@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/core/key/realm-cipher.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmCipherBlobError } from "./error.mjs";
+import "./constants.mjs";
+import { KeyStatus } from "@authup/core-kit";
+import { SymmetricCipher } from "@authup/server-kit";
+import { AuthupError } from "@authup/errors";
+import { JWKUse } from "@authup/specs";
+//#region src/core/key/realm-cipher.ts
+var RealmCipher = class {
+	keyStore;
+	/**
+	* Imported ciphers by key id — key MATERIAL is immutable, so entries
+	* never invalidate. Status and realm binding are deliberately NOT
+	* cached: decrypt re-resolves the key row every call so disabling a
+	* key acts as an immediate, reversible kill switch.
+	*/ ciphers;
+	constructor(ctx) {
+		this.keyStore = ctx.keyStore;
+		this.ciphers = /* @__PURE__ */ new Map();
+	}
+	async encrypt(plain, realmId) {
+		const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);
+		if (!key.decryption_key) throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);
+		const cipher = this.resolveCipher(key.id, key.decryption_key);
+		return [
+			"v1",
+			key.id,
+			await cipher.encrypt(plain)
+		].join(".");
+	}
+	async decrypt(blob, realmId) {
+		const parts = blob.split(".");
+		if (parts.length !== 3 || parts[0] !== "v1") throw new RealmCipherBlobError("The cipher blob is malformed.");
+		const [, keyId, payload] = parts;
+		const key = await this.keyStore.resolveById(keyId);
+		if (!key || key.use !== JWKUse.ENCRYPTION || !key.decryption_key) throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);
+		if (key.status === KeyStatus.DISABLED) throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);
+		if (key.realm_id !== realmId) throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);
+		const cipher = this.resolveCipher(key.id, key.decryption_key);
+		try {
+			return await cipher.decrypt(payload);
+		} catch {
+			throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);
+		}
+	}
+	resolveCipher(keyId, material) {
+		let cipher = this.ciphers.get(keyId);
+		if (!cipher) {
+			cipher = new SymmetricCipher(material);
+			this.ciphers.set(keyId, cipher);
+		}
+		return cipher;
+	}
+};
+//#endregion
+export { RealmCipher };
+
+//# sourceMappingURL=realm-cipher.mjs.map

package/dist/core/key/realm-cipher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-cipher.mjs","names":["AuthupError","KeyStatus","SymmetricCipher","JWKUse","REALM_CIPHER_BLOB_VERSION","RealmCipherBlobError","RealmCipher","keyStore","ciphers","ctx","Map","encrypt","plain","realmId","key","resolveOrCreate","ENCRYPTION","decryption_key","cipher","resolveCipher","id","join","decrypt","blob","parts","split","length","keyId","payload","resolveById","use","status","DISABLED","realm_id","material","get","set"],"sources":["../../../src/core/key/realm-cipher.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport { REALM_CIPHER_BLOB_VERSION } from './constants.ts';\nimport { RealmCipherBlobError } from './error.ts';\nimport type { IKeyStore, IRealmCipher } from './types.ts';\n\nexport type RealmCipherContext = {\n    keyStore: IKeyStore,\n};\n\nexport class RealmCipher implements IRealmCipher {\n    protected keyStore : IKeyStore;\n\n    /**\n     * Imported ciphers by key id — key MATERIAL is immutable, so entries\n     * never invalidate. Status and realm binding are deliberately NOT\n     * cached: decrypt re-resolves the key row every call so disabling a\n     * key acts as an immediate, reversible kill switch.\n     */\n    protected ciphers : Map<string, ISymmetricCipher>;\n\n    constructor(ctx: RealmCipherContext) {\n        this.keyStore = ctx.keyStore;\n        this.ciphers = new Map();\n    }\n\n    async encrypt(plain: string, realmId: string) : Promise<string> {\n        const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);\n        if (!key.decryption_key) {\n            throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryption_key);\n\n        return [\n            REALM_CIPHER_BLOB_VERSION,\n            key.id,\n            await cipher.encrypt(plain),\n        ].join('.');\n    }\n\n    async decrypt(blob: string, realmId: string) : Promise<string> {\n        const parts = blob.split('.');\n        if (parts.length !== 3 || parts[0] !== REALM_CIPHER_BLOB_VERSION) {\n            throw new RealmCipherBlobError('The cipher blob is malformed.');\n        }\n\n        const [, keyId, payload] = parts;\n\n        const key = await this.keyStore.resolveById(keyId);\n        if (\n            !key ||\n            key.use !== JWKUse.ENCRYPTION ||\n            !key.decryption_key\n        ) {\n            throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);\n        }\n\n        if (key.status === KeyStatus.DISABLED) {\n            throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);\n        }\n\n        if (key.realm_id !== realmId) {\n            throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryption_key);\n\n        try {\n            return await cipher.decrypt(payload);\n        } catch {\n            // failed GCM authentication / corrupt payload — blob semantics,\n            // not infrastructure.\n            throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);\n        }\n    }\n\n    protected resolveCipher(\n        keyId: string,\n        material: string,\n    ) : ISymmetricCipher {\n        let cipher = this.ciphers.get(keyId);\n        if (!cipher) {\n            cipher = new SymmetricCipher(material);\n            this.ciphers.set(keyId, cipher);\n        }\n\n        return cipher;\n    }\n}\n"],"mappings":";;;;;;;;;;AAoBA,IAAaM,cAAb,MAAaA;CACCC;;;;;;IAQV;CAEA,YAAYE,KAAyB;EACjC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,0BAAU,IAAIE,IAAAA;CACvB;CAEA,MAAMC,QAAQC,OAAeC,SAAmC;EAC5D,MAAMC,MAAM,MAAM,KAAKP,SAASQ,gBAAgBF,SAASV,OAAOa,UAAU;EAC1E,IAAI,CAACF,IAAIG,gBACL,MAAM,IAAIjB,YAAY,qDAAqDa,QAAQ,EAAE;EAGzF,MAAMK,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,cAAc;EAE5D,OAAO;;GAEHH,IAAIM;GACJ,MAAMF,OAAOP,QAAQC,KAAAA;GACxB,CAACS,KAAK,GAAA;CACX;CAEA,MAAMC,QAAQC,MAAcV,SAAmC;EAC3D,MAAMW,QAAQD,KAAKE,MAAM,GAAA;EACzB,IAAID,MAAME,WAAW,KAAKF,MAAM,OAAA,MAC5B,MAAM,IAAInB,qBAAqB,+BAAA;EAGnC,MAAM,GAAGsB,OAAOC,WAAWJ;EAE3B,MAAMV,MAAM,MAAM,KAAKP,SAASsB,YAAYF,KAAAA;EAC5C,IACI,CAACb,OACDA,IAAIgB,QAAQ3B,OAAOa,cACnB,CAACF,IAAIG,gBAEL,MAAM,IAAIZ,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAIiB,WAAW9B,UAAU+B,UACzB,MAAM,IAAI3B,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAImB,aAAapB,SACjB,MAAM,IAAIR,qBAAqB,gEAAgEsB,MAAM,GAAG;EAG5G,MAAMT,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,cAAc;EAE5D,IAAI;GACA,OAAO,MAAMC,OAAOI,QAAQM,OAAAA;EAChC,QAAQ;GAGJ,MAAM,IAAIvB,qBAAqB,2CAA2CsB,MAAM,GAAG;EACvF;CACJ;CAEUR,cACNQ,OACAO,UACiB;EACjB,IAAIhB,SAAS,KAAKV,QAAQ2B,IAAIR,KAAAA;EAC9B,IAAI,CAACT,QAAQ;GACTA,SAAS,IAAIhB,gBAAgBgC,QAAAA;GAC7B,KAAK1B,QAAQ4B,IAAIT,OAAOT,MAAAA;EAC5B;EAEA,OAAOA;CACX;AACJ"}

