alepha 0.23.0 → 0.24.0

package/dist/server/auth/index.d.ts

@@ -4,7 +4,6 @@ import { DateTimeProvider } from "alepha/datetime";
 import { AccessTokenResponse, IssuerPrimitive, SecurityProvider, UserAccount } from "alepha/security";
 import { ServerRawRequest, ServerReply } from "alepha/server";
 import { ServerLinksProvider } from "alepha/server/links";
-
 //#region ../../src/server/auth/helpers/appleClientSecret.d.ts
 interface AppleClientSecretOptions {
   privateKeyPem: string;
@@ -16,37 +15,6 @@ interface AppleClientSecretOptions {
 /** Signs Apple's short-lived ES256 client_secret JWT on demand (no rotation job). */
 declare function signAppleClientSecret(opts: AppleClientSecretOptions): Promise<string>;
 //#endregion
-//#region ../../src/server/auth/helpers/federationAssertion.d.ts
-interface FederationProfile {
-  provider: "google" | "apple";
-  sub: string;
-  email?: string;
-  email_verified?: boolean;
-  name?: string;
-  given_name?: string;
-  family_name?: string;
-  picture?: string;
-  is_private_email?: boolean;
-}
-interface SignAssertionOptions {
-  privateKeyPem: string;
-  issuer: string;
-  audience: string;
-  ttlSeconds?: number;
-  jti?: string;
-}
-interface VerifyAssertionOptions {
-  publicKeyPem: string;
-  issuer: string;
-  audience: string;
-}
-interface VerifiedAssertion {
-  profile: FederationProfile;
-  jti: string;
-}
-declare function signFederationAssertion(profile: FederationProfile, opts: SignAssertionOptions): Promise<string>;
-declare function verifyFederationAssertion(token: string, opts: VerifyAssertionOptions): Promise<VerifiedAssertion>;
-//#endregion
 //#region ../../src/server/auth/constants/routes.d.ts
 declare const alephaServerAuthRoutes: {
   login: string;
@@ -58,94 +26,102 @@ declare const alephaServerAuthRoutes: {
 };
 //#endregion
 //#region ../../src/server/auth/schemas/authenticationProviderSchema.d.ts
-declare const authenticationProviderSchema: import("typebox").TObject<{
-  name: import("typebox").TString;
-  type: import("typebox").TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
-}>;
+declare const authenticationProviderSchema: import("zod").ZodObject<{
+  name: import("zod").ZodString;
+  type: import("zod").ZodEnum<{
+    CREDENTIALS: "CREDENTIALS";
+    OAUTH2: "OAUTH2";
+    OIDC: "OIDC";
+  }>;
+}, import("zod/v4/core").$strip>;
 type AuthenticationProvider = Static<typeof authenticationProviderSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokenResponseSchema.d.ts
-declare const tokenResponseSchema: import("typebox").TObject<{
-  provider: import("typebox").TString;
-  access_token: import("typebox").TString;
-  issued_at: import("typebox").TNumber;
-  expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_token: import("typebox").TOptional<import("typebox").TString>;
-  refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  id_token: import("typebox").TOptional<import("typebox").TString>;
-  scope: import("typebox").TOptional<import("typebox").TString>;
-  user: import("typebox").TObject<{
-    id: import("typebox").TString;
-    name: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    sessionId: import("typebox").TOptional<import("typebox").TString>;
-    organization: import("typebox").TOptional<import("typebox").TString>;
-    roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-    realm: import("typebox").TOptional<import("typebox").TString>;
-  }>;
-  api: import("typebox").TObject<{
-    prefix: import("typebox").TOptional<import("typebox").TString>;
-    actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-      path: import("typebox").TString;
-      method: import("typebox").TOptional<import("typebox").TString>;
-      contentType: import("typebox").TOptional<import("typebox").TString>;
-      kind: import("typebox").TOptional<import("typebox").TString>;
-      service: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
-    permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-  }>;
-}>;
+declare const tokenResponseSchema: import("zod").ZodObject<{
+  provider: import("zod").ZodString;
+  access_token: import("zod").ZodString;
+  issued_at: import("zod").ZodNumber;
+  expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+  refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  id_token: import("zod").ZodOptional<import("zod").ZodString>;
+  scope: import("zod").ZodOptional<import("zod").ZodString>;
+  user: import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+    organization: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+    realm: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>;
+  api: import("zod").ZodObject<{
+    prefix: import("zod").ZodOptional<import("zod").ZodString>;
+    actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+      path: import("zod").ZodString;
+      method: import("zod").ZodOptional<import("zod").ZodString>;
+      contentType: import("zod").ZodOptional<import("zod").ZodString>;
+      kind: import("zod").ZodOptional<import("zod").ZodString>;
