@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./entities/consent/types.mjs";
 import { ClientCredentialsService } from "./authentication/credential/entities/client/module.mjs";
 import { RobotCredentialsService } from "./authentication/credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "./authentication/credential/entities/user/module.mjs";
@@ -8,15 +9,35 @@ import { BaseCredentialsAuthenticator } from "./authentication/base.mjs";
 import { ClientAuthenticator } from "./authentication/entities/client/module.mjs";
 import { RobotAuthenticator } from "./authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
+import { LoginThrottleService } from "./authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
+import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
+import { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain } from "./client-certificate/module.mjs";
+import "./client-certificate/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
 import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./identity/permission/junction-grant.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
 import { ClientScopeService } from "./entities/client-scope/service.mjs";
+import { ConsentService } from "./entities/consent/service.mjs";
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./entities/event/constants.mjs";
+import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./entities/event/diff.mjs";
+import { EntityEventHandler } from "./entities/event/entity-event-handler.mjs";
+import { sanitizeEventData } from "./entities/event/sanitize.mjs";
+import { EventService } from "./entities/event/service.mjs";
+import { REALM_CIPHER_BLOB_ERROR_INSTANCE, RealmCipherBlobError } from "./key/error.mjs";
+import { isRealmCipherBlobError } from "./key/check.mjs";
+import { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError } from "./key/certificate-error.mjs";
+import { assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, parseCertificateChain } from "./key/certificate.mjs";
+import { REALM_CIPHER_BLOB_VERSION, WRAPPED_KEY_MATERIAL_PREFIX } from "./key/constants.mjs";
+import { KeyProvisioner } from "./key/provisioner.mjs";
+import { RealmCipher } from "./key/realm-cipher.mjs";
+import { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial } from "./key/wrap.mjs";
+import "./key/index.mjs";
+import { KeyService } from "./entities/key/service.mjs";
 import { PermissionService } from "./entities/permission/service.mjs";
 import { PermissionPolicyService } from "./entities/permission-policy/service.mjs";
 import { PolicyService } from "./entities/policy/service.mjs";
@@ -28,25 +49,40 @@ import { RoleService } from "./entities/role/service.mjs";
 import { RoleAttributeService } from "./entities/role-attribute/service.mjs";
 import { RolePermissionService } from "./entities/role-permission/service.mjs";
 import { ScopeService } from "./entities/scope/service.mjs";
+import { SessionService } from "./entities/session/service.mjs";
+import { TrustAnchorService } from "./entities/trust-anchor/service.mjs";
 import { UserService } from "./entities/user/service.mjs";
 import { UserAttributeService } from "./entities/user-attribute/service.mjs";
-import { UserPermissionService } from "./entities/user-permission/service.mjs";
-import { UserRoleService } from "./entities/user-role/service.mjs";
-import { IdentityProviderRoleMappingService } from "./entities/identity-provider-role-mapping/service.mjs";
-import "./entities/index.mjs";
+import { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX } from "./entities/user-authenticator/constants.mjs";
+import { generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse } from "./entities/user-authenticator/helpers.mjs";
 import { defineMailTemplate } from "./mail/template/define.mjs";
 import { MailTemplateName } from "./mail/template/types.mjs";
 import { MAIL_TEMPLATE_REGISTRY } from "./mail/template/registry.mjs";
 import { MailTemplateRenderer } from "./mail/renderer.mjs";
 import "./mail/index.mjs";
+import { buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, verifyWebauthnAuthentication, verifyWebauthnRegistration } from "./entities/user-authenticator/webauthn.mjs";
+import { UserAuthenticatorService } from "./entities/user-authenticator/service.mjs";
+import { USER_AUTHENTICATOR_FILTER_KEYS } from "./entities/user-authenticator/types.mjs";
+import { UserPermissionService } from "./entities/user-permission/service.mjs";
+import { UserRoleService } from "./entities/user-role/service.mjs";
+import { IdentityProviderRoleMappingService } from "./entities/identity-provider-role-mapping/service.mjs";
+import "./entities/index.mjs";
+import { NoopAuthFlowMetrics } from "./metrics/noop.mjs";
+import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
+import { PolicyEngine } from "./security/policy/engine.mjs";
+import { OAuth2AccessPolicyEvaluator } from "./oauth2/access-policy/module.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
+import { OAuth2ClientAuthenticator } from "./oauth2/client/authenticator.mjs";
+import { assertClientGrantAllowed } from "./oauth2/client/grant-type.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./oauth2/authorization/code-request/verifier/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "./oauth2/authorization/code-request/validator.mjs";
 import { OAuth2AuthorizationStateManager } from "./oauth2/authorization/state/module.mjs";
+import { toIdentityPolicyData } from "./identity/permission/identity-policy-data.mjs";
 import { OAuth2Authorization } from "./oauth2/authorization/module.mjs";
-import { OAuth2ClientAuthenticator } from "./oauth2/client/authenticator.mjs";
+import { OAuth2EndSessionService } from "./oauth2/end-session/service.mjs";
+import { OAuth2EndSessionRequestValidator } from "./oauth2/end-session/validator.mjs";
 import { buildOAuth2BearerTokenResponse } from "./oauth2/response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./oauth2/grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.mjs";
@@ -54,9 +90,11 @@ import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { PasswordGrantType } from "./oauth2/grant-types/password.mjs";
 import { OAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh-token.mjs";
 import { RobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
+import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./oauth2/openid/claims.mjs";
 import { OAuth2ScopeAttributesResolver } from "./oauth2/scope/resolver.mjs";
 import { OAuth2AccessTokenIssuer } from "./oauth2/token/issuer/access/module.mjs";
+import { OAuth2MfaTokenIssuer } from "./oauth2/token/issuer/mfa/module.mjs";
 import { OAuth2OpenIDTokenIssuer } from "./oauth2/token/issuer/open-id/module.mjs";
 import { OAuth2RefreshTokenIssuer } from "./oauth2/token/issuer/refresh/module.mjs";
 import { OAuth2TokenRevoker } from "./oauth2/token/revoker/module.mjs";
@@ -65,8 +103,6 @@ import { OAuth2TokenVerifier } from "./oauth2/token/verifier/module.mjs";
 import "./oauth2/index.mjs";
 import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./identity/password-recovery/constants.mjs";
 import { PasswordRecoveryService } from "./identity/password-recovery/service.mjs";
-import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
-import { PolicyEngine } from "./security/policy/engine.mjs";
 import { PermissionCheckerService } from "./identity/permission/checker/service.mjs";
 import { IdentityPermissionProvider } from "./identity/permission/module.mjs";
 import { PolicyCheckerService } from "./identity/policy/checker/service.mjs";
@@ -94,9 +130,12 @@ import "./identity/index.mjs";
 import { ProvisioningEntityStrategyType } from "./provisioning/strategy/constants.mjs";
 import { normalizeEntityProvisioningStrategy } from "./provisioning/strategy/normalize.mjs";
 import { ProvisioningStrategyValidator } from "./provisioning/strategy/validator.mjs";
+import { PermissionProvisioningRelationsValidator } from "./provisioning/entities/permission/relations-validator.mjs";
 import { PermissionProvisioningValidator } from "./provisioning/entities/permission/validator.mjs";
 import { RoleProvisioningValidator } from "./provisioning/entities/role/validator.mjs";
+import { createProvisioningEntitiesValidator } from "./provisioning/entities/utils.mjs";
 import { ClientProvisioningValidator } from "./provisioning/entities/client/validator.mjs";
+import { PolicyProvisioningValidator } from "./provisioning/entities/policy/validator.mjs";
 import { RobotProvisioningValidator } from "./provisioning/entities/robot/validator.mjs";
 import { ScopeProvisioningValidator } from "./provisioning/entities/scope/validator.mjs";
 import { UserProvisioningValidator } from "./provisioning/entities/user/validator.mjs";
@@ -115,4 +154,4 @@ import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WebClientProvisioner, applyJunctionCreateGrant, base64URLEncode, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, createIdentityProviderOAuth2Authenticator, defineMailTemplate, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { BaseCredentialsAuthenticator, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, defineMailTemplate, deriveAmrAcr, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, isRealmCipherBlobError, isWrappedKeyMaterial, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, sanitizeEventData, toIdentityPolicyData, unwrapKeyMaterial, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/key/certificate-error.d.ts

