alepha 0.14.4 → 0.15.0

package/dist/server/auth/index.d.ts

@@ -1,9 +1,9 @@
-import * as alepha165 from "alepha";
+import * as alepha181 from "alepha";
 import { Alepha, Async, KIND, Primitive, Static } from "alepha";
 import * as alepha_server_cookies0 from "alepha/server/cookies";
 import { Cookies, ServerCookiesProvider } from "alepha/server/cookies";
 import { DateTimeProvider } from "alepha/datetime";
-import { AccessTokenResponse, RealmPrimitive, SecurityProvider, UserAccount } from "alepha/security";
+import { AccessTokenResponse, IssuerPrimitive, SecurityProvider, UserAccount } from "alepha/security";
 import { Configuration } from "openid-client";
 import * as alepha_logger0 from "alepha/logger";
 import * as alepha_server0 from "alepha/server";
@@ -20,45 +20,45 @@ declare const alephaServerAuthRoutes: {
 };
 //#endregion
 //#region ../../src/server/auth/schemas/authenticationProviderSchema.d.ts
-declare const authenticationProviderSchema: alepha165.TObject<{
-  name: alepha165.TString;
-  type: alepha165.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+declare const authenticationProviderSchema: alepha181.TObject<{
+  name: alepha181.TString;
+  type: alepha181.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
 }>;
 type AuthenticationProvider = Static<typeof authenticationProviderSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokenResponseSchema.d.ts
-declare const tokenResponseSchema: alepha165.TObject<{
-  provider: alepha165.TString;
-  access_token: alepha165.TString;
-  issued_at: alepha165.TNumber;
-  expires_in: alepha165.TOptional<alepha165.TNumber>;
-  refresh_token: alepha165.TOptional<alepha165.TString>;
-  refresh_token_expires_in: alepha165.TOptional<alepha165.TNumber>;
-  refresh_expires_in: alepha165.TOptional<alepha165.TNumber>;
-  id_token: alepha165.TOptional<alepha165.TString>;
-  scope: alepha165.TOptional<alepha165.TString>;
-  user: alepha165.TObject<{
-    id: alepha165.TString;
-    name: alepha165.TOptional<alepha165.TString>;
-    email: alepha165.TOptional<alepha165.TString>;
-    username: alepha165.TOptional<alepha165.TString>;
-    picture: alepha165.TOptional<alepha165.TString>;
-    sessionId: alepha165.TOptional<alepha165.TString>;
-    organizations: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
-    roles: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
+declare const tokenResponseSchema: alepha181.TObject<{
+  provider: alepha181.TString;
+  access_token: alepha181.TString;
+  issued_at: alepha181.TNumber;
+  expires_in: alepha181.TOptional<alepha181.TNumber>;
+  refresh_token: alepha181.TOptional<alepha181.TString>;
+  refresh_token_expires_in: alepha181.TOptional<alepha181.TNumber>;
+  refresh_expires_in: alepha181.TOptional<alepha181.TNumber>;
+  id_token: alepha181.TOptional<alepha181.TString>;
+  scope: alepha181.TOptional<alepha181.TString>;
+  user: alepha181.TObject<{
+    id: alepha181.TString;
+    name: alepha181.TOptional<alepha181.TString>;
+    email: alepha181.TOptional<alepha181.TString>;
+    username: alepha181.TOptional<alepha181.TString>;
+    picture: alepha181.TOptional<alepha181.TString>;
+    sessionId: alepha181.TOptional<alepha181.TString>;
+    organizations: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
+    roles: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
   }>;
-  api: alepha165.TObject<{
-    prefix: alepha165.TOptional<alepha165.TString>;
-    links: alepha165.TArray<alepha165.TObject<{
-      name: alepha165.TString;
-      group: alepha165.TOptional<alepha165.TString>;
-      path: alepha165.TString;
-      method: alepha165.TOptional<alepha165.TString>;
-      requestBodyType: alepha165.TOptional<alepha165.TString>;
-      service: alepha165.TOptional<alepha165.TString>;