+      service: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
 type TokenResponse = Static<typeof tokenResponseSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokensSchema.d.ts
-declare const tokensSchema: import("typebox").TObject<{
-  provider: import("typebox").TString;
-  access_token: import("typebox").TString;
-  issued_at: import("typebox").TNumber;
-  expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_token: import("typebox").TOptional<import("typebox").TString>;
-  refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-  id_token: import("typebox").TOptional<import("typebox").TString>;
-  scope: import("typebox").TOptional<import("typebox").TString>;
-}>;
+declare const tokensSchema: import("zod").ZodObject<{
+  provider: import("zod").ZodString;
+  access_token: import("zod").ZodString;
+  issued_at: import("zod").ZodNumber;
+  expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+  refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+  id_token: import("zod").ZodOptional<import("zod").ZodString>;
+  scope: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>;
 type Tokens = Static<typeof tokensSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/userinfoResponseSchema.d.ts
-declare const userinfoResponseSchema: import("typebox").TObject<{
-  user: import("typebox").TOptional<import("typebox").TObject<{
-    id: import("typebox").TString;
-    name: import("typebox").TOptional<import("typebox").TString>;
-    email: import("typebox").TOptional<import("typebox").TString>;
-    username: import("typebox").TOptional<import("typebox").TString>;
-    picture: import("typebox").TOptional<import("typebox").TString>;
-    sessionId: import("typebox").TOptional<import("typebox").TString>;
-    organization: import("typebox").TOptional<import("typebox").TString>;
-    roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-    realm: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  api: import("typebox").TObject<{
-    prefix: import("typebox").TOptional<import("typebox").TString>;
-    actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-      path: import("typebox").TString;
-      method: import("typebox").TOptional<import("typebox").TString>;
-      contentType: import("typebox").TOptional<import("typebox").TString>;
-      kind: import("typebox").TOptional<import("typebox").TString>;
-      service: import("typebox").TOptional<import("typebox").TString>;
-    }>>;
-    permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-  }>;
-}>;
+declare const userinfoResponseSchema: import("zod").ZodObject<{
+  user: import("zod").ZodOptional<import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    name: import("zod").ZodOptional<import("zod").ZodString>;
+    firstName: import("zod").ZodOptional<import("zod").ZodString>;
+    lastName: import("zod").ZodOptional<import("zod").ZodString>;
+    email: import("zod").ZodOptional<import("zod").ZodString>;
+    username: import("zod").ZodOptional<import("zod").ZodString>;
+    picture: import("zod").ZodOptional<import("zod").ZodString>;
+    sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+    organization: import("zod").ZodOptional<import("zod").ZodString>;
+    roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+    realm: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  api: import("zod").ZodObject<{
+    prefix: import("zod").ZodOptional<import("zod").ZodString>;
+    actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+      path: import("zod").ZodString;
+      method: import("zod").ZodOptional<import("zod").ZodString>;
+      contentType: import("zod").ZodOptional<import("zod").ZodString>;
+      kind: import("zod").ZodOptional<import("zod").ZodString>;
+      service: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>>;
+    permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
 type UserinfoResponse = Static<typeof userinfoResponseSchema>;
 //#endregion
 //#region ../../../../node_modules/oauth4webapi/build/index.d.ts
 /**
  * JSON Object
  */
-type JsonObject = { [Key in string]?: JsonValue };
+type JsonObject = { [Key in string]?: JsonValue; };
 /**
  * JSON Array
  */
@@ -779,7 +755,7 @@ interface Client {
 /**
  * Removes all Symbol properties from a type
  */
-type OmitSymbolProperties<T> = { [K in keyof T as K extends symbol ? never : K]: T[K] };
+type OmitSymbolProperties<T> = { [K in keyof T as K extends symbol ? never : K]: T[K]; };
 //#endregion
 //#region ../../../../node_modules/openid-client/build/index.d.ts
 /**
@@ -1212,26 +1188,26 @@ declare class ServerAuthProvider {
    */
   protected validateRedirectUri(uri: string): string;
   get identities(): Array<AuthPrimitive>;
-  protected readonly authorizationCode: import("alepha/server/cookies").AbstractCookiePrimitive<import("typebox").TObject<{
-    provider: import("typebox").TString;
-    realm: import("typebox").TOptional<import("typebox").TString>;
-    codeVerifier: import("typebox").TOptional<import("typebox").TString>;
-    redirectUri: import("typebox").TOptional<import("typebox").TString>;
