@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/key/types.d.ts

@@ -0,0 +1,59 @@
+import type { Key } from '@authup/core-kit';
+import type { JWKUse } from '@authup/specs';
+export interface IKeyProvisioner {
+    /**
+     * Ensure the realm holds at least one sig and one enc key row.
+     * Idempotent; never throws (provisioning must not fail realm creation
+     * or startup).
+     *
+     * @param realm
+     */
+    ensureForRealm(realm: {
+        id: string;
+    }): Promise<void>;
+}
+export interface IKeyStore {
+    /**
+     * Resolve the realm's highest-priority ACTIVE key for the given use,
+     * with usable (unwrapped) material. Mints one iff ZERO rows exist for
+     * (realm, use) — the self-healing zero-config backstop (provisioning
+     * mints eagerly). Rows existing but none active fails loud: an admin
+     * who disabled every key meant it.
+     *
+     * @param realmId
+     * @param use
+     */
+    resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    /**
+     * Resolve a key by explicit id with usable (unwrapped) material.
+     * Read-only; status enforcement is the consumer's concern.
+     *
+     * @param id
+     */
+    resolveById(id: string): Promise<Key | null>;
+}
+/**
+ * Realm-scoped at-rest encryption over the key store's enc keys.
+ * Blobs are self-describing (v1.&lt;key_id&gt;.&lt;payload&gt;), so decryption
+ * resolves its key by id — concurrent key creation and future key
+ * rotation never orphan a blob.
+ */
+export interface IRealmCipher {
+    /**
+     * Encrypt under the realm's current enc key (created on first use).
+     *
+     * @param plain
+     * @param realmId
+     */
+    encrypt(plain: string, realmId: string): Promise<string>;
+    /**
+     * Decrypt a blob via the key id it carries. The referenced key must
+     * belong to the given realm — the binding assert is mandatory, so a
+     * foreign realm's blob can never decrypt.
+     *
+     * @param blob
+     * @param realmId
+     */
+    decrypt(blob: string, realmId: string): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/key/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/key/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,SAAS;IACtB;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAElE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/key/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/key/wrap.d.ts

@@ -0,0 +1,5 @@
+import type { ISymmetricCipher } from '@authup/server-kit';
+export declare function isWrappedKeyMaterial(value: string): boolean;
+export declare function wrapKeyMaterial(cipher: ISymmetricCipher, value: string): Promise<string>;
+export declare function unwrapKeyMaterial(cipher: ISymmetricCipher | null | undefined, value: string): Promise<string>;
+//# sourceMappingURL=wrap.d.ts.map

package/dist/core/key/wrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../../src/core/key/wrap.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAE5D;AAED,wBAAsB,eAAe,CACjC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAElB;AAED,wBAAsB,iBAAiB,CACnC,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC3C,KAAK,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAalB"}

package/dist/core/key/wrap.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { WRAPPED_KEY_MATERIAL_PREFIX } from "./constants.mjs";
+import { AuthupError } from "@authup/errors";
+//#region src/core/key/wrap.ts
+function isWrappedKeyMaterial(value) {
+	return value.startsWith(WRAPPED_KEY_MATERIAL_PREFIX);
+}
+async function wrapKeyMaterial(cipher, value) {
+	return `${WRAPPED_KEY_MATERIAL_PREFIX}${await cipher.encrypt(value)}`;
+}
+async function unwrapKeyMaterial(cipher, value) {
+	if (!isWrappedKeyMaterial(value)) return value;
+	if (!cipher) throw new AuthupError("The key store holds wrapped key material, but no secretsEncryptionKey (SECRETS_ENCRYPTION_KEY) is configured.");
+	return cipher.decrypt(value.substring(WRAPPED_KEY_MATERIAL_PREFIX.length));
+}
+//#endregion
+export { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial };
+
+//# sourceMappingURL=wrap.mjs.map