@@ -0,0 +1,10 @@
+import { AuthupError } from '@authup/errors';
+export declare const KEY_CERTIFICATE_ERROR_INSTANCE: unique symbol;
+/**
+ * Certificate parsing/key-association failure independent of any transport.
+ * API-facing services may translate this to their own boundary error.
+ */
+export declare class KeyCertificateError extends AuthupError {
+    constructor(message: string);
+}
+//# sourceMappingURL=certificate-error.d.ts.map

package/dist/core/key/certificate-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate-error.d.ts","sourceRoot":"","sources":["../../../src/core/key/certificate-error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAE7D,eAAO,MAAM,8BAA8B,eAAwD,CAAC;AAEpG;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;gBACpC,OAAO,EAAE,MAAM;CAI9B"}

package/dist/core/key/certificate-error.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthupError, markInstanceof } from "@authup/errors";
+//#region src/core/key/certificate-error.ts
+const KEY_CERTIFICATE_ERROR_INSTANCE = Symbol.for("@authup/server-core/KeyCertificateError");
+/**
+* Certificate parsing/key-association failure independent of any transport.
+* API-facing services may translate this to their own boundary error.
+*/ var KeyCertificateError = class extends AuthupError {
+	constructor(message) {
+		super({ message });
+		markInstanceof(this, KEY_CERTIFICATE_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError };
+
+//# sourceMappingURL=certificate-error.mjs.map

package/dist/core/key/certificate-error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate-error.mjs","names":["AuthupError","markInstanceof","KEY_CERTIFICATE_ERROR_INSTANCE","Symbol","for","KeyCertificateError","message"],"sources":["../../../src/core/key/certificate-error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, markInstanceof } from '@authup/errors';\n\nexport const KEY_CERTIFICATE_ERROR_INSTANCE = Symbol.for('@authup/server-core/KeyCertificateError');\n\n/**\n * Certificate parsing/key-association failure independent of any transport.\n * API-facing services may translate this to their own boundary error.\n */\nexport class KeyCertificateError extends AuthupError {\n    constructor(message: string) {\n        super({ message });\n        markInstanceof(this, KEY_CERTIFICATE_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaE,iCAAiCC,OAAOC,IAAI,yCAAA;;;;GAMzD,IAAaC,sBAAb,cAAyCL,YAAAA;CACrC,YAAYM,SAAiB;EACzB,MAAM,EAAEA,QAAQ,CAAA;EAChBL,eAAe,MAAMC,8BAAAA;CACzB;AACJ"}

