@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/http/middleware/built-in/prometheus.mjs

@@ -3,12 +3,81 @@ import "node:url";
 import.meta.url;
 import { prometheus } from "@routup/prometheus";
 //#region src/adapters/http/middleware/built-in/prometheus.ts
+const PATH_LABEL_UNMATCHED = "/{unmatched}";
+function toPathSegments(path) {
+	return path.split("/").filter((segment) => segment.length > 0);
+}
+function isParameterSegment(segment) {
+	return segment.startsWith(":") || segment === "*";
+}
+function matchSegments(templateSegments, segments, prefix) {
+	if (prefix ? segments.length < templateSegments.length : segments.length !== templateSegments.length) return false;
+	for (const [i, templateSegment] of templateSegments.entries()) {
+		if (isParameterSegment(templateSegment)) continue;
+		if (templateSegment !== segments[i]) return false;
+	}
+	return true;
+}
+function buildRouteTemplates(router) {
+	const exact = [];
+	const prefix = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const route of router.routes) {
+		if (typeof route.path !== "string") continue;
+		const segments = toPathSegments(route.path);
+		const label = `/${segments.join("/")}`;
+		const key = `${route.method || ""} ${label}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		if (route.method) exact.push({
+			method: route.method,
+			segments,
+			label
+		});
+		else if (segments.length > 0) prefix.push({
+			segments,
+			label
+		});
+	}
+	prefix.sort((a, b) => b.segments.length - a.segments.length);
+	return {
+		exact,
+		prefix
+	};
+}
+/**
+* The `path` label must stay bounded: labeling by the raw request path lets
+* every probed id (`/users/<random-uuid>`, even on 401/404) mint a new
+* prom-client time-series — unbounded registry growth. Requests are instead
+* labeled by the registered route template (`/users/:id`), read from the
+* router's own route table (child apps are flattened into the root with full
+* patterns, and all routes are registered before `listen`, so a snapshot at
+* first request is complete). Method-agnostic mounts (`/docs`, `/public`)
+* label as `<mount>/**`; anything else collapses into one unmatched bucket.
+*/ function createRouteTemplateNormalizePath(router) {
+	let templates;
+	return (path, event) => {
+		if (!templates) templates = buildRouteTemplates(router);
+		const segments = toPathSegments(path);
+		const method = `${event.method}`.toUpperCase();
+		for (const template of templates.exact) {
+			if (template.method !== method && !(method === "HEAD" && template.method === "GET")) continue;
+			if (matchSegments(template.segments, segments, false)) return template.label;
+		}
+		for (const template of templates.exact) if (matchSegments(template.segments, segments, false)) return template.label;
+		for (const template of templates.prefix) if (matchSegments(template.segments, segments, true)) return `${template.label}/**`;
+		return PATH_LABEL_UNMATCHED;
+	};
+}
 function registerPrometheusMiddleware(router, input) {
-	let options = { skip(event) {
-		let { path } = event;
-		if (!path.startsWith("/")) path = `/${path}`;
-		return path.startsWith("/metrics") || path === "/";
-	} };
+	let options = {
+		normalizePath: createRouteTemplateNormalizePath(router),
+		skip(event) {
+			let { path } = event;
+			if (!path.startsWith("/")) path = `/${path}`;
+			return path.startsWith("/metrics") || path === "/";
+		}
+	};
 	if (input) options = {
 		...options,
 		...input
@@ -16,6 +85,6 @@ function registerPrometheusMiddleware(router, input) {
 	router.use(prometheus(options));
 }
 //#endregion
-export { registerPrometheusMiddleware };
+export { createRouteTemplateNormalizePath, registerPrometheusMiddleware };
 