package/dist/core/key/wrap.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.mjs","names":["AuthupError","WRAPPED_KEY_MATERIAL_PREFIX","isWrappedKeyMaterial","value","startsWith","wrapKeyMaterial","cipher","encrypt","unwrapKeyMaterial","decrypt","substring","length"],"sources":["../../../src/core/key/wrap.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { WRAPPED_KEY_MATERIAL_PREFIX } from './constants.ts';\n\nexport function isWrappedKeyMaterial(value: string) : boolean {\n    return value.startsWith(WRAPPED_KEY_MATERIAL_PREFIX);\n}\n\nexport async function wrapKeyMaterial(\n    cipher: ISymmetricCipher,\n    value: string,\n) : Promise<string> {\n    return `${WRAPPED_KEY_MATERIAL_PREFIX}${await cipher.encrypt(value)}`;\n}\n\nexport async function unwrapKeyMaterial(\n    cipher: ISymmetricCipher | null | undefined,\n    value: string,\n) : Promise<string> {\n    if (!isWrappedKeyMaterial(value)) {\n        return value;\n    }\n\n    if (!cipher) {\n        throw new AuthupError(\n            'The key store holds wrapped key material, ' +\n            'but no secretsEncryptionKey (SECRETS_ENCRYPTION_KEY) is configured.',\n        );\n    }\n\n    return cipher.decrypt(value.substring(WRAPPED_KEY_MATERIAL_PREFIX.length));\n}\n"],"mappings":";;;;;;AAWA,SAAgBE,qBAAqBC,OAAa;CAC9C,OAAOA,MAAMC,WAAWH,2BAAAA;AAC5B;AAEA,eAAsBI,gBAClBC,QACAH,OAAa;CAEb,OAAO,GAAGF,8BAA8B,MAAMK,OAAOC,QAAQJ,KAAAA;AACjE;AAEA,eAAsBK,kBAClBF,QACAH,OAAa;CAEb,IAAI,CAACD,qBAAqBC,KAAAA,GACtB,OAAOA;CAGX,IAAI,CAACG,QACD,MAAM,IAAIN,YACN,+GACA;CAIR,OAAOM,OAAOG,QAAQN,MAAMO,UAAUT,4BAA4BU,MAAM,CAAA;AAC5E"}

package/dist/core/mail/template/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/registry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,sBAAsB,EAAE;KAAG,CAAC,IAAI,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;CAG9E,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/registry.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,sBAAsB,EAAE;KAAG,CAAC,IAAI,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;CAI9E,CAAC"}

package/dist/core/mail/template/registry.mjs

@@ -2,12 +2,14 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { MailTemplateName } from "./types.mjs";
+import { mfaEmailOtpMailTemplate } from "./templates/mfa-email-otp.mjs";
 import { passwordResetMailTemplate } from "./templates/password-reset.mjs";
 import { registrationActivationMailTemplate } from "./templates/registration-activation.mjs";
 //#region src/core/mail/template/registry.ts
 const MAIL_TEMPLATE_REGISTRY = {
 	[MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,
-	[MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate
+	[MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,
+	[MailTemplateName.MFA_EMAIL_OTP]: mfaEmailOtpMailTemplate
 };
 //#endregion
 export { MAIL_TEMPLATE_REGISTRY };

package/dist/core/mail/template/registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry.mjs","names":["passwordResetMailTemplate","registrationActivationMailTemplate","MailTemplateName","MAIL_TEMPLATE_REGISTRY","REGISTRATION_ACTIVATION","PASSWORD_RESET"],"sources":["../../../../src/core/mail/template/registry.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { passwordResetMailTemplate } from './templates/password-reset.ts';\nimport { registrationActivationMailTemplate } from './templates/registration-activation.ts';\nimport type { MailTemplate } from './types.ts';\nimport { MailTemplateName } from './types.ts';\n\nexport const MAIL_TEMPLATE_REGISTRY: { [N in MailTemplateName]: MailTemplate<N> } = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,\n    [MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,\n};\n"],"mappings":";;;;;;;AAYA,MAAaG,yBAAuE;EAC/ED,iBAAiBE,0BAA0BH;EAC3CC,iBAAiBG,iBAAiBL;AACvC"}
+{"version":3,"file":"registry.mjs","names":["mfaEmailOtpMailTemplate","passwordResetMailTemplate","registrationActivationMailTemplate","MailTemplateName","MAIL_TEMPLATE_REGISTRY","REGISTRATION_ACTIVATION","PASSWORD_RESET","MFA_EMAIL_OTP"],"sources":["../../../../src/core/mail/template/registry.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { mfaEmailOtpMailTemplate } from './templates/mfa-email-otp.ts';\nimport { passwordResetMailTemplate } from './templates/password-reset.ts';\nimport { registrationActivationMailTemplate } from './templates/registration-activation.ts';\nimport type { MailTemplate } from './types.ts';\nimport { MailTemplateName } from './types.ts';\n\nexport const MAIL_TEMPLATE_REGISTRY: { [N in MailTemplateName]: MailTemplate<N> } = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,\n    [MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,\n    [MailTemplateName.MFA_EMAIL_OTP]: mfaEmailOtpMailTemplate,\n};\n"],"mappings":";;;;;;;;AAaA,MAAaI,yBAAuE;EAC/ED,iBAAiBE,0BAA0BH;EAC3CC,iBAAiBG,iBAAiBL;EAClCE,iBAAiBI,gBAAgBP;AACtC"}

