alepha 0.22.0 → 0.24.0

package/dist/server/auth/index.browser.js

@@ -1,4 +1,4 @@
-import { $module, t } from "alepha";
+import { $module, z } from "alepha";
 import { userAccountInfoSchema } from "alepha/security";
 import { apiRegistryResponseSchema } from "alepha/server/links";
 //#region ../../src/server/auth/constants/routes.ts
@@ -12,37 +12,37 @@ const alephaServerAuthRoutes = {
 };
 //#endregion
 //#region ../../src/server/auth/schemas/authenticationProviderSchema.ts
-const authenticationProviderSchema = t.object({
-	name: t.text({ description: "Name of the authentication provider." }),
-	type: t.enum([
+const authenticationProviderSchema = z.object({
+	name: z.text({ description: "Name of the authentication provider." }),
+	type: z.enum([
 		"OAUTH2",
 		"OIDC",
 		"CREDENTIALS"
-	], { description: "Type of the authentication provider." })
-}, { title: "AuthenticationProvider" });
+	]).describe("Type of the authentication provider.")
+}).meta({ title: "AuthenticationProvider" });
 //#endregion
 //#region ../../src/server/auth/schemas/tokensSchema.ts
-const tokensSchema = t.object({
-	provider: t.text(),
-	access_token: t.text({ size: "rich" }),
-	issued_at: t.number(),
-	expires_in: t.optional(t.number()),
-	refresh_token: t.optional(t.text({ size: "rich" })),
-	refresh_token_expires_in: t.optional(t.number()),
-	refresh_expires_in: t.optional(t.number({ description: "Alias of `refresh_token_expires_in` for compatibility with some providers." })),
-	id_token: t.optional(t.text({ size: "rich" })),
-	scope: t.optional(t.text())
+const tokensSchema = z.object({
+	provider: z.text(),
+	access_token: z.text({ size: "rich" }),
+	issued_at: z.number(),
+	expires_in: z.number().optional(),
+	refresh_token: z.text({ size: "rich" }).optional(),
+	refresh_token_expires_in: z.number().optional(),
+	refresh_expires_in: z.number().describe("Alias of `refresh_token_expires_in` for compatibility with some providers.").optional(),
+	id_token: z.text({ size: "rich" }).optional(),
+	scope: z.text().optional()
 });
 //#endregion
 //#region ../../src/server/auth/schemas/tokenResponseSchema.ts
-const tokenResponseSchema = t.extend(tokensSchema, {
+const tokenResponseSchema = tokensSchema.extend({
 	user: userAccountInfoSchema,
 	api: apiRegistryResponseSchema
 });
 //#endregion
 //#region ../../src/server/auth/schemas/userinfoResponseSchema.ts
-const userinfoResponseSchema = t.object({
-	user: t.optional(userAccountInfoSchema),
+const userinfoResponseSchema = z.object({
+	user: userAccountInfoSchema.optional(),
 	api: apiRegistryResponseSchema
 });
 //#endregion

package/dist/server/auth/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../src/server/auth/index.browser.ts"],"sourcesContent":["export const alephaServerAuthRoutes = {\n  login: \"/oauth/login\",\n  callback: \"/oauth/callback\",\n  logout: \"/oauth/logout\",\n  token: \"/_auth/token\",\n  refresh: \"/_auth/refresh\",\n  userinfo: \"/_auth/userinfo\",\n};\n","import { type Static, t } from \"alepha\";\n\nexport const authenticationProviderSchema = t.object(\n  {\n    name: t.text({\n      description: \"Name of the authentication provider.\",\n    }),\n    type: t.enum([\"OAUTH2\", \"OIDC\", \"CREDENTIALS\"], {\n      description: \"Type of the authentication provider.\",\n    }),\n  },\n  {\n    title: \"AuthenticationProvider\",\n  },\n);\n\nexport type AuthenticationProvider = Static<\n  typeof authenticationProviderSchema\n>;\n","import type { Static } from \"alepha\";\nimport { t } from \"alepha\";\n\nexport const tokensSchema = t.object({\n  provider: t.text(),\n  access_token: t.text({ size: \"rich\" }),\n  issued_at: t.number(),\n  expires_in: t.optional(t.number()),\n  refresh_token: t.optional(t.text({ size: \"rich\" })),\n  refresh_token_expires_in: t.optional(t.number()),\n  refresh_expires_in: t.optional(\n    t.number({\n      description:\n        \"Alias of `refresh_token_expires_in` for compatibility with some providers.