 //# sourceMappingURL=prometheus.mjs.map

package/dist/adapters/http/middleware/built-in/prometheus.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"prometheus.mjs","names":["prometheus","registerPrometheusMiddleware","router","input","options","skip","event","path","startsWith","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/prometheus';\nimport { prometheus } from '@routup/prometheus';\nimport type { App } from 'routup';\n\nexport function registerPrometheusMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        skip(event) {\n            let { path } = event;\n            if (!path.startsWith('/')) {\n                path = `/${path}`;\n            }\n\n            return path.startsWith('/metrics') ||\n                path === '/';\n        },\n    };\n\n    if (input) {\n        options = {\n            ...options,\n            ...input,\n        };\n    }\n\n    router.use(prometheus(options));\n}\n"],"mappings":";;;;;AAWA,SAAgBC,6BAA6BC,QAAaC,OAAoB;CAC1E,IAAIC,UAAyB,EACzBC,KAAKC,OAAK;EACN,IAAI,EAAEC,SAASD;EACf,IAAI,CAACC,KAAKC,WAAW,GAAA,GACjBD,OAAO,IAAIA;EAGf,OAAOA,KAAKC,WAAW,UAAA,KACnBD,SAAS;CACjB,EACJ;CAEA,IAAIJ,OACAC,UAAU;EACN,GAAGA;EACH,GAAGD;CACP;CAGJD,OAAOO,IAAIT,WAAWI,OAAAA,CAAAA;AAC1B"}
+{"version":3,"file":"prometheus.mjs","names":["prometheus","PATH_LABEL_UNMATCHED","toPathSegments","path","split","filter","segment","length","isParameterSegment","startsWith","matchSegments","templateSegments","segments","prefix","i","templateSegment","entries","buildRouteTemplates","router","exact","seen","Set","route","routes","label","join","key","method","has","add","push","sort","a","b","createRouteTemplateNormalizePath","templates","event","toUpperCase","template","registerPrometheusMiddleware","input","options","normalizePath","skip","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/prometheus.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/prometheus';\nimport { prometheus } from '@routup/prometheus';\nimport type { App, IAppEvent } from 'routup';\n\nconst PATH_LABEL_UNMATCHED = '/{unmatched}';\n\ntype RouteTemplate = {\n    method?: string,\n    segments: string[],\n    label: string,\n};\n\ntype RouteTemplates = {\n    exact: RouteTemplate[],\n    prefix: RouteTemplate[],\n};\n\nfunction toPathSegments(path: string): string[] {\n    return path.split('/').filter((segment) => segment.length > 0);\n}\n\nfunction isParameterSegment(segment: string): boolean {\n    return segment.startsWith(':') || segment === '*';\n}\n\nfunction matchSegments(\n    templateSegments: string[],\n    segments: string[],\n    prefix: boolean,\n): boolean {\n    if (\n        prefix ?\n            segments.length < templateSegments.length :\n            segments.length !== templateSegments.length\n    ) {\n        return false;\n    }\n\n    for (const [i, templateSegment] of templateSegments.entries()) {\n        if (isParameterSegment(templateSegment)) {\n            continue;\n        }\n\n        if (templateSegment !== segments[i]) {\n            return false;\n        }\n    }\n\n    return true;\n}\n\nfunction buildRouteTemplates(router: App): RouteTemplates {\n    const exact: RouteTemplate[] = [];\n    const prefix: RouteTemplate[] = [];\n    const seen = new Set<string>();\n\n    for (const route of router.routes) {\n        if (typeof route.path !== 'string') {\n            continue;\n        }\n\n        const segments = toPathSegments(route.path);\n        const label = `/${segments.join('/')}`;\n        const key = `${route.method || ''} ${label}`;\n        if (seen.has(key)) {\n            continue;\n        }\n        seen.add(key);\n\n        if (route.method) {\n            exact.push({\n                method: route.method, \n                segments, \n                label, \n            });\n        } else if (segments.length > 0) {\n            prefix.push({ segments, label });\n        }\n    }\n\n    prefix.sort((a, b) => b.segments.length - a.segments.length);\n\n    return { exact, prefix };\n}\n\n/**\n * The `path` label must stay bounded: labeling by the raw request path lets\n * every probed id (`/users/<random-uuid>`, even on 401/404) mint a new\n * prom-client time-series — unbounded registry growth. Requests are instead\n * labeled by the registered route template (`/users/:id`), read from the\n * router's own route table (child apps are flattened into the root with full\n * patterns, and all routes are registered before `listen`, so a snapshot at\n * first request is complete). Method-agnostic mounts (`/docs`, `/public`)\n * label as `<mount>/**`; anything else collapses into one unmatched bucket.