package/dist/core/key/types.d.ts

@@ -0,0 +1,59 @@
+import type { Key } from '@authup/core-kit';
+import type { JWKUse } from '@authup/specs';
+export interface IKeyProvisioner {
+    /**
+     * Ensure the realm holds at least one sig and one enc key row.
+     * Idempotent; never throws (provisioning must not fail realm creation
+     * or startup).
+     *
+     * @param realm
+     */
+    ensureForRealm(realm: {
+        id: string;
+    }): Promise<void>;
+}
+export interface IKeyStore {
+    /**
+     * Resolve the realm's highest-priority ACTIVE key for the given use,
+     * with usable (unwrapped) material. Mints one iff ZERO rows exist for
+     * (realm, use) — the self-healing zero-config backstop (provisioning
+     * mints eagerly). Rows existing but none active fails loud: an admin
+     * who disabled every key meant it.
+     *
+     * @param realmId
+     * @param use
+     */
+    resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    /**
+     * Resolve a key by explicit id with usable (unwrapped) material.
+     * Read-only; status enforcement is the consumer's concern.
+     *
+     * @param id
+     */
+    resolveById(id: string): Promise<Key | null>;
+}
+/**
+ * Realm-scoped at-rest encryption over the key store's enc keys.
+ * Blobs are self-describing (v1.&lt;key_id&gt;.&lt;payload&gt;), so decryption
+ * resolves its key by id — concurrent key creation and future key
+ * rotation never orphan a blob.
+ */
+export interface IRealmCipher {
+    /**
+     * Encrypt under the realm's current enc key (created on first use).
+     *
+     * @param plain
+     * @param realmId
+     */
+    encrypt(plain: string, realmId: string): Promise<string>;
+    /**
+     * Decrypt a blob via the key id it carries. The referenced key must
+     * belong to the given realm — the binding assert is mandatory, so a
+     * foreign realm's blob can never decrypt.
+     *
+     * @param blob
+     * @param realmId
+     */
+    decrypt(blob: string, realmId: string): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/key/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/key/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,SAAS;IACtB;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAElE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/key/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/key/wrap.d.ts

@@ -0,0 +1,5 @@
+import type { ISymmetricCipher } from '@authup/server-kit';
+export declare function isWrappedKeyMaterial(value: string): boolean;
+export declare function wrapKeyMaterial(cipher: ISymmetricCipher, value: string): Promise<string>;
+export declare function unwrapKeyMaterial(cipher: ISymmetricCipher | null | undefined, value: string): Promise<string>;
+//# sourceMappingURL=wrap.d.ts.map

package/dist/core/key/wrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../../src/core/key/wrap.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAE5D;AAED,wBAAsB,eAAe,CACjC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAElB;AAED,wBAAsB,iBAAiB,CACnC,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC3C,KAAK,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAalB"}

package/dist/core/key/wrap.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { WRAPPED_KEY_MATERIAL_PREFIX } from "./constants.mjs";
+import { AuthupError } from "@authup/errors";
+//#region src/core/key/wrap.ts
+function isWrappedKeyMaterial(value) {
+	return value.startsWith(WRAPPED_KEY_MATERIAL_PREFIX);
+}
+async function wrapKeyMaterial(cipher, value) {
+	return `${WRAPPED_KEY_MATERIAL_PREFIX}${await cipher.encrypt(value)}`;
+}
+async function unwrapKeyMaterial(cipher, value) {
+	if (!isWrappedKeyMaterial(value)) return value;
+	if (!cipher) throw new AuthupError("The key store holds wrapped key material, but no secretsEncryptionKey (SECRETS_ENCRYPTION_KEY) is configured.");
+	return cipher.decrypt(value.substring(WRAPPED_KEY_MATERIAL_PREFIX.length));
+}
+//#endregion
+export { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial };
+
+//# sourceMappingURL=wrap.mjs.map