package/dist/core/key/certificate.d.ts

@@ -0,0 +1,15 @@
+import { X509Certificate } from 'node:crypto';
+import type { OAuth2JsonWebKey } from '@authup/specs';
+export declare function parseCertificateChain(pem: string): X509Certificate[];
+export declare function assertCertificateMatchesKey(chain: X509Certificate[], spkiBase64: string): void;
+export declare function buildX5c(chain: X509Certificate[]): string[];
+export declare function buildX5tS256(chain: X509Certificate[]): Promise<string>;
+/**
+ * Derive the RFC 7517 x5c / x5t#S256 JWK members from a stored PEM chain.
+ *
+ * Fail-open by design: one malformed legacy/database row must not take down
+ * the whole realm's JWKS — the usable public key is still published, just
+ * without the certificate members.
+ */
+export declare function buildCertificateJwkFields(certificate: string | null): Promise<Partial<Pick<OAuth2JsonWebKey, 'x5c' | 'x5t#S256'>>>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/core/key/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../../src/core/key/certificate.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,eAAe,EAElB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAWpE;AAED,wBAAgB,2BAA2B,CACvC,KAAK,EAAE,eAAe,EAAE,EACxB,UAAU,EAAE,MAAM,GACnB,IAAI,CA4BN;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,CAE3D;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5E;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC3C,WAAW,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAc9D"}

package/dist/core/key/certificate.mjs

@@ -0,0 +1,72 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { KeyCertificateError } from "./certificate-error.mjs";
+import { base64URLEncode } from "@authup/kit";
+import { ValidationError } from "@authup/errors";
+import { X509Certificate, createPublicKey } from "node:crypto";
+import { subtle } from "uncrypto";
+//#region src/core/key/certificate.ts
+const CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+function parseCertificateChain(pem) {
+	const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);
+	if (!blocks || blocks.length === 0) throw new ValidationError("The certificate chain could not be parsed.");
+	try {
+		return blocks.map((block) => new X509Certificate(block));
+	} catch {
+		throw new ValidationError("The certificate chain could not be parsed.");
+	}
+}
+function assertCertificateMatchesKey(chain, spkiBase64) {
+	const certificate = chain[0];
+	if (!certificate) throw new KeyCertificateError("The certificate chain is empty.");
+	const certificateKey = certificate.publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	let importedKey;
+	try {
+		importedKey = createPublicKey({
+			key: Buffer.from(spkiBase64, "base64"),
+			type: "spki",
+			format: "der"
+		}).export({
+			type: "spki",
+			format: "der"
+		});
+	} catch {
+		throw new KeyCertificateError("The imported public key material is invalid.");
+	}
+	if (Buffer.compare(certificateKey, importedKey) !== 0) throw new KeyCertificateError("The certificate does not match the key material.");
+}
+function buildX5c(chain) {
+	return chain.map((certificate) => certificate.raw.toString("base64"));
+}
+async function buildX5tS256(chain) {
+	const certificate = chain[0];
+	if (!certificate) throw new KeyCertificateError("The certificate chain is empty.");
+	const digest = await subtle.digest("SHA-256", certificate.raw);
+	return base64URLEncode(String.fromCharCode(...new Uint8Array(digest)));
+}
+/**
+* Derive the RFC 7517 x5c / x5t#S256 JWK members from a stored PEM chain.
+*
+* Fail-open by design: one malformed legacy/database row must not take down
+* the whole realm's JWKS — the usable public key is still published, just
+* without the certificate members.
+*/ async function buildCertificateJwkFields(certificate) {
+	if (!certificate) return {};
+	try {
+		const chain = parseCertificateChain(certificate);
+		return {
+			x5c: buildX5c(chain),
+			"x5t#S256": await buildX5tS256(chain)
+		};
+	} catch {
+		return {};
+	}
+}
+//#endregion
+export { assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, parseCertificateChain };
+
+//# sourceMappingURL=certificate.mjs.map