-      rawSchema: alepha165.TOptional<alepha165.TObject<{
-        body: alepha165.TOptional<alepha165.TString>;
-        response: alepha165.TOptional<alepha165.TString>;
+  api: alepha181.TObject<{
+    prefix: alepha181.TOptional<alepha181.TString>;
+    links: alepha181.TArray<alepha181.TObject<{
+      name: alepha181.TString;
+      group: alepha181.TOptional<alepha181.TString>;
+      path: alepha181.TString;
+      method: alepha181.TOptional<alepha181.TString>;
+      requestBodyType: alepha181.TOptional<alepha181.TString>;
+      service: alepha181.TOptional<alepha181.TString>;
+      rawSchema: alepha181.TOptional<alepha181.TObject<{
+        body: alepha181.TOptional<alepha181.TString>;
+        response: alepha181.TOptional<alepha181.TString>;
       }>>;
     }>>;
   }>;
@@ -66,43 +66,43 @@ declare const tokenResponseSchema: alepha165.TObject<{
 type TokenResponse = Static<typeof tokenResponseSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokensSchema.d.ts
-declare const tokensSchema: alepha165.TObject<{
-  provider: alepha165.TString;
-  access_token: alepha165.TString;
-  issued_at: alepha165.TNumber;
-  expires_in: alepha165.TOptional<alepha165.TNumber>;
-  refresh_token: alepha165.TOptional<alepha165.TString>;
-  refresh_token_expires_in: alepha165.TOptional<alepha165.TNumber>;
-  refresh_expires_in: alepha165.TOptional<alepha165.TNumber>;
-  id_token: alepha165.TOptional<alepha165.TString>;
-  scope: alepha165.TOptional<alepha165.TString>;
+declare const tokensSchema: alepha181.TObject<{
+  provider: alepha181.TString;
+  access_token: alepha181.TString;
+  issued_at: alepha181.TNumber;
+  expires_in: alepha181.TOptional<alepha181.TNumber>;
+  refresh_token: alepha181.TOptional<alepha181.TString>;
+  refresh_token_expires_in: alepha181.TOptional<alepha181.TNumber>;
+  refresh_expires_in: alepha181.TOptional<alepha181.TNumber>;
+  id_token: alepha181.TOptional<alepha181.TString>;
+  scope: alepha181.TOptional<alepha181.TString>;
 }>;
 type Tokens = Static<typeof tokensSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/userinfoResponseSchema.d.ts
-declare const userinfoResponseSchema: alepha165.TObject<{
-  user: alepha165.TOptional<alepha165.TObject<{
-    id: alepha165.TString;
-    name: alepha165.TOptional<alepha165.TString>;
-    email: alepha165.TOptional<alepha165.TString>;
-    username: alepha165.TOptional<alepha165.TString>;
-    picture: alepha165.TOptional<alepha165.TString>;
-    sessionId: alepha165.TOptional<alepha165.TString>;
-    organizations: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
-    roles: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
+declare const userinfoResponseSchema: alepha181.TObject<{
+  user: alepha181.TOptional<alepha181.TObject<{
+    id: alepha181.TString;
+    name: alepha181.TOptional<alepha181.TString>;
+    email: alepha181.TOptional<alepha181.TString>;
+    username: alepha181.TOptional<alepha181.TString>;
+    picture: alepha181.TOptional<alepha181.TString>;
+    sessionId: alepha181.TOptional<alepha181.TString>;
+    organizations: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
+    roles: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
   }>>;
-  api: alepha165.TObject<{
-    prefix: alepha165.TOptional<alepha165.TString>;
-    links: alepha165.TArray<alepha165.TObject<{
-      name: alepha165.TString;
-      group: alepha165.TOptional<alepha165.TString>;
-      path: alepha165.TString;
-      method: alepha165.TOptional<alepha165.TString>;
-      requestBodyType: alepha165.TOptional<alepha165.TString>;
-      service: alepha165.TOptional<alepha165.TString>;
-      rawSchema: alepha165.TOptional<alepha165.TObject<{
-        body: alepha165.TOptional<alepha165.TString>;
-        response: alepha165.TOptional<alepha165.TString>;
+  api: alepha181.TObject<{