\",\n    }),\n  ),\n  id_token: t.optional(t.text({ size: \"rich\" })),\n  scope: t.optional(t.text()),\n});\n\nexport type Tokens = Static<typeof tokensSchema>;\n","import { type Static, t } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\nimport { tokensSchema } from \"./tokensSchema.ts\";\n\nexport const tokenResponseSchema = t.extend(tokensSchema, {\n  user: userAccountInfoSchema,\n  api: apiRegistryResponseSchema,\n});\n\nexport type TokenResponse = Static<typeof tokenResponseSchema>;\n","import { type Static, t } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\n\nexport const userinfoResponseSchema = t.object({\n  user: t.optional(userAccountInfoSchema),\n  api: apiRegistryResponseSchema,\n});\n\nexport type UserinfoResponse = Static<typeof userinfoResponseSchema>;\n","import { $module } from \"alepha\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./index.shared.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaServerAuth = $module({\n  name: \"alepha.server.auth\",\n  primitives: [],\n  services: [],\n});\n"],"mappings":";;;;AAAA,MAAa,yBAAyB;CACpC,OAAO;CACP,UAAU;CACV,QAAQ;CACR,OAAO;CACP,SAAS;CACT,UAAU;AACZ;;;ACLA,MAAa,+BAA+B,EAAE,OAC5C;CACE,MAAM,EAAE,KAAK,EACX,aAAa,uCACf,CAAC;CACD,MAAM,EAAE,KAAK;EAAC;EAAU;EAAQ;CAAa,GAAG,EAC9C,aAAa,uCACf,CAAC;AACH,GACA,EACE,OAAO,yBACT,CACF;;;ACXA,MAAa,eAAe,EAAE,OAAO;CACnC,UAAU,EAAE,KAAK;CACjB,cAAc,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;CACrC,WAAW,EAAE,OAAO;CACpB,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;CACjC,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC;CAClD,0BAA0B,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/C,oBAAoB,EAAE,SACpB,EAAE,OAAO,EACP,aACE,6EACJ,CAAC,CACH;CACA,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC;CAC7C,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC;AAC5B,CAAC;;;ACbD,MAAa,sBAAsB,EAAE,OAAO,cAAc;CACxD,MAAM;CACN,KAAK;AACP,CAAC;;;ACJD,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,SAAS,qBAAqB;CACtC,KAAK;AACP,CAAC;;;ACCD,MAAa,mBAAmB,QAAQ;CACtC,MAAM;CACN,YAAY,CAAC;CACb,UAAU,CAAC;AACb,CAAC"}
+{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../src/server/auth/index.browser.ts"],"sourcesContent":["export const alephaServerAuthRoutes = {\n  login: \"/oauth/login\",\n  callback: \"/oauth/callback\",\n  logout: \"/oauth/logout\",\n  token: \"/_auth/token\",\n  refresh: \"/_auth/refresh\",\n  userinfo: \"/_auth/userinfo\",\n};\n","import { type Static, z } from \"alepha\";\n\nexport const authenticationProviderSchema = z\n  .object({\n    name: z.text({\n      description: \"Name of the authentication provider.\",\n    }),\n    type: z\n      .enum([\"OAUTH2\", \"OIDC\", \"CREDENTIALS\"])\n      .describe(\"Type of the authentication provider.\"),\n  })\n  .meta({ title: \"AuthenticationProvider\" });\n\nexport type AuthenticationProvider = Static<\n  typeof authenticationProviderSchema\n>;\n","import type { Static } from \"alepha\";\nimport { z } from \"alepha\";\n\nexport const tokensSchema = z.object({\n  provider: z.text(),\n  access_token: z.text({ size: \"rich\" }),\n  issued_at: z.number(),\n  expires_in: z.number().optional(),\n  refresh_token: z.text({ size: \"rich\" }).optional(),\n  refresh_token_expires_in: z.number().optional(),\n  refresh_expires_in: z\n    .number()\n    .describe(\n      \"Alias of `refresh_token_expires_in` for compatibility with some providers.\",\n    )\n    .optional(),\n  id_token: z.text({ size: \"rich\" }).optional(),\n  scope: z.text().optional(),\n});\n\nexport type Tokens = Static<typeof tokensSchema>;\n","import type { Static } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\nimport { tokensSchema } from \"./tokensSchema.ts\";\n\nexport const tokenResponseSchema = tokensSchema.extend({\n  user: userAccountInfoSchema,\n  api: apiRegistryResponseSchema,\n});\n\nexport type TokenResponse = Static<typeof tokenResponseSchema>;\n","import { type Static, z } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\n\nexport const userinfoResponseSchema = z.object({\n  user: userAccountInfoSchema.optional(),\n  api: apiRegistryResponseSchema,\n});\n\nexport type UserinfoResponse = Static<typeof userinfoResponseSchema>;\n","import { $module } from \"alepha\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./index.shared.