package/dist/core/key/wrap.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.mjs","names":["AuthupError","WRAPPED_KEY_MATERIAL_PREFIX","isWrappedKeyMaterial","value","startsWith","wrapKeyMaterial","cipher","encrypt","unwrapKeyMaterial","decrypt","substring","length"],"sources":["../../../src/core/key/wrap.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { WRAPPED_KEY_MATERIAL_PREFIX } from './constants.ts';\n\nexport function isWrappedKeyMaterial(value: string) : boolean {\n    return value.startsWith(WRAPPED_KEY_MATERIAL_PREFIX);\n}\n\nexport async function wrapKeyMaterial(\n    cipher: ISymmetricCipher,\n    value: string,\n) : Promise<string> {\n    return `${WRAPPED_KEY_MATERIAL_PREFIX}${await cipher.encrypt(value)}`;\n}\n\nexport async function unwrapKeyMaterial(\n    cipher: ISymmetricCipher | null | undefined,\n    value: string,\n) : Promise<string> {\n    if (!isWrappedKeyMaterial(value)) {\n        return value;\n    }\n\n    if (!cipher) {\n        throw new AuthupError(\n            'The key store holds wrapped key material, ' +\n            'but no secretsEncryptionKey (SECRETS_ENCRYPTION_KEY) is configured.',\n        );\n    }\n\n    return cipher.decrypt(value.substring(WRAPPED_KEY_MATERIAL_PREFIX.length));\n}\n"],"mappings":";;;;;;AAWA,SAAgBE,qBAAqBC,OAAa;CAC9C,OAAOA,MAAMC,WAAWH,2BAAAA;AAC5B;AAEA,eAAsBI,gBAClBC,QACAH,OAAa;CAEb,OAAO,GAAGF,8BAA8B,MAAMK,OAAOC,QAAQJ,KAAAA;AACjE;AAEA,eAAsBK,kBAClBF,QACAH,OAAa;CAEb,IAAI,CAACD,qBAAqBC,KAAAA,GACtB,OAAOA;CAGX,IAAI,CAACG,QACD,MAAM,IAAIN,YACN,+GACA;CAIR,OAAOM,OAAOG,QAAQN,MAAMO,UAAUT,4BAA4BU,MAAM,CAAA;AAC5E"}

package/dist/core/mail/template/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/registry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,sBAAsB,EAAE;KAAG,CAAC,IAAI,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;CAG9E,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/registry.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,sBAAsB,EAAE;KAAG,CAAC,IAAI,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;CAI9E,CAAC"}

package/dist/core/mail/template/registry.mjs

@@ -2,12 +2,14 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { MailTemplateName } from "./types.mjs";
+import { mfaEmailOtpMailTemplate } from "./templates/mfa-email-otp.mjs";
 import { passwordResetMailTemplate } from "./templates/password-reset.mjs";
 import { registrationActivationMailTemplate } from "./templates/registration-activation.mjs";
 //#region src/core/mail/template/registry.ts
 const MAIL_TEMPLATE_REGISTRY = {
 	[MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,
-	[MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate
+	[MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,
+	[MailTemplateName.MFA_EMAIL_OTP]: mfaEmailOtpMailTemplate
 };
 //#endregion
 export { MAIL_TEMPLATE_REGISTRY };

package/dist/core/mail/template/registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry.mjs","names":["passwordResetMailTemplate","registrationActivationMailTemplate","MailTemplateName","MAIL_TEMPLATE_REGISTRY","REGISTRATION_ACTIVATION","PASSWORD_RESET"],"sources":["../../../../src/core/mail/template/registry.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { passwordResetMailTemplate } from './templates/password-reset.ts';\nimport { registrationActivationMailTemplate } from './templates/registration-activation.ts';\nimport type { MailTemplate } from './types.ts';\nimport { MailTemplateName } from './types.ts';\n\nexport const MAIL_TEMPLATE_REGISTRY: { [N in MailTemplateName]: MailTemplate<N> } = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,\n    [MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,\n};\n"],"mappings":";;;;;;;AAYA,MAAaG,yBAAuE;EAC/ED,iBAAiBE,0BAA0BH;EAC3CC,iBAAiBG,iBAAiBL;AACvC"}
+{"version":3,"file":"registry.mjs","names":["mfaEmailOtpMailTemplate","passwordResetMailTemplate","registrationActivationMailTemplate","MailTemplateName","MAIL_TEMPLATE_REGISTRY","REGISTRATION_ACTIVATION","PASSWORD_RESET","MFA_EMAIL_OTP"],"sources":["../../../../src/core/mail/template/registry.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { mfaEmailOtpMailTemplate } from './templates/mfa-email-otp.ts';\nimport { passwordResetMailTemplate } from './templates/password-reset.ts';\nimport { registrationActivationMailTemplate } from './templates/registration-activation.ts';\nimport type { MailTemplate } from './types.ts';\nimport { MailTemplateName } from './types.ts';\n\nexport const MAIL_TEMPLATE_REGISTRY: { [N in MailTemplateName]: MailTemplate<N> } = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,\n    [MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,\n    [MailTemplateName.MFA_EMAIL_OTP]: mfaEmailOtpMailTemplate,\n};\n"],"mappings":";;;;;;;;AAaA,MAAaI,yBAAuE;EAC/ED,iBAAiBE,0BAA0BH;EAC3CC,iBAAiBG,iBAAiBL;EAClCE,iBAAiBI,gBAAgBP;AACtC"}

package/dist/core/mail/template/templates/mfa-email-otp.d.ts

@@ -0,0 +1,3 @@
+import { MailTemplateName } from '../types.ts';
+export declare const mfaEmailOtpMailTemplate: import("../types.ts").MailTemplate<MailTemplateName.MFA_EMAIL_OTP>;
+//# sourceMappingURL=mfa-email-otp.d.ts.map

package/dist/core/mail/template/templates/mfa-email-otp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-email-otp.d.ts","sourceRoot":"","sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,eAAO,MAAM,uBAAuB,oEAyBlC,CAAC"}

package/dist/core/mail/template/templates/mfa-email-otp.mjs

@@ -0,0 +1,34 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { code, note, paragraph } from "../../format/blocks.mjs";
+import { defineMailTemplate } from "../define.mjs";
+import { MailTemplateName } from "../types.mjs";
+import { TranslatorTranslationMailKey } from "@authup/i18n";
+//#region src/core/mail/template/templates/mfa-email-otp.ts
+const mfaEmailOtpMailTemplate = defineMailTemplate({
+	name: MailTemplateName.MFA_EMAIL_OTP,
+	build: async (params, t) => {
+		const [subject, intro, codeLabel, hint] = await Promise.all([
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),
+			t(TranslatorTranslationMailKey.CODE),
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT)
+		]);
+		const expiry = params.expiresInMinutes ? await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) : void 0;
+		return {
+			subject,
+			preview: intro,
+			blocks: [
+				paragraph(intro),
+				code(codeLabel, params.code),
+				...expiry ? [note(expiry)] : [],
+				note(hint)
+			]
+		};
+	}
+});
+//#endregion
+export { mfaEmailOtpMailTemplate };
+
+//# sourceMappingURL=mfa-email-otp.mjs.map