+    prefix: alepha181.TOptional<alepha181.TString>;
+    links: alepha181.TArray<alepha181.TObject<{
+      name: alepha181.TString;
+      group: alepha181.TOptional<alepha181.TString>;
+      path: alepha181.TString;
+      method: alepha181.TOptional<alepha181.TString>;
+      requestBodyType: alepha181.TOptional<alepha181.TString>;
+      service: alepha181.TOptional<alepha181.TString>;
+      rawSchema: alepha181.TOptional<alepha181.TObject<{
+        body: alepha181.TOptional<alepha181.TString>;
+        response: alepha181.TOptional<alepha181.TString>;
       }>>;
     }>>;
   }>;
@@ -116,173 +116,173 @@ declare class ServerAuthProvider {
   protected readonly serverCookiesProvider: ServerCookiesProvider;
   protected readonly dateTimeProvider: DateTimeProvider;
   protected readonly serverLinksProvider: ServerLinksProvider;
-  protected readonly authorizationCode: alepha_server_cookies0.AbstractCookiePrimitive<alepha165.TObject<{
-    provider: alepha165.TString;
-    realm: alepha165.TOptional<alepha165.TString>;
-    codeVerifier: alepha165.TOptional<alepha165.TString>;
-    redirectUri: alepha165.TOptional<alepha165.TString>;
-    state: alepha165.TOptional<alepha165.TString>;
-    nonce: alepha165.TOptional<alepha165.TString>;
+  protected readonly authorizationCode: alepha_server_cookies0.AbstractCookiePrimitive<alepha181.TObject<{
+    provider: alepha181.TString;
+    realm: alepha181.TOptional<alepha181.TString>;
+    codeVerifier: alepha181.TOptional<alepha181.TString>;
+    redirectUri: alepha181.TOptional<alepha181.TString>;
+    state: alepha181.TOptional<alepha181.TString>;
+    nonce: alepha181.TOptional<alepha181.TString>;
   }>>;
-  readonly tokens: alepha_server_cookies0.AbstractCookiePrimitive<alepha165.TObject<{
-    provider: alepha165.TString;
-    access_token: alepha165.TString;
-    issued_at: alepha165.TNumber;
-    expires_in: alepha165.TOptional<alepha165.TNumber>;
-    refresh_token: alepha165.TOptional<alepha165.TString>;
-    refresh_token_expires_in: alepha165.TOptional<alepha165.TNumber>;
-    refresh_expires_in: alepha165.TOptional<alepha165.TNumber>;
-    id_token: alepha165.TOptional<alepha165.TString>;
-    scope: alepha165.TOptional<alepha165.TString>;
+  readonly tokens: alepha_server_cookies0.AbstractCookiePrimitive<alepha181.TObject<{
+    provider: alepha181.TString;
+    access_token: alepha181.TString;
+    issued_at: alepha181.TNumber;
+    expires_in: alepha181.TOptional<alepha181.TNumber>;
+    refresh_token: alepha181.TOptional<alepha181.TString>;
+    refresh_token_expires_in: alepha181.TOptional<alepha181.TNumber>;
+    refresh_expires_in: alepha181.TOptional<alepha181.TNumber>;
+    id_token: alepha181.TOptional<alepha181.TString>;
+    scope: alepha181.TOptional<alepha181.TString>;
   }>>;
   get identities(): Array<AuthPrimitive>;
   getAuthenticationProviders(filters?: {
     realmName?: string;
   }): AuthenticationProvider[];
-  protected readonly configure: alepha165.HookPrimitive<"configure">;
+  protected readonly configure: alepha181.HookPrimitive<"configure">;
   protected getAccessTokens(tokens: Tokens): string | undefined;
   /**
-   * Fill request headers with access token from cookies or fallback to provider's fallback function.
-   */
-  protected readonly onRequest: alepha165.HookPrimitive<"server:onRequest">;
+       * Fill request headers with access token from cookies or fallback to provider's fallback function.
+       */
+  protected readonly onRequest: alepha181.HookPrimitive<"server:onRequest">;
   /**
-   * Convert cookies to tokens.
-   * If the tokens are expired, try to refresh them using the refresh token.
-   */
+       * Convert cookies to tokens.
+       * If the tokens are expired, try to refresh them using the refresh token.