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaServerAuth = $module({\n  name: \"alepha.server.auth\",\n  primitives: [],\n  services: [],\n});\n"],"mappings":";;;;AAAA,MAAa,yBAAyB;CACpC,OAAO;CACP,UAAU;CACV,QAAQ;CACR,OAAO;CACP,SAAS;CACT,UAAU;AACZ;;;ACLA,MAAa,+BAA+B,EACzC,OAAO;CACN,MAAM,EAAE,KAAK,EACX,aAAa,uCACf,CAAC;CACD,MAAM,EACH,KAAK;EAAC;EAAU;EAAQ;CAAa,CAAC,CAAC,CACvC,SAAS,sCAAsC;AACpD,CAAC,CAAC,CACD,KAAK,EAAE,OAAO,yBAAyB,CAAC;;;ACR3C,MAAa,eAAe,EAAE,OAAO;CACnC,UAAU,EAAE,KAAK;CACjB,cAAc,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;CACrC,WAAW,EAAE,OAAO;CACpB,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,eAAe,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,SAAS;CACjD,0BAA0B,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9C,oBAAoB,EACjB,OAAO,CAAC,CACR,SACC,4EACF,CAAC,CACA,SAAS;CACZ,UAAU,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,SAAS;CAC5C,OAAO,EAAE,KAAK,CAAC,CAAC,SAAS;AAC3B,CAAC;;;ACbD,MAAa,sBAAsB,aAAa,OAAO;CACrD,MAAM;CACN,KAAK;AACP,CAAC;;;ACJD,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,sBAAsB,SAAS;CACrC,KAAK;AACP,CAAC;;;ACCD,MAAa,mBAAmB,QAAQ;CACtC,MAAM;CACN,YAAY,CAAC;CACb,UAAU,CAAC;AACb,CAAC"}

package/dist/server/auth/index.d.ts

@@ -4,7 +4,17 @@ import { DateTimeProvider } from "alepha/datetime";
 import { AccessTokenResponse, IssuerPrimitive, SecurityProvider, UserAccount } from "alepha/security";
 import { ServerRawRequest, ServerReply } from "alepha/server";
 import { ServerLinksProvider } from "alepha/server/links";
-
+//#region ../../src/server/auth/helpers/appleClientSecret.d.ts
+interface AppleClientSecretOptions {
+  privateKeyPem: string;
+  teamId: string;
+  serviceId: string;
+  keyId: string;
+  ttlSeconds?: number;
+}
+/** Signs Apple's short-lived ES256 client_secret JWT on demand (no rotation job). */
+declare function signAppleClientSecret(opts: AppleClientSecretOptions): Promise<string>;
+//#endregion
 //#region ../../src/server/auth/constants/routes.d.ts
 declare const alephaServerAuthRoutes: {
   login: string;
@@ -16,94 +26,102 @@ declare const alephaServerAuthRoutes: {
 };
 //#endregion
 //#region ../../src/server/auth/schemas/authenticationProviderSchema.d.ts
-declare const authenticationProviderSchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  type: import("typebox").TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
-}>;
+declare const authenticationProviderSchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  type: import("zod").ZodEnum<{
+    CREDENTIALS: "CREDENTIALS";
+    OAUTH2: "OAUTH2";
+    OIDC: "OIDC";
+  }>;
+}, import("zod/v4/core").$strip>;
 type AuthenticationProvider = Static<typeof authenticationProviderSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokenResponseSchema.d.ts
-declare const tokenResponseSchema: import("typebox").TObject<{
-  provider: import("typebox").TString;
-  access_token: import("typebox").TString;
-  issued_at: import("typebox").TNumber;
-  expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_token: import("typebox").TOptional<import("typebox").TString>;
-  refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  id_token: import("typebox").TOptional<import("typebox").TString>;
-  scope: import("typebox").TOptional<import("typebox").TString>;
-  user: import("typebox").TObject<{
-    id: import("typebox").TString;
-    name: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    sessionId: import("typebox").TOptional<import("typebox").TString>;
-    organization: import("typebox").TOptional<import("typebox").TString>;
-    roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-    realm: import("typebox").TOptional<import("typebox").TString>;
-  }>;
-  api: import("typebox").TObject<{