package/dist/core/mail/template/templates/mfa-email-otp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-email-otp.mjs","names":["TranslatorTranslationMailKey","code","note","paragraph","defineMailTemplate","MailTemplateName","mfaEmailOtpMailTemplate","name","MFA_EMAIL_OTP","build","params","t","subject","intro","codeLabel","hint","Promise","all","MFA_EMAIL_OTP_SUBJECT","MFA_EMAIL_OTP_INTRO","CODE","MFA_EMAIL_OTP_HINT","expiry","expiresInMinutes","MFA_EMAIL_OTP_EXPIRY","minutes","undefined","preview","blocks"],"sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { code, note, paragraph } from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const mfaEmailOtpMailTemplate = defineMailTemplate({\n    name: MailTemplateName.MFA_EMAIL_OTP,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT),\n        ]);\n\n        const expiry = params.expiresInMinutes ?\n            await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) :\n            undefined;\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(expiry ? [note(expiry)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAYA,MAAaM,0BAA0BF,mBAAmB;CACtDG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,QAAQ,MAAMC,QAAQC,IAAI;GACxDN,EAAEX,6BAA6BkB,qBAAqB;GACpDP,EAAEX,6BAA6BmB,mBAAmB;GAClDR,EAAEX,6BAA6BoB,IAAI;GACnCT,EAAEX,6BAA6BqB,kBAAkB;GACpD;EAED,MAAMC,SAASZ,OAAOa,mBAClB,MAAMZ,EAAEX,6BAA6BwB,sBAAsB,EAAEC,SAASf,OAAOa,iBAAiB,CAAA,IAC9FG,KAAAA;EAEJ,OAAO;GACHd;GACAe,SAASd;GACTe,QAAQ;IACJzB,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;OACvBqB,SAAS,CAACpB,KAAKoB,MAAAA,CAAAA,IAAW,CAAA;IAC9BpB,KAAKa,IAAAA;;EAEb;CACJ;AACJ,CAAA"}

package/dist/core/mail/template/types.d.ts

@@ -2,7 +2,8 @@ import type { TranslatorTranslationMailKey } from '@authup/i18n';
 import type { MailBlock } from '../format/types.ts';
 export declare enum MailTemplateName {
     REGISTRATION_ACTIVATION = "registration-activation",
-    PASSWORD_RESET = "password-reset"
+    PASSWORD_RESET = "password-reset",
+    MFA_EMAIL_OTP = "mfa-email-otp"
 }
 export type MailTemplateParamsMap = {
     [MailTemplateName.REGISTRATION_ACTIVATION]: {
@@ -14,6 +15,10 @@ export type MailTemplateParamsMap = {
         url?: string;
         expiresInMinutes?: number;
     };
+    [MailTemplateName.MFA_EMAIL_OTP]: {
+        code: string;
+        expiresInMinutes?: number;
+    };
 };
 /**
  * Locale-bound translator handed to a template's `build`. Resolves a key

package/dist/core/mail/template/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oBAAY,gBAAgB;IACxB,uBAAuB,4BAA4B;IACnD,cAAc,mBAAmB;CACpC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACjC,GAAG,EAAE,GAAG,4BAA4B,EAAE,EACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,EAAE,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CACD,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAChC,CAAC,EAAE,sBAAsB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oBAAY,gBAAgB;IACxB,uBAAuB,4BAA4B;IACnD,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;CAClC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACjC,GAAG,EAAE,GAAG,4BAA4B,EAAE,EACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,EAAE,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CACD,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAChC,CAAC,EAAE,sBAAsB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC,CAAC"}

package/dist/core/mail/template/types.mjs

@@ -5,6 +5,7 @@ import.meta.url;
 var MailTemplateName = /*#__PURE__*/ function(MailTemplateName) {
 	MailTemplateName["REGISTRATION_ACTIVATION"] = "registration-activation";
 	MailTemplateName["PASSWORD_RESET"] = "password-reset";
+	MailTemplateName["MFA_EMAIL_OTP"] = "mfa-email-otp";
 	return MailTemplateName;
 }({});
 //#endregion

package/dist/core/mail/template/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;QAAAA"}
+{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n    MFA_EMAIL_OTP = 'mfa-email-otp',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n    [MailTemplateName.MFA_EMAIL_OTP]: {\n        code: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;;QAAAA"}

package/dist/core/metrics/index.d.ts

@@ -0,0 +1,3 @@
+export * from './noop.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/metrics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/index.ts"],"names":[],"mappings":"AAOA,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/core/metrics/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { NoopAuthFlowMetrics } from "./noop.mjs";
+export { NoopAuthFlowMetrics };

package/dist/core/metrics/noop.d.ts

@@ -0,0 +1,8 @@
+import type { IAuthFlowMetrics } from './types.ts';
+export declare class NoopAuthFlowMetrics implements IAuthFlowMetrics {
+    recordLogin(): void;
+    recordTokenGrant(): void;
+    recordAuthorize(): void;
+    recordRefreshReplay(): void;
+}
+//# sourceMappingURL=noop.d.ts.map

package/dist/core/metrics/noop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noop.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/noop.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,WAAW,IAAI,IAAI;IAInB,gBAAgB,IAAI,IAAI;IAIxB,eAAe,IAAI,IAAI;IAIvB,mBAAmB,IAAI,IAAI;CAG9B"}

package/dist/core/metrics/noop.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/metrics/noop.ts
+var NoopAuthFlowMetrics = class {
+	recordLogin() {}
+	recordTokenGrant() {}
+	recordAuthorize() {}
+	recordRefreshReplay() {}
+};
+//#endregion
+export { NoopAuthFlowMetrics };
+
+//# sourceMappingURL=noop.mjs.map