+       */
   protected cookiesToTokens(cookies: Cookies): Promise<Tokens | undefined>;
   protected refreshTokens(tokens: Tokens): Promise<Tokens | undefined>;
   /**
-   * Get user information.
-   */
+       * Get user information.
+       */
   readonly userinfo: alepha_server0.RoutePrimitive<{
-    response: alepha165.TObject<{
-      user: alepha165.TOptional<alepha165.TObject<{
-        id: alepha165.TString;
-        name: alepha165.TOptional<alepha165.TString>;
-        email: alepha165.TOptional<alepha165.TString>;
-        username: alepha165.TOptional<alepha165.TString>;
-        picture: alepha165.TOptional<alepha165.TString>;
-        sessionId: alepha165.TOptional<alepha165.TString>;
-        organizations: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
-        roles: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
+    response: alepha181.TObject<{
+      user: alepha181.TOptional<alepha181.TObject<{
+        id: alepha181.TString;
+        name: alepha181.TOptional<alepha181.TString>;
+        email: alepha181.TOptional<alepha181.TString>;
+        username: alepha181.TOptional<alepha181.TString>;
+        picture: alepha181.TOptional<alepha181.TString>;
+        sessionId: alepha181.TOptional<alepha181.TString>;
+        organizations: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
+        roles: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
       }>>;
-      api: alepha165.TObject<{
-        prefix: alepha165.TOptional<alepha165.TString>;
-        links: alepha165.TArray<alepha165.TObject<{
-          name: alepha165.TString;
-          group: alepha165.TOptional<alepha165.TString>;
-          path: alepha165.TString;
-          method: alepha165.TOptional<alepha165.TString>;
-          requestBodyType: alepha165.TOptional<alepha165.TString>;
-          service: alepha165.TOptional<alepha165.TString>;
-          rawSchema: alepha165.TOptional<alepha165.TObject<{
-            body: alepha165.TOptional<alepha165.TString>;
-            response: alepha165.TOptional<alepha165.TString>;
+      api: alepha181.TObject<{
+        prefix: alepha181.TOptional<alepha181.TString>;
+        links: alepha181.TArray<alepha181.TObject<{
+          name: alepha181.TString;
+          group: alepha181.TOptional<alepha181.TString>;
+          path: alepha181.TString;
+          method: alepha181.TOptional<alepha181.TString>;
+          requestBodyType: alepha181.TOptional<alepha181.TString>;
+          service: alepha181.TOptional<alepha181.TString>;
+          rawSchema: alepha181.TOptional<alepha181.TObject<{
+            body: alepha181.TOptional<alepha181.TString>;
+            response: alepha181.TOptional<alepha181.TString>;
           }>>;
         }>>;
       }>;
     }>;
   }>;
   /**
-   * Refresh a token for internal providers.
-   */
+       * Refresh a token for internal providers.
+       */
   readonly refresh: alepha_server0.RoutePrimitive<{
-    query: alepha165.TObject<{
-      provider: alepha165.TString;
+    query: alepha181.TObject<{
+      provider: alepha181.TString;
     }>;
-    body: alepha165.TObject<{
-      refresh_token: alepha165.TString;
-      access_token: alepha165.TOptional<alepha165.TString>;
+    body: alepha181.TObject<{
+      refresh_token: alepha181.TString;
+      access_token: alepha181.TOptional<alepha181.TString>;
     }>;
-    response: alepha165.TObject<{
-      provider: alepha165.TString;
-      access_token: alepha165.TString;
-      issued_at: alepha165.TNumber;
-      expires_in: alepha165.TOptional<alepha165.TNumber>;
-      refresh_token: alepha165.TOptional<alepha165.TString>;
-      refresh_token_expires_in: alepha165.TOptional<alepha165.TNumber>;
-      refresh_expires_in: alepha165.TOptional<alepha165.TNumber>;
-      id_token: alepha165.TOptional<alepha165.TString>;
-      scope: alepha165.TOptional<alepha165.TString>;
+    response: alepha181.TObject<{
+      provider: alepha181.TString;
+      access_token: alepha181.TString;
+      issued_at: alepha181.TNumber;
+      expires_in: alepha181.TOptional<alepha181.TNumber>;
+      refresh_token: alepha181.TOptional<alepha181.TString>;
+      refresh_token_expires_in: alepha181.TOptional<alepha181.TNumber>;
+      refresh_expires_in: alepha181.TOptional<alepha181.TNumber>;
+      id_token: alepha181.TOptional<alepha181.TString>;
+      scope: alepha181.TOptional<alepha181.TString>;
     }>;
   }>;
   /**
-   * Login for local password-based authentication.