-    prefix: import("typebox").TOptional<import("typebox").TString>;
-    actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-      path: import("typebox").TString;
-      method: import("typebox").TOptional<import("typebox").TString>;
-      contentType: import("typebox").TOptional<import("typebox").TString>;
-      kind: import("typebox").TOptional<import("typebox").TString>;
-      service: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
-    permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-  }>;
-}>;
+declare const tokenResponseSchema: import("zod").ZodObject<{
+  provider: import("zod").ZodString;
+  access_token: import("zod").ZodString;
+  issued_at: import("zod").ZodNumber;
+  expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+  refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  id_token: import("zod").ZodOptional<import("zod").ZodString>;
+  scope: import("zod").ZodOptional<import("zod").ZodString>;
+  user: import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+    organization: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+    realm: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>;
+  api: import("zod").ZodObject<{
+    prefix: import("zod").ZodOptional<import("zod").ZodString>;
+    actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+      path: import("zod").ZodString;
+      method: import("zod").ZodOptional<import("zod").ZodString>;
+      contentType: import("zod").ZodOptional<import("zod").ZodString>;
+      kind: import("zod").ZodOptional<import("zod").ZodString>;
+      service: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
 type TokenResponse = Static<typeof tokenResponseSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokensSchema.d.ts
-declare const tokensSchema: import("typebox").TObject<{
-  provider: import("typebox").TString;
-  access_token: import("typebox").TString;
-  issued_at: import("typebox").TNumber;
-  expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_token: import("typebox").TOptional<import("typebox").TString>;
-  refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  id_token: import("typebox").TOptional<import("typebox").TString>;
-  scope: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const tokensSchema: import("zod").ZodObject<{
+  provider: import("zod").ZodString;
+  access_token: import("zod").ZodString;
+  issued_at: import("zod").ZodNumber;
+  expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+  refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  id_token: import("zod").ZodOptional<import("zod").ZodString>;
+  scope: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type Tokens = Static<typeof tokensSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/userinfoResponseSchema.d.ts
-declare const userinfoResponseSchema: import("typebox").TObject<{
-  user: import("typebox").TOptional<import("typebox").TObject<{
-    id: import("typebox").TString;
-    name: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    sessionId: import("typebox").TOptional<import("typebox").TString>;
-    organization: import("typebox").TOptional<import("typebox").TString>;
-    roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-    realm: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  api: import("typebox").TObject<{
-    prefix: import("typebox").TOptional<import("typebox").TString>;
-    actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-      path: import("typebox").TString;
-      method: import("typebox").TOptional<import("typebox").TString>;
-      contentType: import("typebox").TOptional<import("typebox").TString>;
-      kind: import("typebox").TOptional<import("typebox").TString>;
-      service: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
-    permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-  }>;
-}>;
+declare const userinfoResponseSchema: import("zod").ZodObject<{