package/dist/core/mail/template/templates/mfa-email-otp.d.ts

@@ -0,0 +1,3 @@
+import { MailTemplateName } from '../types.ts';
+export declare const mfaEmailOtpMailTemplate: import("../types.ts").MailTemplate<MailTemplateName.MFA_EMAIL_OTP>;
+//# sourceMappingURL=mfa-email-otp.d.ts.map

package/dist/core/mail/template/templates/mfa-email-otp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-email-otp.d.ts","sourceRoot":"","sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,eAAO,MAAM,uBAAuB,oEAyBlC,CAAC"}

package/dist/core/mail/template/templates/mfa-email-otp.mjs

@@ -0,0 +1,34 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { code, note, paragraph } from "../../format/blocks.mjs";
+import { defineMailTemplate } from "../define.mjs";
+import { MailTemplateName } from "../types.mjs";
+import { TranslatorTranslationMailKey } from "@authup/i18n";
+//#region src/core/mail/template/templates/mfa-email-otp.ts
+const mfaEmailOtpMailTemplate = defineMailTemplate({
+	name: MailTemplateName.MFA_EMAIL_OTP,
+	build: async (params, t) => {
+		const [subject, intro, codeLabel, hint] = await Promise.all([
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),
+			t(TranslatorTranslationMailKey.CODE),
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT)
+		]);
+		const expiry = params.expiresInMinutes ? await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) : void 0;
+		return {
+			subject,
+			preview: intro,
+			blocks: [
+				paragraph(intro),
+				code(codeLabel, params.code),
+				...expiry ? [note(expiry)] : [],
+				note(hint)
+			]
+		};
+	}
+});
+//#endregion
+export { mfaEmailOtpMailTemplate };
+
+//# sourceMappingURL=mfa-email-otp.mjs.map

package/dist/core/mail/template/templates/mfa-email-otp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-email-otp.mjs","names":["TranslatorTranslationMailKey","code","note","paragraph","defineMailTemplate","MailTemplateName","mfaEmailOtpMailTemplate","name","MFA_EMAIL_OTP","build","params","t","subject","intro","codeLabel","hint","Promise","all","MFA_EMAIL_OTP_SUBJECT","MFA_EMAIL_OTP_INTRO","CODE","MFA_EMAIL_OTP_HINT","expiry","expiresInMinutes","MFA_EMAIL_OTP_EXPIRY","minutes","undefined","preview","blocks"],"sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { code, note, paragraph } from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const mfaEmailOtpMailTemplate = defineMailTemplate({\n    name: MailTemplateName.MFA_EMAIL_OTP,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT),\n        ]);\n\n        const expiry = params.expiresInMinutes ?\n            await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) :\n            undefined;\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(expiry ? [note(expiry)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAYA,MAAaM,0BAA0BF,mBAAmB;CACtDG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,QAAQ,MAAMC,QAAQC,IAAI;GACxDN,EAAEX,6BAA6BkB,qBAAqB;GACpDP,EAAEX,6BAA6BmB,mBAAmB;GAClDR,EAAEX,6BAA6BoB,IAAI;GACnCT,EAAEX,6BAA6BqB,kBAAkB;GACpD;EAED,MAAMC,SAASZ,OAAOa,mBAClB,MAAMZ,EAAEX,6BAA6BwB,sBAAsB,EAAEC,SAASf,OAAOa,iBAAiB,CAAA,IAC9FG,KAAAA;EAEJ,OAAO;GACHd;GACAe,SAASd;GACTe,QAAQ;IACJzB,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;OACvBqB,SAAS,CAACpB,KAAKoB,MAAAA,CAAAA,IAAW,CAAA;IAC9BpB,KAAKa,IAAAA;;EAEb;CACJ;AACJ,CAAA"}