package/dist/core/metrics/noop.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"noop.mjs","names":["NoopAuthFlowMetrics","recordLogin","recordTokenGrant","recordAuthorize","recordRefreshReplay"],"sources":["../../../src/core/metrics/noop.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAuthFlowMetrics } from './types.ts';\n\nexport class NoopAuthFlowMetrics implements IAuthFlowMetrics {\n    recordLogin(): void {\n        // noop\n    }\n\n    recordTokenGrant(): void {\n        // noop\n    }\n\n    recordAuthorize(): void {\n        // noop\n    }\n\n    recordRefreshReplay(): void {\n        // noop\n    }\n}\n"],"mappings":";;;;AASA,IAAaA,sBAAb,MAAaA;CACTC,cAAoB,CAEpB;CAEAC,mBAAyB,CAEzB;CAEAC,kBAAwB,CAExB;CAEAC,sBAA4B,CAE5B;AACJ"}

package/dist/core/metrics/types.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2TokenGrant } from '@authup/specs';
+export type AuthFlowLoginResult = 'success' | 'failure';
+/**
+ * `denied` is reserved — dead until an application-access policy (plan 052)
+ * can deny an authorize; emitted in the label domain from day one so
+ * dashboards stay stable when it turns live.
+ */
+export type AuthFlowAuthorizeOutcome = 'issued' | 'denied' | 'login_required' | 'mfa_required' | 'error';
+export interface IAuthFlowMetrics {
+    recordLogin(result: AuthFlowLoginResult): void;
+    /**
+     * Successful token grants only — failures appear in the generic
+     * per-route status-code histogram on /token.
+     */
+    recordTokenGrant(grantType: `${OAuth2TokenGrant}`): void;
+    recordAuthorize(outcome: AuthFlowAuthorizeOutcome): void;
+    recordRefreshReplay(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/metrics/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;AAEzG,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAE/C;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAEzD,eAAe,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAEzD,mBAAmB,IAAI,IAAI,CAAC;CAC/B"}

package/dist/core/metrics/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/access-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/access-policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/access-policy/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AccessPolicyEvaluator } from "./module.mjs";
+export { OAuth2AccessPolicyEvaluator };

package/dist/core/oauth2/access-policy/module.d.ts

@@ -0,0 +1,12 @@
+import type { IdentityPolicyData } from '@authup/access';
+import type { Logger } from '@authup/server-kit';
+import { PolicyEngine } from '../../security/policy/engine.ts';
+import type { IOAuth2AccessPolicyEvaluator, IOAuth2AccessPolicyProvider, OAuth2AccessPolicyEvaluatorContext } from './types.ts';
+export declare class OAuth2AccessPolicyEvaluator implements IOAuth2AccessPolicyEvaluator {
+    protected policyProvider: IOAuth2AccessPolicyProvider;
+    protected engine: PolicyEngine;
+    protected logger?: Logger;
+    constructor(ctx: OAuth2AccessPolicyEvaluatorContext);
+    evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/access-policy/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EACR,4BAA4B,EAC5B,2BAA2B,EAC3B,kCAAkC,EACrC,MAAM,YAAY,CAAC;AAEpB,qBAAa,2BAA4B,YAAW,4BAA4B;IAC5E,SAAS,CAAC,cAAc,EAAG,2BAA2B,CAAC;IAEvD,SAAS,CAAC,MAAM,EAAG,YAAY,CAAC;IAEhC,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,GAAG,EAAE,kCAAkC;IAM7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;CAoBlF"}

package/dist/core/oauth2/access-policy/module.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyEngine as PolicyEngine$1 } from "../../security/policy/engine.mjs";
+import { BuiltInPolicyType, PolicyData, definePolicyEvaluationContext } from "@authup/access";
+//#region src/core/oauth2/access-policy/module.ts
+var OAuth2AccessPolicyEvaluator = class {
+	policyProvider;
+	engine;
+	logger;
+	constructor(ctx) {
+		this.policyProvider = ctx.policyProvider;
+		this.engine = new PolicyEngine$1(ctx.identityPermissionProvider);
+		this.logger = ctx.logger;
+	}
+	async evaluate(policyId, subject) {
+		let tree;
+		try {
+			tree = await this.policyProvider.findDescendantsTreeById(policyId);
+		} catch (e) {
+			this.logger?.warn(`Loading the access policy ${policyId} failed.`, { error: e });
+			return false;
+		}
+		if (!tree) return false;
+		const ctx = definePolicyEvaluationContext({ data: new PolicyData({ [BuiltInPolicyType.IDENTITY]: subject }) });
+		return (await this.engine.evaluate(tree, ctx)).success;
+	}
+};
+//#endregion
+export { OAuth2AccessPolicyEvaluator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/access-policy/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","PolicyData","definePolicyEvaluationContext","PolicyEngine","OAuth2AccessPolicyEvaluator","policyProvider","engine","logger","ctx","identityPermissionProvider","evaluate","policyId","subject","tree","findDescendantsTreeById","e","warn","error","data","IDENTITY","result","success"],"sources":["../../../../src/core/oauth2/access-policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    BuiltInPolicyType,\n    PolicyData,\n    definePolicyEvaluationContext,\n} from '@authup/access';\nimport type { BasePolicy, IdentityPolicyData } from '@authup/access';\nimport type { Logger } from '@authup/server-kit';\nimport { PolicyEngine } from '../../security/policy/engine.ts';\nimport type {\n    IOAuth2AccessPolicyEvaluator,\n    IOAuth2AccessPolicyProvider,\n    OAuth2AccessPolicyEvaluatorContext,\n} from './types.ts';\n\nexport class OAuth2AccessPolicyEvaluator implements IOAuth2AccessPolicyEvaluator {\n    protected policyProvider : IOAuth2AccessPolicyProvider;\n\n    protected engine : PolicyEngine;\n\n    protected logger? : Logger;\n\n    constructor(ctx: OAuth2AccessPolicyEvaluatorContext) {\n        this.policyProvider = ctx.policyProvider;\n        this.engine = new PolicyEngine(ctx.identityPermissionProvider);\n        this.logger = ctx.logger;\n    }\n\n    async evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean> {\n        let tree : BasePolicy | null;\n\n        try {\n            tree = await this.policyProvider.findDescendantsTreeById(policyId);\n        } catch (e) {\n            this.logger?.warn(`Loading the access policy ${policyId} failed.`, { error: e });\n            return false;\n        }\n\n        if (!tree) {\n            return false;\n        }\n\n        const ctx = definePolicyEvaluationContext({ data: new PolicyData({ [BuiltInPolicyType.IDENTITY]: subject }) });\n\n        const result = await this.engine.evaluate(tree, ctx);\n\n        return result.success;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaI,8BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAyC;EACjD,KAAKH,iBAAiBG,IAAIH;EAC1B,KAAKC,SAAS,IAAIH,eAAaK,IAAIC,0BAA0B;EAC7D,KAAKF,SAASC,IAAID;CACtB;CAEA,MAAMG,SAASC,UAAkBC,SAA+C;EAC5E,IAAIC;EAEJ,IAAI;GACAA,OAAO,MAAM,KAAKR,eAAeS,wBAAwBH,QAAAA;EAC7D,SAASI,GAAG;GACR,KAAKR,QAAQS,KAAK,6BAA6BL,SAAS,WAAW,EAAEM,OAAOF,EAAE,CAAA;GAC9E,OAAO;EACX;EAEA,IAAI,CAACF,MACD,OAAO;EAGX,MAAML,MAAMN,8BAA8B,EAAEgB,MAAM,IAAIjB,WAAW,GAAGD,kBAAkBmB,WAAWP,QAAQ,CAAA,EAAG,CAAA;EAI5G,QAAOQ,MAFc,KAAKd,OAAOI,SAASG,MAAML,GAAAA,EAAAA,CAElCa;CAClB;AACJ"}