-   */
+       * Login for local password-based authentication.
+       */
   readonly token: alepha_server0.RoutePrimitive<{
-    query: alepha165.TObject<{
-      provider: alepha165.TString;
-      realm: alepha165.TOptional<alepha165.TString>;
+    query: alepha181.TObject<{
+      provider: alepha181.TString;
+      realm: alepha181.TOptional<alepha181.TString>;
     }>;
-    body: alepha165.TObject<{
-      username: alepha165.TString;
-      password: alepha165.TString;
+    body: alepha181.TObject<{
+      username: alepha181.TString;
+      password: alepha181.TString;
     }>;
-    response: alepha165.TObject<{
-      provider: alepha165.TString;
-      access_token: alepha165.TString;
-      issued_at: alepha165.TNumber;
-      expires_in: alepha165.TOptional<alepha165.TNumber>;
-      refresh_token: alepha165.TOptional<alepha165.TString>;
-      refresh_token_expires_in: alepha165.TOptional<alepha165.TNumber>;
-      refresh_expires_in: alepha165.TOptional<alepha165.TNumber>;
-      id_token: alepha165.TOptional<alepha165.TString>;
-      scope: alepha165.TOptional<alepha165.TString>;
-      user: alepha165.TObject<{
-        id: alepha165.TString;
-        name: alepha165.TOptional<alepha165.TString>;
-        email: alepha165.TOptional<alepha165.TString>;
-        username: alepha165.TOptional<alepha165.TString>;
-        picture: alepha165.TOptional<alepha165.TString>;
-        sessionId: alepha165.TOptional<alepha165.TString>;
-        organizations: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
-        roles: alepha165.TOptional<alepha165.TArray<alepha165.TString>>;
+    response: alepha181.TObject<{
+      provider: alepha181.TString;
+      access_token: alepha181.TString;
+      issued_at: alepha181.TNumber;
+      expires_in: alepha181.TOptional<alepha181.TNumber>;
+      refresh_token: alepha181.TOptional<alepha181.TString>;
+      refresh_token_expires_in: alepha181.TOptional<alepha181.TNumber>;
+      refresh_expires_in: alepha181.TOptional<alepha181.TNumber>;
+      id_token: alepha181.TOptional<alepha181.TString>;
+      scope: alepha181.TOptional<alepha181.TString>;
+      user: alepha181.TObject<{
+        id: alepha181.TString;
+        name: alepha181.TOptional<alepha181.TString>;
+        email: alepha181.TOptional<alepha181.TString>;
+        username: alepha181.TOptional<alepha181.TString>;
+        picture: alepha181.TOptional<alepha181.TString>;
+        sessionId: alepha181.TOptional<alepha181.TString>;
+        organizations: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
+        roles: alepha181.TOptional<alepha181.TArray<alepha181.TString>>;
       }>;
-      api: alepha165.TObject<{
-        prefix: alepha165.TOptional<alepha165.TString>;
-        links: alepha165.TArray<alepha165.TObject<{
-          name: alepha165.TString;
-          group: alepha165.TOptional<alepha165.TString>;
-          path: alepha165.TString;
-          method: alepha165.TOptional<alepha165.TString>;
-          requestBodyType: alepha165.TOptional<alepha165.TString>;
-          service: alepha165.TOptional<alepha165.TString>;
-          rawSchema: alepha165.TOptional<alepha165.TObject<{
-            body: alepha165.TOptional<alepha165.TString>;
-            response: alepha165.TOptional<alepha165.TString>;
+      api: alepha181.TObject<{
+        prefix: alepha181.TOptional<alepha181.TString>;
+        links: alepha181.TArray<alepha181.TObject<{
+          name: alepha181.TString;
+          group: alepha181.TOptional<alepha181.TString>;
+          path: alepha181.TString;
+          method: alepha181.TOptional<alepha181.TString>;
+          requestBodyType: alepha181.TOptional<alepha181.TString>;
+          service: alepha181.TOptional<alepha181.TString>;
+          rawSchema: alepha181.TOptional<alepha181.TObject<{
+            body: alepha181.TOptional<alepha181.TString>;
+            response: alepha181.TOptional<alepha181.TString>;
           }>>;
         }>>;
       }>;
     }>;
   }>;
   /**
-   * Oauth2/OIDC login route.