package/dist/core/mail/template/types.d.ts

@@ -2,7 +2,8 @@ import type { TranslatorTranslationMailKey } from '@authup/i18n';
 import type { MailBlock } from '../format/types.ts';
 export declare enum MailTemplateName {
     REGISTRATION_ACTIVATION = "registration-activation",
-    PASSWORD_RESET = "password-reset"
+    PASSWORD_RESET = "password-reset",
+    MFA_EMAIL_OTP = "mfa-email-otp"
 }
 export type MailTemplateParamsMap = {
     [MailTemplateName.REGISTRATION_ACTIVATION]: {
@@ -14,6 +15,10 @@ export type MailTemplateParamsMap = {
         url?: string;
         expiresInMinutes?: number;
     };
+    [MailTemplateName.MFA_EMAIL_OTP]: {
+        code: string;
+        expiresInMinutes?: number;
+    };
 };
 /**
  * Locale-bound translator handed to a template's `build`. Resolves a key

package/dist/core/mail/template/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oBAAY,gBAAgB;IACxB,uBAAuB,4BAA4B;IACnD,cAAc,mBAAmB;CACpC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACjC,GAAG,EAAE,GAAG,4BAA4B,EAAE,EACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,EAAE,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CACD,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAChC,CAAC,EAAE,sBAAsB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oBAAY,gBAAgB;IACxB,uBAAuB,4BAA4B;IACnD,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;CAClC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACjC,GAAG,EAAE,GAAG,4BAA4B,EAAE,EACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,EAAE,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CACD,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAChC,CAAC,EAAE,sBAAsB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC,CAAC"}

package/dist/core/mail/template/types.mjs

@@ -5,6 +5,7 @@ import.meta.url;
 var MailTemplateName = /*#__PURE__*/ function(MailTemplateName) {
 	MailTemplateName["REGISTRATION_ACTIVATION"] = "registration-activation";
 	MailTemplateName["PASSWORD_RESET"] = "password-reset";
+	MailTemplateName["MFA_EMAIL_OTP"] = "mfa-email-otp";
 	return MailTemplateName;
 }({});
 //#endregion

package/dist/core/mail/template/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;QAAAA"}
+{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n    MFA_EMAIL_OTP = 'mfa-email-otp',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n    [MailTemplateName.MFA_EMAIL_OTP]: {\n        code: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;;QAAAA"}

package/dist/core/metrics/index.d.ts

@@ -0,0 +1,3 @@
+export * from './noop.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/metrics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/index.ts"],"names":[],"mappings":"AAOA,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/core/metrics/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { NoopAuthFlowMetrics } from "./noop.mjs";
+export { NoopAuthFlowMetrics };

package/dist/core/metrics/noop.d.ts

@@ -0,0 +1,8 @@
+import type { IAuthFlowMetrics } from './types.ts';
+export declare class NoopAuthFlowMetrics implements IAuthFlowMetrics {
+    recordLogin(): void;
+    recordTokenGrant(): void;
+    recordAuthorize(): void;
+    recordRefreshReplay(): void;
+}
+//# sourceMappingURL=noop.d.ts.map

package/dist/core/metrics/noop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noop.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/noop.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,WAAW,IAAI,IAAI;IAInB,gBAAgB,IAAI,IAAI;IAIxB,eAAe,IAAI,IAAI;IAIvB,mBAAmB,IAAI,IAAI;CAG9B"}

package/dist/core/metrics/noop.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/metrics/noop.ts
+var NoopAuthFlowMetrics = class {
+	recordLogin() {}
+	recordTokenGrant() {}
+	recordAuthorize() {}
+	recordRefreshReplay() {}
+};
+//#endregion
+export { NoopAuthFlowMetrics };
+
+//# sourceMappingURL=noop.mjs.map