-    loginUri: import("typebox").TOptional<import("typebox").TString>;
-    state: import("typebox").TOptional<import("typebox").TString>;
-    nonce: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
-  readonly tokens: import("alepha/server/cookies").AbstractCookiePrimitive<import("typebox").TObject<{
-    provider: import("typebox").TString;
-    access_token: import("typebox").TString;
-    issued_at: import("typebox").TNumber;
-    expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-    refresh_token: import("typebox").TOptional<import("typebox").TString>;
-    refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-    refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-    id_token: import("typebox").TOptional<import("typebox").TString>;
-    scope: import("typebox").TOptional<import("typebox").TString>;
-  }>>;
+  protected readonly authorizationCode: import("alepha/server/cookies").AbstractCookiePrimitive<import("zod").ZodObject<{
+    provider: import("zod").ZodString;
+    realm: import("zod").ZodOptional<import("zod").ZodString>;
+    codeVerifier: import("zod").ZodOptional<import("zod").ZodString>;
+    redirectUri: import("zod").ZodOptional<import("zod").ZodString>;
+    loginUri: import("zod").ZodOptional<import("zod").ZodString>;
+    state: import("zod").ZodOptional<import("zod").ZodString>;
+    nonce: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
+  readonly tokens: import("alepha/server/cookies").AbstractCookiePrimitive<import("zod").ZodObject<{
+    provider: import("zod").ZodString;
+    access_token: import("zod").ZodString;
+    issued_at: import("zod").ZodNumber;
+    expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+    refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+    refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+    refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+    id_token: import("zod").ZodOptional<import("zod").ZodString>;
+    scope: import("zod").ZodOptional<import("zod").ZodString>;
+  }, import("zod/v4/core").$strip>>;
   protected readonly configure: import("alepha").HookPrimitive<"configure">;
   /**
    * Fill request headers with access token from cookies or fallback to provider's fallback function.
@@ -1241,109 +1217,113 @@ declare class ServerAuthProvider {
    * Get user information.
    */
   readonly userinfo: import("alepha/server").RoutePrimitive<{
-    response: import("typebox").TObject<{
-      user: import("typebox").TOptional<import("typebox").TObject<{
-        id: import("typebox").TString;
-        name: import("typebox").TOptional<import("typebox").TString>;
-        email: import("typebox").TOptional<import("typebox").TString>;
-        username: import("typebox").TOptional<import("typebox").TString>;
-        picture: import("typebox").TOptional<import("typebox").TString>;
-        sessionId: import("typebox").TOptional<import("typebox").TString>;
-        organization: import("typebox").TOptional<import("typebox").TString>;
-        roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-        realm: import("typebox").TOptional<import("typebox").TString>;
-      }>>;
-      api: import("typebox").TObject<{
-        prefix: import("typebox").TOptional<import("typebox").TString>;
-        actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-          path: import("typebox").TString;
-          method: import("typebox").TOptional<import("typebox").TString>;
-          contentType: import("typebox").TOptional<import("typebox").TString>;
-          kind: import("typebox").TOptional<import("typebox").TString>;
-          service: import("typebox").TOptional<import("typebox").TString>;
-        }>>;
-        permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-      }>;
-    }>;
+    response: import("zod").ZodObject<{
+      user: import("zod").ZodOptional<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodOptional<import("zod").ZodString>;
+        firstName: import("zod").ZodOptional<import("zod").ZodString>;
+        lastName: import("zod").ZodOptional<import("zod").ZodString>;
+        email: import("zod").ZodOptional<import("zod").ZodString>;
+        username: import("zod").ZodOptional<import("zod").ZodString>;
+        picture: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        organization: import("zod").ZodOptional<import("zod").ZodString>;
+        roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+        realm: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
+      api: import("zod").ZodObject<{
+        prefix: import("zod").ZodOptional<import("zod").ZodString>;
+        actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+          path: import("zod").ZodString;
+          method: import("zod").ZodOptional<import("zod").ZodString>;
+          contentType: import("zod").ZodOptional<import("zod").ZodString>;
+          kind: import("zod").ZodOptional<import("zod").ZodString>;
+          service: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Refresh a token for internal providers.