-   */
+       * Oauth2/OIDC login route.
+       */
   readonly login: alepha_server0.RoutePrimitive<{
-    query: alepha165.TObject<{
-      provider: alepha165.TString;
-      realm: alepha165.TOptional<alepha165.TString>;
-      redirect_uri: alepha165.TOptional<alepha165.TString>;
+    query: alepha181.TObject<{
+      provider: alepha181.TString;
+      realm: alepha181.TOptional<alepha181.TString>;
+      redirect_uri: alepha181.TOptional<alepha181.TString>;
     }>;
   }>;
   /**
-   * Callback for OAuth2/OIDC providers.
-   * It handles the authorization code flow and retrieves the access token.
-   */
+       * Callback for OAuth2/OIDC providers.
+       * It handles the authorization code flow and retrieves the access token.
+       */
   readonly callback: alepha_server0.RoutePrimitive<alepha_server0.RequestConfigSchema>;
   /**
-   * Logout route for OAuth2/OIDC providers.
-   */
+       * Logout route for OAuth2/OIDC providers.
+       */
   readonly logout: alepha_server0.RoutePrimitive<{
-    query: alepha165.TObject<{
-      post_logout_redirect_uri: alepha165.TOptional<alepha165.TString>;
+    query: alepha181.TObject<{
+      post_logout_redirect_uri: alepha181.TOptional<alepha181.TString>;
     }>;
   }>;
   /**
-   * Find an auth provider by name and optionally by realm.
-   * When realm is specified, it filters providers by both name and realm.
-   * This enables multi-realm setups where multiple providers share the same name (e.g., "credentials").
-   */
+       * Find an auth provider by name and optionally by realm.
+       * When realm is specified, it filters providers by both name and realm.
+       * This enables multi-realm setups where multiple providers share the same name (e.g., "credentials").
+       */
   protected provider(opts: string | {
     provider: string;
     realm?: string;
@@ -362,13 +362,13 @@ declare const $auth: {
 };
 type AuthPrimitiveOptions = {
   /**
-   * Name of the identity provider.
-   * If not provided, it will be derived from the property key.
-   */
+       * Name of the identity provider.
+       * If not provided, it will be derived from the property key.
+       */
   name?: string;
   /**
-   * If true, auth provider will be skipped.
-   */
+       * If true, auth provider will be skipped.
+       */
   disabled?: boolean;
 } & (AuthExternal | AuthInternal);
 /**
@@ -376,60 +376,60 @@ type AuthPrimitiveOptions = {
  */
 type AuthExternal = {
   /**
-   * Only OIDC is supported for external authentication.
-   */
+       * Only OIDC is supported for external authentication.
+       */
   oidc: OidcOptions;
   /**
-   * For anonymous access, this will expect a service account access token.
-   *
-   * ```ts
-   * class App {
-   *   anonymous = $serviceAccount(...);
-   *   auth = $auth({
-   *     // ... config ...
-   *     fallback: this.anonymous,
-   *   })
-   * }
-   * ```
-   */
+       * For anonymous access, this will expect a service account access token.
+       *
+       * ```ts
+       * class App {
+       *   anonymous = $serviceAccount(...);
+       *   auth = $auth({
+       *     // ... config ...
+       *     fallback: this.anonymous,
+       *   })
+       * }
+       * ```
+       */
   fallback?: () => Async<AccessToken>;
 };
 /**
  * When using your own authentication system, e.g. using a database to store user accounts.
  * This is usually used with a custom login form.
  *
- * This relies on the `realm`, which is used to create/verify the access token.