package/dist/core/metrics/noop.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"noop.mjs","names":["NoopAuthFlowMetrics","recordLogin","recordTokenGrant","recordAuthorize","recordRefreshReplay"],"sources":["../../../src/core/metrics/noop.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAuthFlowMetrics } from './types.ts';\n\nexport class NoopAuthFlowMetrics implements IAuthFlowMetrics {\n    recordLogin(): void {\n        // noop\n    }\n\n    recordTokenGrant(): void {\n        // noop\n    }\n\n    recordAuthorize(): void {\n        // noop\n    }\n\n    recordRefreshReplay(): void {\n        // noop\n    }\n}\n"],"mappings":";;;;AASA,IAAaA,sBAAb,MAAaA;CACTC,cAAoB,CAEpB;CAEAC,mBAAyB,CAEzB;CAEAC,kBAAwB,CAExB;CAEAC,sBAA4B,CAE5B;AACJ"}

package/dist/core/metrics/types.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2TokenGrant } from '@authup/specs';
+export type AuthFlowLoginResult = 'success' | 'failure';
+/**
+ * `denied` is reserved — dead until an application-access policy (plan 052)
+ * can deny an authorize; emitted in the label domain from day one so
+ * dashboards stay stable when it turns live.
+ */
+export type AuthFlowAuthorizeOutcome = 'issued' | 'denied' | 'login_required' | 'mfa_required' | 'error';
+export interface IAuthFlowMetrics {
+    recordLogin(result: AuthFlowLoginResult): void;
+    /**
+     * Successful token grants only — failures appear in the generic
+     * per-route status-code histogram on /token.
+     */
+    recordTokenGrant(grantType: `${OAuth2TokenGrant}`): void;
+    recordAuthorize(outcome: AuthFlowAuthorizeOutcome): void;
+    recordRefreshReplay(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/metrics/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;AAEzG,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAE/C;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAEzD,eAAe,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAEzD,mBAAmB,IAAI,IAAI,CAAC;CAC/B"}

package/dist/core/metrics/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/access-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/access-policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/access-policy/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AccessPolicyEvaluator } from "./module.mjs";
+export { OAuth2AccessPolicyEvaluator };

package/dist/core/oauth2/access-policy/module.d.ts

@@ -0,0 +1,12 @@
+import type { IdentityPolicyData } from '@authup/access';
+import type { Logger } from '@authup/server-kit';
+import { PolicyEngine } from '../../security/policy/engine.ts';
+import type { IOAuth2AccessPolicyEvaluator, IOAuth2AccessPolicyProvider, OAuth2AccessPolicyEvaluatorContext } from './types.ts';
+export declare class OAuth2AccessPolicyEvaluator implements IOAuth2AccessPolicyEvaluator {
+    protected policyProvider: IOAuth2AccessPolicyProvider;
+    protected engine: PolicyEngine;
+    protected logger?: Logger;
+    constructor(ctx: OAuth2AccessPolicyEvaluatorContext);
+    evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/access-policy/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EACR,4BAA4B,EAC5B,2BAA2B,EAC3B,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAEpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,cAAc,EAAG,2BAA2B,CAAC;IAEvD,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,GAAG,EAAE,kCAAkC;IAM7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;CAoBlF"}