package/dist/core/oauth2/access-policy/types.d.ts

@@ -0,0 +1,19 @@
+import type { BasePolicy, IdentityPolicyData } from '@authup/access';
+import type { Logger } from '@authup/server-kit';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+export interface IOAuth2AccessPolicyEvaluator {
+    /**
+     * true = access permitted. A present-but-unresolvable policy id,
+     * a load failure, or an evaluation failure all yield false (fail closed).
+     */
+    evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean>;
+}
+export interface IOAuth2AccessPolicyProvider {
+    findDescendantsTreeById(id: string): Promise<BasePolicy | null>;
+}
+export type OAuth2AccessPolicyEvaluatorContext = {
+    policyProvider: IOAuth2AccessPolicyProvider;
+    identityPermissionProvider: IIdentityPermissionProvider;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/access-policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,MAAM,WAAW,4BAA4B;IACzC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,2BAA2B;IACxC,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kCAAkC,GAAG;IAC7C,cAAc,EAAE,2BAA2B,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/oauth2/access-policy/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/authorization/code/issuer/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;CA+BvC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,OAAO,KAAK,EAAE,kCAAkC,EAAgC,MAAM,wBAAwB,CAAC;AAC/G,OAAO,KAAK,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvG,qBAAa,6BAA8B,YAAW,8BAA8B;IAChF,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,OAAO,EAAE,oCAAoC,CAAC;gBAGpD,UAAU,EAAE,kCAAkC,EAC9C,OAAO,GAAE,oCAAyC;IAMhD,KAAK,CACP,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,oCAAyC,GAClD,OAAO,CAAC,uBAAuB,CAAC;CAiCvC"}

package/dist/core/oauth2/authorization/code/issuer/module.mjs

@@ -20,7 +20,9 @@ var OAuth2AuthorizationCodeIssuer = class {
 			nonce: input.nonce,
 			code_challenge: input.code_challenge,
 			code_challenge_method: input.code_challenge_method,
+			acr_values: input.acr_values ?? null,
 			auth_time: options.authTime ?? Math.floor(Date.now() / 1e3),
+			auth_method: options.authMethod ?? null,
 			realm_id: realm.id,
 			realm_name: realm.name,
 			sub: identity.data.id,