    */
   readonly refresh: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      provider: import("typebox").TString;
-    }>;
-    body: import("typebox").TObject<{
-      refresh_token: import("typebox").TString;
-      access_token: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    response: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      access_token: import("typebox").TString;
-      issued_at: import("typebox").TNumber;
-      expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_token: import("typebox").TOptional<import("typebox").TString>;
-      refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      id_token: import("typebox").TOptional<import("typebox").TString>;
-      scope: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      refresh_token: import("zod").ZodString;
+      access_token: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      access_token: import("zod").ZodString;
+      issued_at: import("zod").ZodNumber;
+      expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+      refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      id_token: import("zod").ZodOptional<import("zod").ZodString>;
+      scope: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Login for local password-based authentication.
    */
   readonly token: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      realm: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-    body: import("typebox").TObject<{
-      username: import("typebox").TString;
-      password: import("typebox").TString;
-    }>;
-    response: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      access_token: import("typebox").TString;
-      issued_at: import("typebox").TNumber;
-      expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_token: import("typebox").TOptional<import("typebox").TString>;
-      refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
-      id_token: import("typebox").TOptional<import("typebox").TString>;
-      scope: import("typebox").TOptional<import("typebox").TString>;
-      user: import("typebox").TObject<{
-        id: import("typebox").TString;
-        name: import("typebox").TOptional<import("typebox").TString>;
-        email: import("typebox").TOptional<import("typebox").TString>;
-        username: import("typebox").TOptional<import("typebox").TString>;
-        picture: import("typebox").TOptional<import("typebox").TString>;
-        sessionId: import("typebox").TOptional<import("typebox").TString>;
-        organization: import("typebox").TOptional<import("typebox").TString>;
-        roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-        realm: import("typebox").TOptional<import("typebox").TString>;
-      }>;
-      api: import("typebox").TObject<{
-        prefix: import("typebox").TOptional<import("typebox").TString>;
-        actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
-          path: import("typebox").TString;
-          method: import("typebox").TOptional<import("typebox").TString>;
-          contentType: import("typebox").TOptional<import("typebox").TString>;
-          kind: import("typebox").TOptional<import("typebox").TString>;
-          service: import("typebox").TOptional<import("typebox").TString>;
-        }>>;
-        permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
-      }>;
-    }>;
+    query: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      realm: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
+    body: import("zod").ZodObject<{
+      username: import("zod").ZodString;
+      password: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>;
+    response: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      access_token: import("zod").ZodString;
+      issued_at: import("zod").ZodNumber;
+      expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+      refresh_token_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      refresh_expires_in: import("zod").ZodOptional<import("zod").ZodNumber>;
+      id_token: import("zod").ZodOptional<import("zod").ZodString>;
+      scope: import("zod").ZodOptional<import("zod").ZodString>;
+      user: import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        name: import("zod").ZodOptional<import("zod").ZodString>;
+        firstName: import("zod").ZodOptional<import("zod").ZodString>;
+        lastName: import("zod").ZodOptional<import("zod").ZodString>;
+        email: import("zod").ZodOptional<import("zod").ZodString>;
+        username: import("zod").ZodOptional<import("zod").ZodString>;
+        picture: import("zod").ZodOptional<import("zod").ZodString>;
+        sessionId: import("zod").ZodOptional<import("zod").ZodString>;
+        organization: import("zod").ZodOptional<import("zod").ZodString>;
+        roles: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+        realm: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>;
+      api: import("zod").ZodObject<{
+        prefix: import("zod").ZodOptional<import("zod").ZodString>;
+        actions: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodObject<{
+          path: import("zod").ZodString;
+          method: import("zod").ZodOptional<import("zod").ZodString>;
+          contentType: import("zod").ZodOptional<import("zod").ZodString>;
+          kind: import("zod").ZodOptional<import("zod").ZodString>;
+          service: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>>;
+        permissions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Oauth2/OIDC login route.