package/dist/core/oauth2/access-policy/module.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyEngine as PolicyEngine$1 } from "../../security/policy/engine.mjs";
+import { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from "@authup/access";
+//#region src/core/oauth2/access-policy/module.ts
+var OAuth2AccessPolicyEvaluator = class {
+	policyProvider;
+	engine;
+	logger;
+	constructor(ctx) {
+		this.policyProvider = ctx.policyProvider;
+		this.engine = new PolicyEngine$1(ctx.identityPermissionProvider);
+		this.logger = ctx.logger;
+	}
+	async evaluate(policyId, subject) {
+		let tree;
+		try {
+			tree = await this.policyProvider.findDescendantsTreeById(policyId);
+		} catch (e) {
+			this.logger?.warn(`Loading the access policy ${policyId} failed.`, { error: e });
+			return false;
+		}
+		if (!tree) return false;
+		const ctx = definePolicyEvaluationContext({ data: new PolicyData({ [BuiltInPolicyType.IDENTITY]: subject }) });
+		return (await this.engine.evaluate(tree, ctx)).success;
+	}
+};
+//#endregion
+export { OAuth2AccessPolicyEvaluator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/access-policy/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","PolicyEngine","OAuth2AccessPolicyEvaluator","policyProvider","engine","logger","ctx","identityPermissionProvider","evaluate","policyId","subject","tree","findDescendantsTreeById","e","warn","error","data","IDENTITY","result","success"],"sources":["../../../../src/core/oauth2/access-policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    PolicyData,\n    definePolicyEvaluationContext,\n} from '@authup/access';\nimport type { BasePolicy, IdentityPolicyData } from '@authup/access';\nimport type { Logger } from '@authup/server-kit';\nimport { PolicyEngine } from '../../security/policy/engine.ts';\nimport type {\n    IOAuth2AccessPolicyEvaluator,\n    IOAuth2AccessPolicyProvider,\n    OAuth2AccessPolicyEvaluatorContext,\n} from './types.ts';\n\nexport class OAuth2AccessPolicyEvaluator implements IOAuth2AccessPolicyEvaluator {\n    protected policyProvider : IOAuth2AccessPolicyProvider;\n\n    protected engine : PolicyEngine;\n\n    protected logger? : Logger;\n\n    constructor(ctx: OAuth2AccessPolicyEvaluatorContext) {\n        this.policyProvider = ctx.policyProvider;\n        this.engine = new PolicyEngine(ctx.identityPermissionProvider);\n        this.logger = ctx.logger;\n    }\n\n    async evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean> {\n        let tree : BasePolicy | null;\n\n        try {\n            tree = await this.policyProvider.findDescendantsTreeById(policyId);\n        } catch (e) {\n            this.logger?.warn(`Loading the access policy ${policyId} failed.`, { error: e });\n            return false;\n        }\n\n        if (!tree) {\n            return false;\n        }\n\n        const ctx = definePolicyEvaluationContext({ data: new PolicyData({ [BuiltInPolicyType.IDENTITY]: subject }) });\n\n        const result = await this.engine.evaluate(tree, ctx);\n\n        return result.success;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaI,8BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,KAAKH,iBAAiBG,IAAIH;EAC1B,KAAKC,SAAS,IAAIH,eAAaK,IAAIC,0BAA0B;EAC7D,KAAKF,SAASC,IAAID;CACtB;CAEA,MAAMG,SAASC,UAAkBC,SAA+C;EAC5E,IAAIC;EAEJ,IAAI;GACAA,OAAO,MAAM,KAAKR,eAAeS,wBAAwBH,QAAAA;EAC7D,SAASI,GAAG;GACR,KAAKR,QAAQS,KAAK,6BAA6BL,SAAS,WAAW,EAAEM,OAAOF,EAAE,CAAA;GAC9E,OAAO;EACX;EAEA,IAAI,CAACF,MACD,OAAO;EAGX,MAAML,MAAMN,8BAA8B,EAAEgB,MAAM,IAAIjB,WAAW,GAAGD,kBAAkBmB,WAAWP,QAAQ,CAAA,EAAG,CAAA;EAI5G,QAAOQ,MAFc,KAAKd,OAAOI,SAASG,MAAML,GAAAA,EAAAA,CAElCa;CAClB;AACJ"}

package/dist/core/oauth2/access-policy/types.d.ts

@@ -0,0 +1,19 @@
+import type { BasePolicy, IdentityPolicyData } from '@authup/access';
+import type { Logger } from '@authup/server-kit';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+export interface IOAuth2AccessPolicyEvaluator {
+    /**
+     * true = access permitted. A present-but-unresolvable policy id,
+     * a load failure, or an evaluation failure all yield false (fail closed).
+     */
+    evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean>;
+}
+export interface IOAuth2AccessPolicyProvider {
+    findDescendantsTreeById(id: string): Promise<BasePolicy | null>;
+}
+export type OAuth2AccessPolicyEvaluatorContext = {
+    policyProvider: IOAuth2AccessPolicyProvider;
+    identityPermissionProvider: IIdentityPermissionProvider;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/access-policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,MAAM,WAAW,4BAA4B;IACzC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,2BAA2B;IACxC,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kCAAkC,GAAG;IAC7C,cAAc,EAAE,2BAA2B,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/oauth2/access-policy/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/code/index.mjs