package/dist/core/key/certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.mjs","names":["X509Certificate","createPublicKey","ValidationError","base64URLEncode","subtle","KeyCertificateError","CERTIFICATE_BLOCK_PATTERN","parseCertificateChain","pem","blocks","match","length","map","block","assertCertificateMatchesKey","chain","spkiBase64","certificate","certificateKey","publicKey","export","type","format","importedKey","key","Buffer","from","compare","buildX5c","raw","toString","buildX5tS256","digest","String","fromCharCode","Uint8Array","buildCertificateJwkFields","x5c"],"sources":["../../../src/core/key/certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    X509Certificate,\n    createPublicKey,\n} from 'node:crypto';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { subtle } from 'uncrypto';\nimport { KeyCertificateError } from './certificate-error.ts';\n\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n\nexport function parseCertificateChain(pem: string): X509Certificate[] {\n    const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n    if (!blocks || blocks.length === 0) {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n\n    try {\n        return blocks.map((block) => new X509Certificate(block));\n    } catch {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n}\n\nexport function assertCertificateMatchesKey(\n    chain: X509Certificate[],\n    spkiBase64: string,\n): void {\n    const certificate = chain[0];\n    if (!certificate) {\n        throw new KeyCertificateError('The certificate chain is empty.');\n    }\n\n    const certificateKey = certificate.publicKey.export({\n        type: 'spki',\n        format: 'der',\n    });\n\n    let importedKey : Buffer;\n    try {\n        importedKey = createPublicKey({\n            key: Buffer.from(spkiBase64, 'base64'),\n            type: 'spki',\n            format: 'der',\n        }).export({\n            type: 'spki',\n            format: 'der',\n        });\n    } catch {\n        throw new KeyCertificateError('The imported public key material is invalid.');\n    }\n\n    if (Buffer.compare(certificateKey, importedKey) !== 0) {\n        throw new KeyCertificateError('The certificate does not match the key material.');\n    }\n}\n\nexport function buildX5c(chain: X509Certificate[]): string[] {\n    return chain.map((certificate) => certificate.raw.toString('base64'));\n}\n\nexport async function buildX5tS256(chain: X509Certificate[]): Promise<string> {\n    const certificate = chain[0];\n    if (!certificate) {\n        throw new KeyCertificateError('The certificate chain is empty.');\n    }\n\n    const digest = await subtle.digest('SHA-256', certificate.raw);\n\n    return base64URLEncode(\n        String.fromCharCode(...new Uint8Array(digest)),\n    );\n}\n\n/**\n * Derive the RFC 7517 x5c / x5t#S256 JWK members from a stored PEM chain.\n *\n * Fail-open by design: one malformed legacy/database row must not take down\n * the whole realm's JWKS — the usable public key is still published, just\n * without the certificate members.\n */\nexport async function buildCertificateJwkFields(\n    certificate: string | null,\n): Promise<Partial<Pick<OAuth2JsonWebKey, 'x5c' | 'x5t#S256'>>> {\n    if (!certificate) {\n        return {};\n    }\n\n    try {\n        const chain = parseCertificateChain(certificate);\n        return {\n            x5c: buildX5c(chain),\n            'x5t#S256': await buildX5tS256(chain),\n        };\n    } catch {\n        return {};\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAMM,4BAA4B;AAElC,SAAgBC,sBAAsBC,KAAW;CAC7C,MAAMC,SAASD,IAAIE,MAAMJ,yBAAAA;CACzB,IAAI,CAACG,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAIT,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAOO,OAAOG,KAAKC,UAAU,IAAIb,gBAAgBa,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAIX,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,SAAgBY,4BACZC,OACAC,YAAkB;CAElB,MAAMC,cAAcF,MAAM;CAC1B,IAAI,CAACE,aACD,MAAM,IAAIZ,oBAAoB,iCAAA;CAGlC,MAAMa,iBAAiBD,YAAYE,UAAUC,OAAO;EAChDC,MAAM;EACNC,QAAQ;CACZ,CAAA;CAEA,IAAIC;CACJ,IAAI;EACAA,cAActB,gBAAgB;GAC1BuB,KAAKC,OAAOC,KAAKV,YAAY,QAAA;GAC7BK,MAAM;GACNC,QAAQ;EACZ,CAAA,CAAA,CAAGF,OAAO;GACNC,MAAM;GACNC,QAAQ;EACZ,CAAA;CACJ,QAAQ;EACJ,MAAM,IAAIjB,oBAAoB,8CAAA;CAClC;CAEA,IAAIoB,OAAOE,QAAQT,gBAAgBK,WAAAA,MAAiB,GAChD,MAAM,IAAIlB,oBAAoB,kDAAA;AAEtC;AAEA,SAAgBuB,SAASb,OAAwB;CAC7C,OAAOA,MAAMH,KAAKK,gBAAgBA,YAAYY,IAAIC,SAAS,QAAA,CAAA;AAC/D;AAEA,eAAsBC,aAAahB,OAAwB;CACvD,MAAME,cAAcF,MAAM;CAC1B,IAAI,CAACE,aACD,MAAM,IAAIZ,oBAAoB,iCAAA;CAGlC,MAAM2B,SAAS,MAAM5B,OAAO4B,OAAO,WAAWf,YAAYY,GAAG;CAE7D,OAAO1B,gBACH8B,OAAOC,aAAY,GAAI,IAAIC,WAAWH,MAAAA,CAAAA,CAAAA;AAE9C;;;;;;;GASA,eAAsBI,0BAClBnB,aAA0B;CAE1B,IAAI,CAACA,aACD,OAAO,CAAC;CAGZ,IAAI;EACA,MAAMF,QAAQR,sBAAsBU,WAAAA;EACpC,OAAO;GACHoB,KAAKT,SAASb,KAAAA;GACd,YAAY,MAAMgB,aAAahB,KAAAA;EACnC;CACJ,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}

package/dist/core/key/check.d.ts

@@ -0,0 +1,3 @@
+import { type RealmCipherBlobError } from './error.ts';
+export declare function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError;
+//# sourceMappingURL=check.d.ts.map