package/dist/core/oauth2/authorization/code/issuer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","realm","data","identityInvalid","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","auth_time","authTime","Math","floor","Date","now","realm_id","id","realm_name","name","sub","sub_kind","type","sessionId","session_id","save","maxAge"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        // The code carries the identity's realm id + name. A dangling realm\n        // relation (realm row deleted without cascade) must fail closed as a\n        // clean OAuth2 error — never a TypeError → 500.\n        const { realm } = identity.data;\n        if (!realm) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n\n            auth_time: options.authTime ?? Math.floor(Date.now() / 1000),\n\n            realm_id: realm.id,\n            realm_name: realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.sessionId) {\n            entity.session_id = options.sessionId;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EAIjC,MAAM,EAAEI,UAAUD,SAASE;EAC3B,IAAI,CAACD,OACD,MAAMP,mBAAmBS,gBAAe;EAG5C,MAAMC,SAAuC;GACzCC,cAAcN,MAAMM;GACpBC,WAAWP,MAAMO;GACjBC,OAAOR,MAAMQ;GACbC,OAAOT,MAAMS;GACbC,gBAAgBV,MAAMU;GACtBC,uBAAuBX,MAAMW;GAE7BC,WAAWd,QAAQe,YAAYC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;GAEvDC,UAAUhB,MAAMiB;GAChBC,YAAYlB,MAAMmB;GAClBC,KAAKrB,SAASE,KAAKgB;GACnBI,UAAUtB,SAASuB;EACvB;EAEA,IAAI1B,QAAQ2B,WACRpB,OAAOqB,aAAa5B,QAAQ2B;EAGhC,OAAO,KAAK5B,WAAW8B,KAAKtB,QAAQ,EAAEuB,QAAQ9B,QAAQ8B,UAAU,KAAK9B,QAAQ8B,OAAO,CAAA;CACxF;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2RequestError","OAuth2AuthorizationCodeIssuer","repository","options","issue","input","identity","realm","data","identityInvalid","entity","redirect_uri","client_id","scope","nonce","code_challenge","code_challenge_method","acr_values","auth_time","authTime","Math","floor","Date","now","auth_method","authMethod","realm_id","id","realm_name","name","sub","sub_kind","type","sessionId","session_id","save","maxAge"],"sources":["../../../../../../src/core/oauth2/authorization/code/issuer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { OAuth2RequestError } from '@authup/specs';\nimport type { IOAuth2AuthorizationCodeRepository, OAuth2AuthorizationCodeInput } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeIssuerOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeIssuer implements IOAuth2AuthorizationCodeIssuer {\n    protected repository: IOAuth2AuthorizationCodeRepository;\n\n    protected options: OAuth2AuthorizationCodeIssuerOptions;\n\n    constructor(\n        repository: IOAuth2AuthorizationCodeRepository,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) {\n        this.repository = repository;\n        this.options = options;\n    }\n\n    async issue(\n        input: OAuth2AuthorizationCodeRequest,\n        identity: Identity,\n        options: OAuth2AuthorizationCodeIssuerOptions = {},\n    ) : Promise<OAuth2AuthorizationCode> {\n        // The code carries the identity's realm id + name. A dangling realm\n        // relation (realm row deleted without cascade) must fail closed as a\n        // clean OAuth2 error — never a TypeError → 500.\n        const { realm } = identity.data;\n        if (!realm) {\n            throw OAuth2RequestError.identityInvalid();\n        }\n\n        const entity: OAuth2AuthorizationCodeInput = {\n            redirect_uri: input.redirect_uri,\n            client_id: input.client_id,\n            scope: input.scope,\n            nonce: input.nonce,\n            code_challenge: input.code_challenge,\n            code_challenge_method: input.code_challenge_method,\n            acr_values: input.acr_values ?? null,\n\n            auth_time: options.authTime ?? Math.floor(Date.now() / 1000),\n            auth_method: options.authMethod ?? null,\n\n            realm_id: realm.id,\n            realm_name: realm.name,\n            sub: identity.data.id,\n            sub_kind: identity.type,\n        };\n\n        if (options.sessionId) {\n            entity.session_id = options.sessionId;\n        }\n\n        return this.repository.save(entity, { maxAge: options.maxAge ?? this.options.maxAge });\n    }\n}\n"],"mappings":";;;;;AAYA,IAAaC,gCAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,YACAC,UAAgD,CAAC,GACnD;EACE,KAAKD,aAAaA;EAClB,KAAKC,UAAUA;CACnB;CAEA,MAAMC,MACFC,OACAC,UACAH,UAAgD,CAAC,GAChB;EAIjC,MAAM,EAAEI,UAAUD,SAASE;EAC3B,IAAI,CAACD,OACD,MAAMP,mBAAmBS,gBAAe;EAG5C,MAAMC,SAAuC;GACzCC,cAAcN,MAAMM;GACpBC,WAAWP,MAAMO;GACjBC,OAAOR,MAAMQ;GACbC,OAAOT,MAAMS;GACbC,gBAAgBV,MAAMU;GACtBC,uBAAuBX,MAAMW;GAC7BC,YAAYZ,MAAMY,cAAc;GAEhCC,WAAWf,QAAQgB,YAAYC,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GAAA;GACvDC,aAAarB,QAAQsB,cAAc;GAEnCC,UAAUnB,MAAMoB;GAChBC,YAAYrB,MAAMsB;GAClBC,KAAKxB,SAASE,KAAKmB;GACnBI,UAAUzB,SAAS0B;EACvB;EAEA,IAAI7B,QAAQ8B,WACRvB,OAAOwB,aAAa/B,QAAQ8B;EAGhC,OAAO,KAAK/B,WAAWiC,KAAKzB,QAAQ,EAAE0B,QAAQjC,QAAQiC,UAAU,KAAKjC,QAAQiC,OAAO,CAAA;CACxF;AACJ"}

package/dist/core/oauth2/authorization/code/issuer/types.d.ts

@@ -1,4 +1,4 @@
-import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest } from '@authup/core-kit';
+import type { Identity, OAuth2AuthorizationCode, OAuth2AuthorizationCodeRequest, SessionAuthMethod } from '@authup/core-kit';
 export type OAuth2AuthorizationCodeIssuerOptions = {
     /**
      * Max duration in seconds
@@ -15,6 +15,11 @@ export type OAuth2AuthorizationCodeIssuerOptions = {
      * Defaults to the issuance instant (session-less flows authenticate now).
      */
     authTime?: number;
+    /**
+     * How the subject authenticated (SessionAuthMethod) — persisted on the
+     * code so a session created at the /token exchange inherits it.
+     */
+    authMethod?: `${SessionAuthMethod}` | null;
 };
 export interface IOAuth2AuthorizationCodeIssuer {
     issue(input: OAuth2AuthorizationCodeRequest, identity: Identity, options?: OAuth2AuthorizationCodeIssuerOptions): Promise<OAuth2AuthorizationCode>;

package/dist/core/oauth2/authorization/code/issuer/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code/issuer/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,QAAQ,EACR,uBAAuB,EACvB,8BAA8B,EAC9B,iBAAiB,EACpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,oCAAoC,GAAG;IAC/C;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF,MAAM,WAAW,8BAA8B;IAC3C,KAAK,CACD,KAAK,EAAE,8BAA8B,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC"}