@@ -2,6 +2,7 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { OAuth2AuthorizationCodeIssuer } from "./issuer/module.mjs";
+import "./issuer/index.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./verifier/module.mjs";
 import "./verifier/index.mjs";
 export { OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeVerifier };

package/dist/core/oauth2/authorization/code/issuer/module.d.ts

@@ -6,6 +6,5 @@ export declare class OAuth2AuthorizationCodeIssuer implements IOAuth2Authorizati
     protected options: OAuth2AuthorizationCodeIssuerOptions;
     constructor(repository: IOAuth2AuthorizationCodeRepository, options?: OAuth2AuthorizationCodeIssuerOptions);
     issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;
-    updateIdToken(entity: OAuth2AuthorizationCode, idToken: string): Promise<void>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/authorization/code/issuer/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;IAsB9B,aAAa,CACf,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAKpB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;CAiCvC"}

package/dist/core/oauth2/authorization/code/issuer/module.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAuth2RequestError } from "@authup/specs";
 //#region src/core/oauth2/authorization/code/issuer/module.ts
 var OAuth2AuthorizationCodeIssuer = class {
 	repository;
@@ -10,6 +11,8 @@ var OAuth2AuthorizationCodeIssuer = class {
 		this.options = options;
 	}
 	async issue(input, identity, options = {}) {
+		const { realm } = identity.data;
+		if (!realm) throw OAuth2RequestError.identityInvalid();
 		const entity = {
 			redirect_uri: input.redirect_uri,
 			client_id: input.client_id,
@@ -17,18 +20,17 @@ var OAuth2AuthorizationCodeIssuer = class {
 			nonce: input.nonce,
 			code_challenge: input.code_challenge,
 			code_challenge_method: input.code_challenge_method,
-			realm_id: identity.data.realm.id,
-			realm_name: identity.data.realm.name,
+			acr_values: input.acr_values ?? null,
+			auth_time: options.authTime ?? Math.floor(Date.now() / 1e3),
+			auth_method: options.authMethod ?? null,
+			realm_id: realm.id,
+			realm_name: realm.name,
 			sub: identity.data.id,
 			sub_kind: identity.type
 		};
-		if (options.idToken) entity.id_token = options.idToken;
+		if (options.sessionId) entity.session_id = options.sessionId;
 		return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });
 	}
-	async updateIdToken(entity, idToken) {
-		entity.id_token = idToken;
-		await this.repository.save(entity, { maxAge: this.options.maxAge });
-	}
 };
 //#endregion
 export { OAuth2AuthorizationCodeIssuer };