\n */\nexport function createRouteTemplateNormalizePath(\n    router: App,\n): (path: string, event: IAppEvent) => string {\n    let templates : RouteTemplates | undefined;\n\n    return (path, event) => {\n        if (!templates) {\n            templates = buildRouteTemplates(router);\n        }\n\n        const segments = toPathSegments(path);\n        const method = `${event.method}`.toUpperCase();\n\n        for (const template of templates.exact) {\n            if (\n                template.method !== method &&\n                !(method === 'HEAD' && template.method === 'GET')\n            ) {\n                continue;\n            }\n\n            if (matchSegments(template.segments, segments, false)) {\n                return template.label;\n            }\n        }\n\n        for (const template of templates.exact) {\n            if (matchSegments(template.segments, segments, false)) {\n                return template.label;\n            }\n        }\n\n        for (const template of templates.prefix) {\n            if (matchSegments(template.segments, segments, true)) {\n                return `${template.label}/**`;\n            }\n        }\n\n        return PATH_LABEL_UNMATCHED;\n    };\n}\n\nexport function registerPrometheusMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        normalizePath: createRouteTemplateNormalizePath(router),\n        skip(event) {\n            let { path } = event;\n            if (!path.startsWith('/')) {\n                path = `/${path}`;\n            }\n\n            return path.startsWith('/metrics') ||\n                path === '/';\n        },\n    };\n\n    if (input) {\n        options = {\n            ...options,\n            ...input,\n        };\n    }\n\n    router.use(prometheus(options));\n}\n"],"mappings":";;;;;AAWA,MAAMC,uBAAuB;AAa7B,SAASC,eAAeC,MAAY;CAChC,OAAOA,KAAKC,MAAM,GAAA,CAAA,CAAKC,QAAQC,YAAYA,QAAQC,SAAS,CAAA;AAChE;AAEA,SAASC,mBAAmBF,SAAe;CACvC,OAAOA,QAAQG,WAAW,GAAA,KAAQH,YAAY;AAClD;AAEA,SAASI,cACLC,kBACAC,UACAC,QAAe;CAEf,IACIA,SACID,SAASL,SAASI,iBAAiBJ,SACnCK,SAASL,WAAWI,iBAAiBJ,QAEzC,OAAO;CAGX,KAAK,MAAM,CAACO,GAAGC,oBAAoBJ,iBAAiBK,QAAO,GAAI;EAC3D,IAAIR,mBAAmBO,eAAAA,GACnB;EAGJ,IAAIA,oBAAoBH,SAASE,IAC7B,OAAO;CAEf;CAEA,OAAO;AACX;AAEA,SAASG,oBAAoBC,QAAW;CACpC,MAAMC,QAAyB,CAAA;CAC/B,MAAMN,SAA0B,CAAA;CAChC,MAAMO,uBAAO,IAAIC,IAAAA;CAEjB,KAAK,MAAMC,SAASJ,OAAOK,QAAQ;EAC/B,IAAI,OAAOD,MAAMnB,SAAS,UACtB;EAGJ,MAAMS,WAAWV,eAAeoB,MAAMnB,IAAI;EAC1C,MAAMqB,QAAQ,IAAIZ,SAASa,KAAK,GAAA;EAChC,MAAMC,MAAM,GAAGJ,MAAMK,UAAU,GAAG,GAAGH;EACrC,IAAIJ,KAAKQ,IAAIF,GAAAA,GACT;EAEJN,KAAKS,IAAIH,GAAAA;EAET,IAAIJ,MAAMK,QACNR,MAAMW,KAAK;GACPH,QAAQL,MAAMK;GACdf;GACAY;EACJ,CAAA;OACG,IAAIZ,SAASL,SAAS,GACzBM,OAAOiB,KAAK;GAAElB;GAAUY;EAAM,CAAA;CAEtC;CAEAX,OAAOkB,MAAMC,GAAGC,MAAMA,EAAErB,SAASL,SAASyB,EAAEpB,SAASL,MAAM;CAE3D,OAAO;EAAEY;EAAON;CAAO;AAC3B;;;;;;;;;;GAYA,SAAgBqB,iCACZhB,QAAW;CAEX,IAAIiB;CAEJ,QAAQhC,MAAMiC,UAAAA;EACV,IAAI,CAACD,WACDA,YAAYlB,oBAAoBC,MAAAA;EAGpC,MAAMN,WAAWV,eAAeC,IAAAA;EAChC,MAAMwB,SAAS,GAAGS,MAAMT,SAASU,YAAW;EAE5C,KAAK,MAAMC,YAAYH,UAAUhB,OAAO;GACpC,IACImB,SAASX,WAAWA,UACpB,EAAEA,WAAW,UAAUW,SAASX,WAAW,QAE3C;GAGJ,IAAIjB,cAAc4B,SAAS1B,UAAUA,UAAU,KAAA,GAC3C,OAAO0B,SAASd;EAExB;EAEA,KAAK,MAAMc,YAAYH,UAAUhB,OAC7B,IAAIT,cAAc4B,SAAS1B,UAAUA,UAAU,KAAA,GAC3C,OAAO0B,SAASd;EAIxB,KAAK,MAAMc,YAAYH,UAAUtB,QAC7B,IAAIH,cAAc4B,SAAS1B,UAAUA,UAAU,IAAA,GAC3C,OAAO,GAAG0B,SAASd,MAAM;EAIjC,OAAOvB;CACX;AACJ;AAEA,SAAgBsC,6BAA6BrB,QAAasB,OAAoB;CAC1E,IAAIC,UAAyB;EACzBC,eAAeR,iCAAiChB,MAAAA;EAChDyB,KAAKP,OAAK;GACN,IAAI,EAAEjC,SAASiC;GACf,IAAI,CAACjC,KAAKM,WAAW,GAAA,GACjBN,OAAO,IAAIA;GAGf,OAAOA,KAAKM,WAAW,UAAA,KACnBN,SAAS;EACjB;CACJ;CAEA,IAAIqC,OACAC,UAAU;EACN,GAAGA;EACH,GAAGD;CACP;CAGJtB,OAAO0B,IAAI5C,WAAWyC,OAAAA,CAAAA;AAC1B"}