package/dist/core/oauth2/authorization/code/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","realmId","realm_id","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        // Realm binding (defense in depth): the code's realm (the authorizing\n        // identity's realm) must match the authenticated client's realm. Blocks\n        // redeeming a realm-A identity's code against a realm-B client — covers\n        // codes minted outside OAuth2Authorization.authorize() (identity-provider\n        // callback) and any in-flight codes issued before the authorize-side gate.\n        if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // is_confidential flag changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAStC,IAAIH,QAAQM,WAAWL,OAAOM,YAAYN,OAAOM,aAAaP,QAAQM,SAClE,MAAMZ,iBAAiBS,QAAO;EAGlC,IAAIF,OAAOO;OACH,CAACR,QAAQS,eAAeR,OAAOO,iBAAiBR,QAAQS,aACxD,MAAMf,iBAAiBgB,oBAAmB;EAAA;EAOlD,IAAIV,QAAQW,kBAAkB,CAACV,OAAOW,gBAClC,MAAMlB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOW,gBAAgB;GACvB,IAAI,CAACZ,QAAQa,cACT,MAAMnB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOa,0BAA0BrB,uCAAuCsB;QAEpEC,MAD2BrB,yBAAyBK,QAAQa,YAAY,MACnDZ,OAAOW,gBAC5B,MAAMlB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQa,iBAAiBZ,OAAOW,gBACvC,MAAMlB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2AuthorizationCodeChallengeMethod","OAuth2GrantError","buildOAuth2CodeChallenge","OAuth2AuthorizationCodeVerifier","repository","verify","code","options","entity","popOneById","invalid","client_id","clientId","realmId","realm_id","redirect_uri","redirectUri","redirectUriMismatch","clientIsPublic","code_challenge","codeVerifier","code_challenge_method","SHA_256","codeVerifierHash"],"sources":["../../../../../../src/core/oauth2/authorization/code/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCode } from '@authup/core-kit';\nimport { OAuth2AuthorizationCodeChallengeMethod, OAuth2GrantError } from '@authup/specs';\nimport { buildOAuth2CodeChallenge } from '../../helpers.ts';\n\nimport type { IOAuth2AuthorizationCodeRepository } from '../repository/index.ts';\nimport type { IOAuth2AuthorizationCodeVerifier, IOAuth2AuthorizationCodeVerifyOptions } from './types.ts';\n\nexport class OAuth2AuthorizationCodeVerifier implements IOAuth2AuthorizationCodeVerifier {\n    protected repository : IOAuth2AuthorizationCodeRepository;\n\n    constructor(repository: IOAuth2AuthorizationCodeRepository) {\n        this.repository = repository;\n    }\n\n    async verify(code: string, options: IOAuth2AuthorizationCodeVerifyOptions) : Promise<OAuth2AuthorizationCode> {\n        const entity = await this.repository.popOneById(code);\n        if (!entity) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        // RFC 6749 §4.1.3: if the client was issued a client_id, verify the\n        // authorization code was issued to the authenticated client. Always\n        // require a clientId to be supplied so a malformed token request can't\n        // bypass the binding by omitting it.\n        if (entity.client_id) {\n            if (!options.clientId || options.clientId !== entity.client_id) {\n                throw OAuth2GrantError.invalid();\n            }\n        }\n\n        // Realm binding (defense in depth): the code's realm (the authorizing\n        // identity's realm) must match the authenticated client's realm. Blocks\n        // redeeming a realm-A identity's code against a realm-B client — covers\n        // codes minted outside OAuth2Authorization.authorize() (identity-provider\n        // callback) and any in-flight codes issued before the authorize-side gate.\n        if (options.realmId && entity.realm_id && entity.realm_id !== options.realmId) {\n            throw OAuth2GrantError.invalid();\n        }\n\n        if (entity.redirect_uri) {\n            if (!options.redirectUri || entity.redirect_uri !== options.redirectUri) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        // Public clients MUST use PKCE (RFC 7636). Defense in depth in case\n        // the authorize-side check was bypassed or the client's\n        // auth_method changed between authorize and token.\n        if (options.clientIsPublic && !entity.code_challenge) {\n            throw OAuth2GrantError.invalid('PKCE is required for public clients.');\n        }\n\n        if (entity.code_challenge) {\n            if (!options.codeVerifier) {\n                throw OAuth2GrantError.invalid('Code verifier invalid.');\n            }\n\n            // RFC 7636 §4.3: code_challenge_method defaults to \"plain\" when\n            // absent. Only treat the challenge as S256 when the client\n            // explicitly sent code_challenge_method=S256.\n            if (entity.code_challenge_method === OAuth2AuthorizationCodeChallengeMethod.SHA_256) {\n                const codeVerifierHash = await buildOAuth2CodeChallenge(options.codeVerifier);\n                if (codeVerifierHash !== entity.code_challenge) {\n                    throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n                }\n            } else if (options.codeVerifier !== entity.code_challenge) {\n                throw OAuth2GrantError.invalid('PKCE code_verifier mismatch.');\n            }\n        }\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;AAcA,IAAaG,kCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAgD;EACxD,KAAKA,aAAaA;CACtB;CAEA,MAAMC,OAAOC,MAAcC,SAAmF;EAC1G,MAAMC,SAAS,MAAM,KAAKJ,WAAWK,WAAWH,IAAAA;EAChD,IAAI,CAACE,QACD,MAAMP,iBAAiBS,QAAO;EAOlC,IAAIF,OAAOG;OACH,CAACJ,QAAQK,YAAYL,QAAQK,aAAaJ,OAAOG,WACjD,MAAMV,iBAAiBS,QAAO;EAAA;EAStC,IAAIH,QAAQM,WAAWL,OAAOM,YAAYN,OAAOM,aAAaP,QAAQM,SAClE,MAAMZ,iBAAiBS,QAAO;EAGlC,IAAIF,OAAOO;OACH,CAACR,QAAQS,eAAeR,OAAOO,iBAAiBR,QAAQS,aACxD,MAAMf,iBAAiBgB,oBAAmB;EAAA;EAOlD,IAAIV,QAAQW,kBAAkB,CAACV,OAAOW,gBAClC,MAAMlB,iBAAiBS,QAAQ,sCAAA;EAGnC,IAAIF,OAAOW,gBAAgB;GACvB,IAAI,CAACZ,QAAQa,cACT,MAAMnB,iBAAiBS,QAAQ,wBAAA;GAMnC,IAAIF,OAAOa,0BAA0BrB,uCAAuCsB;QAEpEC,MAD2BrB,yBAAyBK,QAAQa,YAAY,MACnDZ,OAAOW,gBAC5B,MAAMlB,iBAAiBS,QAAQ,8BAAA;GAAA,OAEhC,IAAIH,QAAQa,iBAAiBZ,OAAOW,gBACvC,MAAMlB,iBAAiBS,QAAQ,8BAAA;EAEvC;EAEA,OAAOF;CACX;AACJ"}