package/dist/core/key/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/core/key/check.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEzF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF"}

package/dist/core/key/check.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { REALM_CIPHER_BLOB_ERROR_INSTANCE } from "./error.mjs";
+import { hasInstanceof } from "@authup/errors";
+//#region src/core/key/check.ts
+function isRealmCipherBlobError(input) {
+	return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);
+}
+//#endregion
+export { isRealmCipherBlobError };
+
+//# sourceMappingURL=check.mjs.map

package/dist/core/key/check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.mjs","names":["hasInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","isRealmCipherBlobError","input"],"sources":["../../../src/core/key/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { hasInstanceof } from '@authup/errors';\nimport { REALM_CIPHER_BLOB_ERROR_INSTANCE, type RealmCipherBlobError } from './error.ts';\n\nexport function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError {\n    return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;;AAUA,SAAgBE,uBAAuBC,OAAc;CACjD,OAAOH,cAAcG,OAAOF,gCAAAA;AAChC"}

package/dist/core/key/constants.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Version tag leading a realm-cipher blob (v1.<key_id>.<payload>).
+ */
+export declare const REALM_CIPHER_BLOB_VERSION = "v1";
+/**
+ * Marker prefixing key material stored KEK-wrapped in the key store
+ * (config secretsEncryptionKey). Unprefixed material is plaintext.
+ */
+export declare const WRAPPED_KEY_MATERIAL_PREFIX = "wrapped.v1.";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/key/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/core/key/constants.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,gBAAgB,CAAC"}

package/dist/core/key/constants.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/key/constants.ts
+/**
+* Version tag leading a realm-cipher blob (v1.<key_id>.<payload>).
+*/ const REALM_CIPHER_BLOB_VERSION = "v1";
+/**
+* Marker prefixing key material stored KEK-wrapped in the key store
+* (config secretsEncryptionKey). Unprefixed material is plaintext.
+*/ const WRAPPED_KEY_MATERIAL_PREFIX = "wrapped.v1.";
+//#endregion
+export { REALM_CIPHER_BLOB_VERSION, WRAPPED_KEY_MATERIAL_PREFIX };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/key/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["REALM_CIPHER_BLOB_VERSION","WRAPPED_KEY_MATERIAL_PREFIX"],"sources":["../../../src/core/key/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Version tag leading a realm-cipher blob (v1.<key_id>.<payload>).\n */\nexport const REALM_CIPHER_BLOB_VERSION = 'v1';\n\n/**\n * Marker prefixing key material stored KEK-wrapped in the key store\n * (config secretsEncryptionKey). Unprefixed material is plaintext.\n */\nexport const WRAPPED_KEY_MATERIAL_PREFIX = 'wrapped.v1.';\n"],"mappings":";;;;;;GAUA,MAAaA,4BAA4B;;;;GAMzC,MAAaC,8BAA8B"}

package/dist/core/key/error.d.ts

@@ -0,0 +1,14 @@
+import { AuthupError } from '@authup/errors';
+export declare const REALM_CIPHER_BLOB_ERROR_INSTANCE: unique symbol;
+/**
+ * A blob-semantics decryption failure — malformed blob, unknown / foreign /
+ * non-enc key reference, or failed GCM authentication. This is the expected
+ * fail-closed class consumers map to a plain verification failure.
+ * Infrastructure errors (database outage, KEK misconfiguration) are
+ * deliberately NOT of this type — they must bubble instead of silently
+ * burning a verification attempt.
+ */
+export declare class RealmCipherBlobError extends AuthupError {
+    constructor(message: string);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/core/key/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/core/key/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAE7D,eAAO,MAAM,gCAAgC,eAAyD,CAAC;AAEvG;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,WAAW;gBACrC,OAAO,EAAE,MAAM;CAI9B"}

package/dist/core/key/error.mjs

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthupError, markInstanceof } from "@authup/errors";
+//#region src/core/key/error.ts
+const REALM_CIPHER_BLOB_ERROR_INSTANCE = Symbol.for("@authup/server-core/RealmCipherBlobError");
+/**
+* A blob-semantics decryption failure — malformed blob, unknown / foreign /
+* non-enc key reference, or failed GCM authentication. This is the expected
+* fail-closed class consumers map to a plain verification failure.
+* Infrastructure errors (database outage, KEK misconfiguration) are
+* deliberately NOT of this type — they must bubble instead of silently
+* burning a verification attempt.
+*/ var RealmCipherBlobError = class extends AuthupError {
+	constructor(message) {
+		super({ message });
+		markInstanceof(this, REALM_CIPHER_BLOB_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { REALM_CIPHER_BLOB_ERROR_INSTANCE, RealmCipherBlobError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/key/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["AuthupError","markInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","Symbol","for","RealmCipherBlobError","message"],"sources":["../../../src/core/key/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, markInstanceof } from '@authup/errors';\n\nexport const REALM_CIPHER_BLOB_ERROR_INSTANCE = Symbol.for('@authup/server-core/RealmCipherBlobError');\n\n/**\n * A blob-semantics decryption failure — malformed blob, unknown / foreign /\n * non-enc key reference, or failed GCM authentication. This is the expected\n * fail-closed class consumers map to a plain verification failure.\n * Infrastructure errors (database outage, KEK misconfiguration) are\n * deliberately NOT of this type — they must bubble instead of silently\n * burning a verification attempt.\n */\nexport class RealmCipherBlobError extends AuthupError {\n    constructor(message: string) {\n        super({ message });\n        markInstanceof(this, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaE,mCAAmCC,OAAOC,IAAI,0CAAA;;;;;;;;GAU3D,IAAaC,uBAAb,cAA0CL,YAAAA;CACtC,YAAYM,SAAiB;EACzB,MAAM,EAAEA,QAAQ,CAAA;EAChBL,eAAe,MAAMC,gCAAAA;CACzB;AACJ"}