package/dist/adapters/http/middleware/built-in/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAyB5E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,YAAY,QAwB5E"}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs

@@ -12,7 +12,6 @@ function registerRateLimitMiddleware(router, input) {
 			const identity = useRequestIdentity(event);
 			if (!identity) return 1200;
 			switch (identity.type) {
-				case "robot":
 				case "client": return 60 * 5e3;
 				default: return 6e3;
 			}

package/dist/adapters/http/middleware/built-in/rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.mjs","names":["rateLimit","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","max","event","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'robot':\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EACzBC,IAAIC,OAAK;GACL,MAAMC,WAAWP,mBAAmBM,KAAAA;GACpC,IAAI,CAACC,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK;IACL,KAAK,UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAL,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOQ,IAAIZ,UAAUM,OAAAA,CAAAA;AACzB"}
+{"version":3,"file":"rate-limit.mjs","names":["rateLimit","merge","useRequestIdentity","registerRateLimitMiddleware","router","input","options","max","event","identity","type","windowMs","use"],"sources":["../../../../../src/adapters/http/middleware/built-in/rate-limit.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OptionsInput } from '@routup/rate-limit';\nimport { rateLimit } from '@routup/rate-limit';\nimport type { App } from 'routup';\nimport { merge } from 'smob';\nimport { useRequestIdentity } from '../../request/index.ts';\n\nexport function registerRateLimitMiddleware(router: App, input?: OptionsInput) {\n    let options : OptionsInput = {\n        max(event) {\n            const identity = useRequestIdentity(event);\n            if (!identity) {\n                return 60 * 20; // 20 req. p. sec\n            }\n\n            switch (identity.type) {\n                case 'client': {\n                    return 60 * 5_000; // 1000 req p. sec\n                }\n                case 'user':\n                default: {\n                    return 60 * 100; // 100 req p. sec\n                }\n            }\n        },\n        windowMs: 60 * 1000, // 60 sec\n    };\n\n    options = merge(input || {}, options);\n\n    router.use(rateLimit(options));\n}\n"],"mappings":";;;;;;;;AAaA,SAAgBG,4BAA4BC,QAAaC,OAAoB;CACzE,IAAIC,UAAyB;EACzBC,IAAIC,OAAK;GACL,MAAMC,WAAWP,mBAAmBM,KAAAA;GACpC,IAAI,CAACC,UACD,OAAO;GAGX,QAAQA,SAASC,MAAjB;IACI,KAAK,UACD,OAAO,KAAK;IAGhB,SACI,OAAO;GAEf;EACJ;EACAC,UAAU,KAAK;CACnB;CAEAL,UAAUL,MAAMI,SAAS,CAAC,GAAGC,OAAAA;CAE7BF,OAAOQ,IAAIZ,UAAUM,OAAAA,CAAAA;AACzB"}