+ * This relies on the `issuer`, which is used to create/verify the access token.
  */
 type AuthInternal = {
-  realm: RealmPrimitive;
+  issuer: IssuerPrimitive;
 } & ({
   /**
-   * The common username/password authentication.
-   *
-   * - It uses the OAuth2 Client Credentials flow to obtain an access token.
-   *
-   * This is usually used with a custom login form on your website or mobile app.
-   */
+       * The common username/password authentication.
+       *
+       * - It uses the OAuth2 Client Credentials flow to obtain an access token.
+       *
+       * This is usually used with a custom login form on your website or mobile app.
+       */
   credentials: CredentialsOptions;
 } | {
   /**
-   * OAuth2 authentication. Delegates authentication to an OAuth2 provider. (e.g. Google, GitHub, etc.)
-   *
-   * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
-   *
-   * This is usually used with a login button that redirects to the OAuth2 provider.
-   */
+       * OAuth2 authentication. Delegates authentication to an OAuth2 provider. (e.g. Google, GitHub, etc.)
+       *
+       * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
+       *
+       * This is usually used with a login button that redirects to the OAuth2 provider.
+       */
   oauth: OAuth2Options;
 } | {
   /**
-   * Like OAuth2, but uses OIDC (OpenID Connect) for authentication and user information retrieval.
-   * OIDC is an identity layer on top of OAuth2, providing user authentication and profile information.
-   *
-   * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
-   * - PCKE (Proof Key for Code Exchange) is recommended for security.
-   *
-   * This is usually used with a login button that redirects to the OIDC provider.
-   */
+       * Like OAuth2, but uses OIDC (OpenID Connect) for authentication and user information retrieval.
+       * OIDC is an identity layer on top of OAuth2, providing user authentication and profile information.
+       *
+       * - It uses the OAuth2 Authorization Code flow to obtain an access token and user information.
+       * - PCKE (Proof Key for Code Exchange) is recommended for security.
+       *
+       * This is usually used with a login button that redirects to the OIDC provider.
+       */
   oidc: OidcOptions;
 });
 type CredentialsOptions = {
@@ -442,36 +442,36 @@ interface Credentials {
 }
 interface OidcOptions {
   /**
-   * URL of the OIDC issuer.
-   */
+       * URL of the OIDC issuer.
+       */
   issuer: string;
   /**
-   * Client ID for the OIDC client.
-   */
+       * Client ID for the OIDC client.
+       */
   clientId: string;
   /**
-   * Client secret for the OIDC client.
-   * Optional if PKCE (Proof Key for Code Exchange) is used.
-   */
+       * Client secret for the OIDC client.
+       * Optional if PKCE (Proof Key for Code Exchange) is used.
+       */
   clientSecret?: string;
   /**
-   * Redirect URI for the OIDC client.
-   * This is where the user will be redirected after authentication.
-   */
+       * Redirect URI for the OIDC client.
+       * This is where the user will be redirected after authentication.
+       */
   redirectUri?: string;
   /**
-   * For external auth providers only.
-   * Take the ID token instead of the access token for validation.
-   */
+       * For external auth providers only.
+       * Take the ID token instead of the access token for validation.
+       */
   useIdToken?: boolean;
   /**
-   * URI to redirect the user after logout.
-   */
+       * URI to redirect the user after logout.
+       */
   logoutUri?: string;
   /**
-   * Optional scope for the OIDC client.
-   * @default "openid profile email".
-   */
+       * Optional scope for the OIDC client.
+       * @default "openid profile email".
+       */
   scope?: string;
   account?: LinkAccountFn;
 }
@@ -485,33 +485,33 @@ interface LinkAccountOptions {
 type LinkAccountFn = (tokens: LinkAccountOptions) => Async<UserAccount>;
 interface OAuth2Options {
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   clientId: string;
   /**
-   * Client secret for the OAuth2 client.
-   */
+       * Client secret for the OAuth2 client.
+       */
   clientSecret: string;
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   authorization: string;
   /**
-   * URL of the OAuth2 token endpoint.
-   */
+       * URL of the OAuth2 token endpoint.
+       */
   token: string;
   /**
-   * Function to retrieve user profile information from the OAuth2 tokens.