package/dist/core/key/index.d.ts

@@ -0,0 +1,10 @@
+export * from './check.ts';
+export * from './certificate-error.ts';
+export * from './certificate.ts';
+export * from './constants.ts';
+export * from './error.ts';
+export * from './provisioner.ts';
+export * from './realm-cipher.ts';
+export * from './types.ts';
+export * from './wrap.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/key/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/key/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}

package/dist/core/key/index.mjs

@@ -0,0 +1,12 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { REALM_CIPHER_BLOB_ERROR_INSTANCE, RealmCipherBlobError } from "./error.mjs";
+import { isRealmCipherBlobError } from "./check.mjs";
+import { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError } from "./certificate-error.mjs";
+import { assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, parseCertificateChain } from "./certificate.mjs";
+import { REALM_CIPHER_BLOB_VERSION, WRAPPED_KEY_MATERIAL_PREFIX } from "./constants.mjs";
+import { KeyProvisioner } from "./provisioner.mjs";
+import { RealmCipher } from "./realm-cipher.mjs";
+import { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial } from "./wrap.mjs";
+export { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, WRAPPED_KEY_MATERIAL_PREFIX, assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, isRealmCipherBlobError, isWrappedKeyMaterial, parseCertificateChain, unwrapKeyMaterial, wrapKeyMaterial };

package/dist/core/key/provisioner.d.ts

@@ -0,0 +1,22 @@
+import type { Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { IKeyProvisioner, IKeyStore } from './types.ts';
+export type KeyProvisionerContext = {
+    keyStore: IKeyStore;
+    logger?: Logger;
+};
+/**
+ * Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at
+ * realm creation and as a startup backfill, so keys are visible in the
+ * management API from the moment a realm exists instead of appearing on
+ * first use. resolveOrCreate stays as the zero-rows self-healing backstop.
+ */
+export declare class KeyProvisioner implements IKeyProvisioner {
+    protected keyStore: IKeyStore;
+    protected logger?: Logger;
+    constructor(ctx: KeyProvisionerContext);
+    ensureForRealm(realm: Realm | {
+        id: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=provisioner.d.ts.map

package/dist/core/key/provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../../src/core/key/provisioner.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,MAAM,qBAAqB,GAAG;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC;IAE9B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,qBAAqB;IAKhC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAkBrE"}

package/dist/core/key/provisioner.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { JWKUse } from "@authup/specs";
+//#region src/core/key/provisioner.ts
+/**
+* Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at
+* realm creation and as a startup backfill, so keys are visible in the
+* management API from the moment a realm exists instead of appearing on
+* first use. resolveOrCreate stays as the zero-rows self-healing backstop.
+*/ var KeyProvisioner = class {
+	keyStore;
+	logger;
+	constructor(ctx) {
+		this.keyStore = ctx.keyStore;
+		this.logger = ctx.logger;
+	}
+	async ensureForRealm(realm) {
+		const uses = [JWKUse.SIGNATURE, JWKUse.ENCRYPTION];
+		for (const use of uses) try {
+			await this.keyStore.resolveOrCreate(realm.id, use);
+		} catch (e) {
+			if (this.logger) this.logger.warn(`Failed to provision ${use} key for realm ${realm.id}: ${e instanceof Error ? e.message : String(e)}`);
+		}
+	}
+};
+//#endregion
+export { KeyProvisioner };
+
+//# sourceMappingURL=provisioner.mjs.map

package/dist/core/key/provisioner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.mjs","names":["JWKUse","KeyProvisioner","keyStore","logger","ctx","ensureForRealm","realm","uses","SIGNATURE","ENCRYPTION","use","resolveOrCreate","id","e","warn","Error","message","String"],"sources":["../../../src/core/key/provisioner.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport type { IKeyProvisioner, IKeyStore } from './types.ts';\n\nexport type KeyProvisionerContext = {\n    keyStore: IKeyStore,\n    logger?: Logger,\n};\n\n/**\n * Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at\n * realm creation and as a startup backfill, so keys are visible in the\n * management API from the moment a realm exists instead of appearing on\n * first use. resolveOrCreate stays as the zero-rows self-healing backstop.\n */\nexport class KeyProvisioner implements IKeyProvisioner {\n    protected keyStore: IKeyStore;\n\n    protected logger?: Logger;\n\n    constructor(ctx: KeyProvisionerContext) {\n        this.keyStore = ctx.keyStore;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const uses : `${JWKUse}`[] = [JWKUse.SIGNATURE, JWKUse.ENCRYPTION];\n\n        for (const use of uses) {\n            try {\n                await this.keyStore.resolveOrCreate(realm.id, use);\n            } catch (e) {\n                // rows-exist-but-none-active throws by design (a deliberate\n                // admin kill switch) — the provisioning guarantee is only\n                // \"at least one row exists\", so log and continue.\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision ${use} key for realm ${realm.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAuBA,IAAaC,iBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA4B;EACpC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,SAASC,IAAID;CACtB;CAEA,MAAME,eAAeC,OAA8C;EAC/D,MAAMC,OAAuB,CAACP,OAAOQ,WAAWR,OAAOS,UAAAA;EAEvD,KAAK,MAAMC,OAAOH,MACd,IAAI;GACA,MAAM,KAAKL,SAASS,gBAAgBL,MAAMM,IAAIF,GAAAA;EAClD,SAASG,GAAG;GAIR,IAAI,KAAKV,QACL,KAAKA,OAAOW,KACR,uBAAuBJ,IAAI,iBAAiBJ,MAAMM,GAAG,IAAIC,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGjH;CAER;AACJ"}