+  user: import("zod").ZodOptional<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+    organization: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+    realm: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  api: import("zod").ZodObject<{
+    prefix: import("zod").ZodOptional<import("zod").ZodString>;
+    actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+      path: import("zod").ZodString;
+      method: import("zod").ZodOptional<import("zod").ZodString>;
+      contentType: import("zod").ZodOptional<import("zod").ZodString>;
+      kind: import("zod").ZodOptional<import("zod").ZodString>;
+      service: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
 type UserinfoResponse = Static<typeof userinfoResponseSchema>;
 //#endregion
 //#region ../../../../node_modules/oauth4webapi/build/index.d.ts
 /**
  * JSON Object
  */
-type JsonObject = { [Key in string]?: JsonValue };
+type JsonObject = { [Key in string]?: JsonValue; };
 /**
  * JSON Array
  */
@@ -737,7 +755,7 @@ interface Client {
 /**
  * Removes all Symbol properties from a type
  */
-type OmitSymbolProperties<T> = { [K in keyof T as K extends symbol ? never : K]: T[K] };
+type OmitSymbolProperties<T> = { [K in keyof T as K extends symbol ? never : K]: T[K]; };
 //#endregion
 //#region ../../../../node_modules/openid-client/build/index.d.ts
 /**
@@ -1170,26 +1188,26 @@ declare class ServerAuthProvider {
    */
   protected validateRedirectUri(uri: string): string;
   get identities(): Array<AuthPrimitive>;
-  protected readonly authorizationCode: import("alepha/server/cookies").AbstractCookiePrimitive<import("typebox").TObject<{
-    provider: import("typebox").TString;
-    realm: import("typebox").TOptional<import("typebox").TString>;
-    codeVerifier: import("typebox").TOptional<import("typebox").TString>;
-    redirectUri: import("typebox").TOptional<import("typebox").TString>;
-    loginUri: import("typebox").TOptional<import("typebox").TString>;
-    state: import("typebox").TOptional<import("typebox").TString>;
-    nonce: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  readonly tokens: import("alepha/server/cookies").AbstractCookiePrimitive<import("typebox").TObject<{
-    provider: import("typebox").TString;
-    access_token: import("typebox").TString;
-    issued_at: import("typebox").TNumber;
-    expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-    refresh_token: import("typebox").TOptional<import("typebox").TString>;
-    refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-    refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-    id_token: import("typebox").TOptional<import("typebox").TString>;
-    scope: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
+  protected readonly authorizationCode: import("alepha/server/cookies").AbstractCookiePrimitive<import("zod").ZodObject<{
+    provider: import("zod").ZodString;
+    realm: import("zod").ZodOptional<import("zod").ZodString>;
+    codeVerifier: import("zod").ZodOptional<import("zod").ZodString>;
+    redirectUri: import("zod").ZodOptional<import("zod").ZodString>;
+    loginUri: import("zod").ZodOptional<import("zod").ZodString>;
+    state: import("zod").ZodOptional<import("zod").ZodString>;
+    nonce: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  readonly tokens: import("alepha/server/cookies").AbstractCookiePrimitive<import("zod").ZodObject<{
+    provider: import("zod").ZodString;
+    access_token: import("zod").ZodString;
+    issued_at: import("zod").ZodNumber;
+    expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+    refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+    refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+    refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+    id_token: import("zod").ZodOptional<import("zod").ZodString>;
+    scope: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
   protected readonly configure: import("alepha").HookPrimitive<"configure">;
   /**
    * Fill request headers with access token from cookies or fallback to provider's fallback function.