    */
   readonly login: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      realm: import("typebox").TOptional<import("typebox").TString>;
-      redirect_uri: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      provider: import("zod").ZodString;
+      realm: import("zod").ZodOptional<import("zod").ZodString>;
+      redirect_uri: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   /**
    * Extracts provider-specific extra profile fields delivered via the
@@ -1378,9 +1358,9 @@ declare class ServerAuthProvider {
    * Logout route for OAuth2/OIDC providers.
    */
   readonly logout: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      post_logout_redirect_uri: import("typebox").TOptional<import("typebox").TString>;
-    }>;
+    query: import("zod").ZodObject<{
+      post_logout_redirect_uri: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>;
   }>;
   getAuthenticationProviders(filters?: {
     realmName?: string;
@@ -1735,62 +1715,6 @@ declare const $authCredentials: (realm: IssuerPrimitive & WithLoginFn, options?:
  */
 declare const $authFacebook: (realm: IssuerPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
 //#endregion
-//#region ../../src/server/auth/primitives/$authFederationBroker.d.ts
-interface FederationBrokerProviders {
-  google?: {
-    clientId: string;
-    clientSecret: string;
-  };
-  apple?: {
-    serviceId: string;
-    teamId: string;
-    keyId: string;
-    privateKeyPem: string;
-  };
-}
-interface FederationBrokerOptions {
-  /** Broker public origin, e.g. https://alepha.club — becomes the assertion `iss`. */
-  issuer: string;
-  /** EdDSA PKCS#8 PEM — signs assertions. */
-  signingKeyPem: string;
-  providers: FederationBrokerProviders;
-  /** Validate the requested tenant and return its exact origin (or null to reject). */
-  resolveTenant: (tenant: string) => Promise<string | null>;
-  assertionTtlSeconds?: number;
-}
-declare const $authFederationBroker: (options: FederationBrokerOptions) => {
-  start: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      provider: import("typebox").TString;
-      tenant: import("typebox").TString;
-      redirect: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-  }>;
-  callback: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
-  callbackPost: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
-};
-//#endregion
-//#region ../../src/server/auth/primitives/$authFederationClient.d.ts
-declare function assertionToProfile(token: string, opts: VerifyAssertionOptions): Promise<{
-  provider: string;
-  jti: string;
-  link: LinkAccountOptions;
-}>;
-interface FederationClientOptions {
-  realm: IssuerPrimitive & WithLinkFn;
-  brokerUrl: string;
-  publicKeyPem: string;
-  selfOrigin?: string;
-}
-declare const $authFederationClient: (options: FederationClientOptions) => {
-  callback: import("alepha/server").RoutePrimitive<{
-    query: import("typebox").TObject<{
-      token: import("typebox").TString;
-      redirect: import("typebox").TOptional<import("typebox").TString>;
-    }>;
-  }>;
-};
-//#endregion
 //#region ../../src/server/auth/primitives/$authFranceConnect.d.ts
 /**
  * Creates an authentication provider primitive for France Connect.
@@ -1892,5 +1816,5 @@ declare const $authMicrosoft: (realm: IssuerPrimitive & WithLinkFn, options?: Pa
  */
 declare const AlephaServerAuth: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { $auth, $authApple, $authCredentials, $authFacebook, $authFederationBroker, $authFederationClient, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, AccessToken, AlephaServerAuth, AppleClientSecretOptions, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, FederationBrokerOptions, FederationBrokerProviders, FederationClientOptions, FederationProfile, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, SignAssertionOptions, TokenResponse, Tokens, UserinfoResponse, VerifiedAssertion, VerifyAssertionOptions, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, assertionToProfile, authenticationProviderSchema, signAppleClientSecret, signFederationAssertion, tokenResponseSchema, tokensSchema, userinfoResponseSchema, verifyFederationAssertion };
+export { $auth, $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, AccessToken, AlephaServerAuth, AppleClientSecretOptions, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, TokenResponse, Tokens, UserinfoResponse, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, authenticationProviderSchema, signAppleClientSecret, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
 //# sourceMappingURL=index.d.ts.map