package/dist/core/key/realm-cipher.d.ts

@@ -0,0 +1,20 @@
+import type { ISymmetricCipher } from '@authup/server-kit';
+import type { IKeyStore, IRealmCipher } from './types.ts';
+export type RealmCipherContext = {
+    keyStore: IKeyStore;
+};
+export declare class RealmCipher implements IRealmCipher {
+    protected keyStore: IKeyStore;
+    /**
+     * Imported ciphers by key id — key MATERIAL is immutable, so entries
+     * never invalidate. Status and realm binding are deliberately NOT
+     * cached: decrypt re-resolves the key row every call so disabling a
+     * key acts as an immediate, reversible kill switch.
+     */
+    protected ciphers: Map<string, ISymmetricCipher>;
+    constructor(ctx: RealmCipherContext);
+    encrypt(plain: string, realmId: string): Promise<string>;
+    decrypt(blob: string, realmId: string): Promise<string>;
+    protected resolveCipher(keyId: string, material: string): ISymmetricCipher;
+}
+//# sourceMappingURL=realm-cipher.d.ts.map

package/dist/core/key/realm-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-cipher.d.ts","sourceRoot":"","sources":["../../../src/core/key/realm-cipher.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK3D,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,qBAAa,WAAY,YAAW,YAAY;IAC5C,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBAEtC,GAAG,EAAE,kBAAkB;IAK7B,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAezD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAoC9D,SAAS,CAAC,aAAa,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GAChB,gBAAgB;CASvB"}

package/dist/core/key/realm-cipher.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmCipherBlobError } from "./error.mjs";
+import "./constants.mjs";
+import { KeyStatus } from "@authup/core-kit";
+import { SymmetricCipher } from "@authup/server-kit";
+import { AuthupError } from "@authup/errors";
+import { JWKUse } from "@authup/specs";
+//#region src/core/key/realm-cipher.ts
+var RealmCipher = class {
+	keyStore;
+	/**
+	* Imported ciphers by key id — key MATERIAL is immutable, so entries
+	* never invalidate. Status and realm binding are deliberately NOT
+	* cached: decrypt re-resolves the key row every call so disabling a
+	* key acts as an immediate, reversible kill switch.
+	*/ ciphers;
+	constructor(ctx) {
+		this.keyStore = ctx.keyStore;
+		this.ciphers = /* @__PURE__ */ new Map();
+	}
+	async encrypt(plain, realmId) {
+		const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);
+		if (!key.decryption_key) throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);
+		const cipher = this.resolveCipher(key.id, key.decryption_key);
+		return [
+			"v1",
+			key.id,
+			await cipher.encrypt(plain)
+		].join(".");
+	}
+	async decrypt(blob, realmId) {
+		const parts = blob.split(".");
+		if (parts.length !== 3 || parts[0] !== "v1") throw new RealmCipherBlobError("The cipher blob is malformed.");
+		const [, keyId, payload] = parts;
+		const key = await this.keyStore.resolveById(keyId);
+		if (!key || key.use !== JWKUse.ENCRYPTION || !key.decryption_key) throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);
+		if (key.status === KeyStatus.DISABLED) throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);
+		if (key.realm_id !== realmId) throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);
+		const cipher = this.resolveCipher(key.id, key.decryption_key);
+		try {
+			return await cipher.decrypt(payload);
+		} catch {
+			throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);
+		}
+	}
+	resolveCipher(keyId, material) {
+		let cipher = this.ciphers.get(keyId);
+		if (!cipher) {
+			cipher = new SymmetricCipher(material);
+			this.ciphers.set(keyId, cipher);
+		}
+		return cipher;
+	}
+};
+//#endregion
+export { RealmCipher };
+
+//# sourceMappingURL=realm-cipher.mjs.map