@@ -1199,109 +1217,113 @@ declare class ServerAuthProvider {
    * Get user information.
    */
   readonly userinfo: import("alepha/server").RoutePrimitive<{
-    response: import("typebox").TObject<{
-      user: import("typebox").TOptional<import("typebox").TObject<{
-        id: import("typebox").TString;
-        name: import("typebox").TOptional<import("typebox").TString>;
-        email: import("typebox").TOptional<import("typebox").TString>;
-        username: import("typebox").TOptional<import("typebox").TString>;
-        picture: import("typebox").TOptional<import("typebox").TString>;
-        sessionId: import("typebox").TOptional<import("typebox").TString>;
-        organization: import("typebox").TOptional<import("typebox").TString>;
-        roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-        realm: import("typebox").TOptional<import("typebox").TString>;
-      }>>;
-      api: import("typebox").TObject<{
-        prefix: import("typebox").TOptional<import("typebox").TString>;
-        actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-          path: import("typebox").TString;
-          method: import("typebox").TOptional<import("typebox").TString>;
-          contentType: import("typebox").TOptional<import("typebox").TString>;
-          kind: import("typebox").TOptional<import("typebox").TString>;
-          service: import("typebox").TOptional<import("typebox").TString>;
-        }>>;
-        permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-      }>;
-    }>;
+    response: import("zod").ZodObject<{
+      user: import("zod").ZodOptional<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodOptional<import("zod").ZodString>;
+        firstName: import("zod").ZodOptional<import("zod").ZodString>;
+        lastName: import("zod").ZodOptional<import("zod").ZodString>;
+        email: import("zod").ZodOptional<import("zod").ZodString>;
+        username: import("zod").ZodOptional<import("zod").ZodString>;
+        picture: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        organization: import("zod").ZodOptional<import("zod").ZodString>;
+        roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+        realm: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      api: import("zod").ZodObject<{
+        prefix: import("zod").ZodOptional<import("zod").ZodString>;
+        actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+          path: import("zod").ZodString;
+          method: import("zod").ZodOptional<import("zod").ZodString>;
+          contentType: import("zod").ZodOptional<import("zod").ZodString>;
+          kind: import("zod").ZodOptional<import("zod").ZodString>;
+          service: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Refresh a token for internal providers.
    */
   readonly refresh: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      provider: import("typebox").TString;
-    }>;
-    body: import("typebox").TObject<{
-      refresh_token: import("typebox").TString;
-      access_token: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      access_token: import("typebox").TString;
-      issued_at: import("typebox").TNumber;
-      expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_token: import("typebox").TOptional<import("typebox").TString>;
-      refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      id_token: import("typebox").TOptional<import("typebox").TString>;
-      scope: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      refresh_token: import("zod").ZodString;
+      access_token: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      access_token: import("zod").ZodString;
+      issued_at: import("zod").ZodNumber;
+      expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+      refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      id_token: import("zod").ZodOptional<import("zod").ZodString>;
+      scope: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Login for local password-based authentication.