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","realm_id","data","realm","id","realm_name","name","sub","sub_kind","type","idToken","id_token","save","maxAge","updateIdToken"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            realm_id: identity.data.realm.id,\n            realm_name: identity.data.realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.idToken) {\n            entity.id_token = options.idToken;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n\n    async updateIdToken(\n        entity: OAuth2AuthorizationCode,\n        idToken: string,\n    ) : Promise<void> {\n        entity.id_token = idToken;\n\n        await this.repository.save(entity, { maxAge: this.options.maxAge });\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EACjC,MAAMI,SAAuC;GACzCC,cAAcH,MAAMG;GACpBC,WAAWJ,MAAMI;GACjBC,OAAOL,MAAMK;GACbC,OAAON,MAAMM;GACbC,gBAAgBP,MAAMO;GACtBC,uBAAuBR,MAAMQ;GAE7BC,UAAUR,SAASS,KAAKC,MAAMC;GAC9BC,YAAYZ,SAASS,KAAKC,MAAMG;GAChCC,KAAKd,SAASS,KAAKE;GACnBI,UAAUf,SAASgB;EACvB;EAEA,IAAInB,QAAQoB,SACRhB,OAAOiB,WAAWrB,QAAQoB;EAG9B,OAAO,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQvB,QAAQuB,UAAU,KAAKvB,QAAQuB,OAAO,CAAA;CACxF;CAEA,MAAMC,cACFpB,QACAgB,SACc;EACdhB,OAAOiB,WAAWD;EAElB,MAAM,KAAKrB,WAAWuB,KAAKlB,QAAQ,EAAEmB,QAAQ,KAAKvB,QAAQuB,OAAO,CAAA;CACrE;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","realm","data","identityInvalid","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","acr_values","auth_time","authTime","Math","floor","Date","now","auth_method","authMethod","realm_id","id","realm_name","name","sub","sub_kind","type","sessionId","session_id","save","maxAge"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        // The code carries the identity's realm id + name. A dangling realm\n        // relation (realm row deleted without cascade) must fail closed as a\n        // clean OAuth2 error — never a TypeError → 500.\n        const { realm } = identity.data;\n        if (!realm) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n            acr_values: input.acr_values ?? null,\n\n            auth_time: options.authTime ?? Math.floor(Date.now() / 1000),\n            auth_method: options.authMethod ?? null,\n\n            realm_id: realm.id,\n            realm_name: realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.sessionId) {\n            entity.session_id = options.sessionId;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EAIjC,MAAM,EAAEI,UAAUD,SAASE;EAC3B,IAAI,CAACD,OACD,MAAMP,mBAAmBS,gBAAe;EAG5C,MAAMC,SAAuC;GACzCC,cAAcN,MAAMM;GACpBC,WAAWP,MAAMO;GACjBC,OAAOR,MAAMQ;GACbC,OAAOT,MAAMS;GACbC,gBAAgBV,MAAMU;GACtBC,uBAAuBX,MAAMW;GAC7BC,YAAYZ,MAAMY,cAAc;GAEhCC,WAAWf,QAAQgB,YAAYC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;GACvDC,aAAarB,QAAQsB,cAAc;GAEnCC,UAAUnB,MAAMoB;GAChBC,YAAYrB,MAAMsB;GAClBC,KAAKxB,SAASE,KAAKmB;GACnBI,UAAUzB,SAAS0B;EACvB;EAEA,IAAI7B,QAAQ8B,WACRvB,OAAOwB,aAAa/B,QAAQ8B;EAGhC,OAAO,KAAK/B,WAAWiC,KAAKzB,QAAQ,EAAE0B,QAAQjC,QAAQiC,UAAU,KAAKjC,QAAQiC,OAAO,CAAA;CACxF;AACJ"}

package/dist/core/oauth2/authorization/code/issuer/types.d.ts

@@ -1,13 +1,27 @@
-import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest, SessionAuthMethod } from '@authup/core-kit';
 export type OAuth2AuthorizationCodeIssuerOptions = {
     /**
      * Max duration in seconds
      */
     maxAge?: number;
-    idToken?: string;
+    /**
+     * The id of the session the authorizing bearer belongs to, persisted on the
+     * authorization code so the token exchange can reuse it.
+     */
+    sessionId?: string | null;
+    /**
+     * The authentication instant (seconds since epoch) — persisted on the code
+     * for the id_token `auth_time` claim minted at the /token exchange.
+     * Defaults to the issuance instant (session-less flows authenticate now).
+     */
+    authTime?: number;
+    /**
+     * How the subject authenticated (SessionAuthMethod) — persisted on the
+     * code so a session created at the /token exchange inherits it.
+     */
+    authMethod?: `${SessionAuthMethod}` | null;
 };
 export interface IOAuth2AuthorizationCodeIssuer {
     issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;
-    updateIdToken(entity: OAuth2AuthorizationCode, idToken: string): Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/authorization/code/issuer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAErC,aAAa,CACT,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EACR,uBAAuB,EACvB,8BAA8B,EAC9B,iBAAiB,EACpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC"}

package/dist/core/oauth2/authorization/code/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;gBAE9C,UAAU,EAAE,kCAAkC;IAIpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC;CAiDhH"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAE1G,qBAAa,+BAAgC,YAAW,gCAAgC;IACpF,SAAS,CAAC,UAAU,EAAG,kCAAkC,CAAC;gBAE9C,UAAU,EAAE,kCAAkC;IAIpD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qCAAqC,GAAI,OAAO,CAAC,uBAAuB,CAAC;CA0DhH"}

package/dist/core/oauth2/authorization/code/verifier/module.mjs

@@ -15,6 +15,7 @@ var OAuth2AuthorizationCodeVerifier = class {
 		if (entity.client_id) {
 			if (!options.clientId || options.clientId !== entity.client_id) throw OAuth2GrantError.invalid();
 		}
+		if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) throw OAuth2GrantError.invalid();
 		if (entity.redirect_uri) {
 			if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) throw OAuth2GrantError.redirectUriMismatch();
 		}