-   */
+       * Function to retrieve user profile information from the OAuth2 tokens.
+       */
   userinfo: (tokens: Tokens) => Async<OAuth2Profile>;
   account?: LinkAccountFn;
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   redirectUri?: string;
   /**
-   * URL of the OAuth2 authorization endpoint.
-   */
+       * URL of the OAuth2 authorization endpoint.
+       */
   scope?: string;
 }
 declare class AuthPrimitive extends Primitive<AuthPrimitiveOptions> {
@@ -519,19 +519,19 @@ declare class AuthPrimitive extends Primitive<AuthPrimitiveOptions> {
   protected readonly dateTimeProvider: DateTimeProvider;
   oauth?: Configuration;
   get name(): string;
-  get realm(): RealmPrimitive | undefined;
+  get issuer(): IssuerPrimitive | undefined;
   get jwks_uri(): string;
   get scope(): string | undefined;
   get redirect_uri(): string | undefined;
   /**
-   * Refreshes the access token using the refresh token.
-   * Can be used on oauth2, oidc or credentials auth providers.
-   */
+       * Refreshes the access token using the refresh token.
+       * Can be used on oauth2, oidc or credentials auth providers.
+       */
   refresh(refreshToken: string, accessToken?: string): Promise<AccessTokenResponse>;
   /**
-   * Extracts user information from the access token.
-   * This is used to create a user account from the access token.
-   */
+       * Extracts user information from the access token.
+       * This is used to create a user account from the access token.
+       */
   user(tokens: Tokens): Promise<UserAccount>;
   protected getUserFromIdToken(idToken: string): OAuth2Profile;
   prepare(): Promise<void>;
@@ -552,7 +552,7 @@ interface WithLoginFn {
  *
  * Uses username and password to authenticate users.
  */
-declare const $authCredentials: (realm: RealmPrimitive & WithLoginFn, options?: Partial<CredentialsOptions>) => AuthPrimitive;
+declare const $authCredentials: (realm: IssuerPrimitive & WithLoginFn, options?: Partial<CredentialsOptions>) => AuthPrimitive;
 //#endregion
 //#region ../../src/server/auth/primitives/$authGithub.d.ts
 /**
@@ -565,7 +565,7 @@ declare const $authCredentials: (realm: RealmPrimitive & WithLoginFn, options?:
  * - `GITHUB_CLIENT_ID`: The client ID obtained from the GitHub Developer Settings.
  * - `GITHUB_CLIENT_SECRET`: The client secret obtained from the GitHub Developer Settings.
  */
-declare const $authGithub: (realm: RealmPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
+declare const $authGithub: (realm: IssuerPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
 //#endregion
 //#region ../../src/server/auth/primitives/$authGoogle.d.ts
 /**
@@ -578,16 +578,16 @@ declare const $authGithub: (realm: RealmPrimitive & WithLinkFn, options?: Partia
  * - `GOOGLE_CLIENT_ID`: The client ID obtained from the Google Developer Console.
  * - `GOOGLE_CLIENT_SECRET`: The client secret obtained from the Google Developer Console.
  */
-declare const $authGoogle: (realm: RealmPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
+declare const $authGoogle: (realm: IssuerPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
 //#endregion
 //#region ../../src/server/auth/index.d.ts
 declare module "alepha" {
   interface State {
     /**
-     * The authenticated user account attached to the server request state.
-     *
-     * @internal
-     */
+             * The authenticated user account attached to the server request state.
+             *
+             * @internal
+             */
     "alepha.server.request.user"?: UserAccount;
   }
 }
@@ -604,7 +604,7 @@ declare module "alepha" {
  * @see {@link ServerAuthProvider}
  * @module alepha.server.auth
  */
-declare const AlephaServerAuth: alepha165.Service<alepha165.Module>;
+declare const AlephaServerAuth: alepha181.Service<alepha181.Module>;
 //#endregion
 export { $auth, $authCredentials, $authGithub, $authGoogle, AccessToken, AlephaServerAuth, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, TokenResponse, Tokens, UserinfoResponse, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, authenticationProviderSchema, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
 //# sourceMappingURL=index.d.ts.map