    */
   readonly token: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      realm: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      username: import("typebox").TString;
-      password: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      access_token: import("typebox").TString;
-      issued_at: import("typebox").TNumber;
-      expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_token: import("typebox").TOptional<import("typebox").TString>;
-      refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      id_token: import("typebox").TOptional<import("typebox").TString>;
-      scope: import("typebox").TOptional<import("typebox").TString>;
-      user: import("typebox").TObject<{
-        id: import("typebox").TString;
-        name: import("typebox").TOptional<import("typebox").TString>;
-        email: import("typebox").TOptional<import("typebox").TString>;
-        username: import("typebox").TOptional<import("typebox").TString>;
-        picture: import("typebox").TOptional<import("typebox").TString>;
-        sessionId: import("typebox").TOptional<import("typebox").TString>;
-        organization: import("typebox").TOptional<import("typebox").TString>;
-        roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-        realm: import("typebox").TOptional<import("typebox").TString>;
-      }>;
-      api: import("typebox").TObject<{
-        prefix: import("typebox").TOptional<import("typebox").TString>;
-        actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-          path: import("typebox").TString;
-          method: import("typebox").TOptional<import("typebox").TString>;
-          contentType: import("typebox").TOptional<import("typebox").TString>;
-          kind: import("typebox").TOptional<import("typebox").TString>;
-          service: import("typebox").TOptional<import("typebox").TString>;
-        }>>;
-        permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-      }>;
-    }>;
+    query: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      realm: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      username: import("zod").ZodString;
+      password: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      access_token: import("zod").ZodString;
+      issued_at: import("zod").ZodNumber;
+      expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+      refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      id_token: import("zod").ZodOptional<import("zod").ZodString>;
+      scope: import("zod").ZodOptional<import("zod").ZodString>;
+      user: import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodOptional<import("zod").ZodString>;
+        firstName: import("zod").ZodOptional<import("zod").ZodString>;
+        lastName: import("zod").ZodOptional<import("zod").ZodString>;
+        email: import("zod").ZodOptional<import("zod").ZodString>;
+        username: import("zod").ZodOptional<import("zod").ZodString>;
+        picture: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        organization: import("zod").ZodOptional<import("zod").ZodString>;
+        roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+        realm: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>;
+      api: import("zod").ZodObject<{
+        prefix: import("zod").ZodOptional<import("zod").ZodString>;
+        actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+          path: import("zod").ZodString;
+          method: import("zod").ZodOptional<import("zod").ZodString>;
+          contentType: import("zod").ZodOptional<import("zod").ZodString>;
+          kind: import("zod").ZodOptional<import("zod").ZodString>;
+          service: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Oauth2/OIDC login route.
    */
   readonly login: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      realm: import("typebox").TOptional<import("typebox").TString>;
-      redirect_uri: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      realm: import("zod").ZodOptional<import("zod").ZodString>;
+      redirect_uri: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Extracts provider-specific extra profile fields delivered via the
@@ -1316,6 +1338,12 @@ declare class ServerAuthProvider {
    * is passed so openid-client can read the authorization code from the POST body.
    */
   protected handleCallback(url: URL, reply: ServerReply, cookies: Cookies, raw?: ServerRawRequest): Promise<void>;
+  /**
+   * Establish a local session for an already-resolved user: mint realm tokens
+   * and write the `tokens` cookie. Used by the OAuth callback and by federated
+   * (broker) login. `issuer` is the realm issuer (provider.issuer / realm).
+   */
+  establishSession(user: UserAccount, issuer: IssuerPrimitive, providerName: string, cookies: Cookies): Promise<void>;
   /**
    * Callback for OAuth2/OIDC providers.
    * It handles the authorization code flow and retrieves the access token.
@@ -1330,9 +1358,9 @@ declare class ServerAuthProvider {
    * Logout route for OAuth2/OIDC providers.
    */
   readonly logout: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      post_logout_redirect_uri: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      post_logout_redirect_uri: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   getAuthenticationProviders(filters?: {
     realmName?: string;
@@ -1788,5 +1816,5 @@ declare const $authMicrosoft: (realm: IssuerPrimitive & WithLinkFn, options?: Pa
  */
 declare const AlephaServerAuth: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { $auth, $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, AccessToken, AlephaServerAuth, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, TokenResponse, Tokens, UserinfoResponse, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, authenticationProviderSchema, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
+export { $auth, $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, AccessToken, AlephaServerAuth, AppleClientSecretOptions, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, TokenResponse, Tokens, UserinfoResponse, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, authenticationProviderSchema, signAppleClientSecret, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
 //# sourceMappingURL=index.d.ts.map