package/dist/core/key/realm-cipher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-cipher.mjs","names":["AuthupError","KeyStatus","SymmetricCipher","JWKUse","REALM_CIPHER_BLOB_VERSION","RealmCipherBlobError","RealmCipher","keyStore","ciphers","ctx","Map","encrypt","plain","realmId","key","resolveOrCreate","ENCRYPTION","decryption_key","cipher","resolveCipher","id","join","decrypt","blob","parts","split","length","keyId","payload","resolveById","use","status","DISABLED","realm_id","material","get","set"],"sources":["../../../src/core/key/realm-cipher.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport { REALM_CIPHER_BLOB_VERSION } from './constants.ts';\nimport { RealmCipherBlobError } from './error.ts';\nimport type { IKeyStore, IRealmCipher } from './types.ts';\n\nexport type RealmCipherContext = {\n    keyStore: IKeyStore,\n};\n\nexport class RealmCipher implements IRealmCipher {\n    protected keyStore : IKeyStore;\n\n    /**\n     * Imported ciphers by key id — key MATERIAL is immutable, so entries\n     * never invalidate. Status and realm binding are deliberately NOT\n     * cached: decrypt re-resolves the key row every call so disabling a\n     * key acts as an immediate, reversible kill switch.\n     */\n    protected ciphers : Map<string, ISymmetricCipher>;\n\n    constructor(ctx: RealmCipherContext) {\n        this.keyStore = ctx.keyStore;\n        this.ciphers = new Map();\n    }\n\n    async encrypt(plain: string, realmId: string) : Promise<string> {\n        const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);\n        if (!key.decryption_key) {\n            throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryption_key);\n\n        return [\n            REALM_CIPHER_BLOB_VERSION,\n            key.id,\n            await cipher.encrypt(plain),\n        ].join('.');\n    }\n\n    async decrypt(blob: string, realmId: string) : Promise<string> {\n        const parts = blob.split('.');\n        if (parts.length !== 3 || parts[0] !== REALM_CIPHER_BLOB_VERSION) {\n            throw new RealmCipherBlobError('The cipher blob is malformed.');\n        }\n\n        const [, keyId, payload] = parts;\n\n        const key = await this.keyStore.resolveById(keyId);\n        if (\n            !key ||\n            key.use !== JWKUse.ENCRYPTION ||\n            !key.decryption_key\n        ) {\n            throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);\n        }\n\n        if (key.status === KeyStatus.DISABLED) {\n            throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);\n        }\n\n        if (key.realm_id !== realmId) {\n            throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryption_key);\n\n        try {\n            return await cipher.decrypt(payload);\n        } catch {\n            // failed GCM authentication / corrupt payload — blob semantics,\n            // not infrastructure.\n            throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);\n        }\n    }\n\n    protected resolveCipher(\n        keyId: string,\n        material: string,\n    ) : ISymmetricCipher {\n        let cipher = this.ciphers.get(keyId);\n        if (!cipher) {\n            cipher = new SymmetricCipher(material);\n            this.ciphers.set(keyId, cipher);\n        }\n\n        return cipher;\n    }\n}\n"],"mappings":";;;;;;;;;;AAoBA,IAAaM,cAAb,MAAaA;CACCC;;;;;;IAQV;CAEA,YAAYE,KAAyB;EACjC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,0BAAU,IAAIE,IAAAA;CACvB;CAEA,MAAMC,QAAQC,OAAeC,SAAmC;EAC5D,MAAMC,MAAM,MAAM,KAAKP,SAASQ,gBAAgBF,SAASV,OAAOa,UAAU;EAC1E,IAAI,CAACF,IAAIG,gBACL,MAAM,IAAIjB,YAAY,qDAAqDa,QAAQ,EAAE;EAGzF,MAAMK,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,cAAc;EAE5D,OAAO;;GAEHH,IAAIM;GACJ,MAAMF,OAAOP,QAAQC,KAAAA;GACxB,CAACS,KAAK,GAAA;CACX;CAEA,MAAMC,QAAQC,MAAcV,SAAmC;EAC3D,MAAMW,QAAQD,KAAKE,MAAM,GAAA;EACzB,IAAID,MAAME,WAAW,KAAKF,MAAM,OAAA,MAC5B,MAAM,IAAInB,qBAAqB,+BAAA;EAGnC,MAAM,GAAGsB,OAAOC,WAAWJ;EAE3B,MAAMV,MAAM,MAAM,KAAKP,SAASsB,YAAYF,KAAAA;EAC5C,IACI,CAACb,OACDA,IAAIgB,QAAQ3B,OAAOa,cACnB,CAACF,IAAIG,gBAEL,MAAM,IAAIZ,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAIiB,WAAW9B,UAAU+B,UACzB,MAAM,IAAI3B,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAImB,aAAapB,SACjB,MAAM,IAAIR,qBAAqB,gEAAgEsB,MAAM,GAAG;EAG5G,MAAMT,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,cAAc;EAE5D,IAAI;GACA,OAAO,MAAMC,OAAOI,QAAQM,OAAAA;EAChC,QAAQ;GAGJ,MAAM,IAAIvB,qBAAqB,2CAA2CsB,MAAM,GAAG;EACvF;CACJ;CAEUR,cACNQ,OACAO,UACiB;EACjB,IAAIhB,SAAS,KAAKV,QAAQ2B,IAAIR,KAAAA;EAC9B,IAAI,CAACT,QAAQ;GACTA,SAAS,IAAIhB,gBAAgBgC,QAAAA;GAC7B,KAAK1B,QAAQ4B,IAAIT,OAAOT,MAAAA;EAC5B;EAEA,OAAOA;CACX;AACJ"}