package/dist/adapters/http/middleware/index.mjs

@@ -12,9 +12,9 @@ import { registerBasicMiddleware } from "./built-in/basic.mjs";
 import { registerCorsMiddleware } from "./built-in/cors.mjs";
 import { registerErrorMiddleware } from "./built-in/error.mjs";
 import { createLoggerMiddleware, redactSensitiveURLParams } from "./built-in/logger.mjs";
-import { registerPrometheusMiddleware } from "./built-in/prometheus.mjs";
+import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./built-in/ui-http-client.mjs";
 import "./built-in/index.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };

package/dist/adapters/http/request/client-certificate.d.ts

@@ -0,0 +1,6 @@
+import '../../../core/client-certificate/reflect.ts';
+import type { IAppEvent } from 'routup';
+import type { ClientCertificateEvidence } from '../../../core/index.ts';
+import type { CertificateSource } from './types.ts';
+export declare function extractClientCertificateEvidence(event: IAppEvent, source: CertificateSource): Promise<ClientCertificateEvidence | undefined>;
+//# sourceMappingURL=client-certificate.d.ts.map

package/dist/adapters/http/request/client-certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-certificate.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/client-certificate.ts"],"names":[],"mappings":"AAOA,OAAO,6CAA6C,CAAC;AAIrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAKxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD,wBAAsB,gCAAgC,CAClD,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAqBhD"}

package/dist/adapters/http/request/client-certificate.mjs

@@ -0,0 +1,89 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "../../../core/client-certificate/reflect.mjs";
+import { buildClientCertificateThumbprint, parseClientCertificateChain } from "../../../core/client-certificate/module.mjs";
+import "../../../core/index.mjs";
+import { base64ToArrayBuffer } from "@authup/kit";
+import { BadRequestError } from "@authup/errors";
+import { X509Certificate } from "@peculiar/x509";
+//#region src/adapters/http/request/client-certificate.ts
+const MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;
+const MAX_CERTIFICATE_CHAIN_LENGTH = 10;
+const STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;
+async function extractClientCertificateEvidence(event, source) {
+	if (source === "disabled") return;
+	let result;
+	if (source === "standard") result = extractStandardEvidence(event);
+	else if (source === "forwarded") result = extractForwardedEvidence(event);
+	else throw new BadRequestError("The client certificate source is not configured correctly.");
+	if (!result) return;
+	return {
+		...result,
+		thumbprint: await buildClientCertificateThumbprint(result.certificate)
+	};
+}
+function extractStandardEvidence(event) {
+	const leafHeader = event.headers.get("client-cert");
+	const chainHeader = event.headers.get("client-cert-chain");
+	if (!leafHeader) {
+		if (chainHeader) throw certificateHeaderError();
+		return;
+	}
+	assertHeaderLength(leafHeader);
+	return {
+		certificate: parseStructuredCertificate(leafHeader),
+		chain: chainHeader ? parseStructuredCertificateList(chainHeader) : []
+	};
+}
+function extractForwardedEvidence(event) {
+	const value = event.headers.get("x-forwarded-tls-client-cert");
+	if (!value) return;
+	assertHeaderLength(value);
+	let pem;
+	try {
+		pem = value.includes("-----BEGIN CERTIFICATE-----") ? value : decodeURIComponent(value.replace(/\+/g, "%20"));
+	} catch {
+		throw certificateHeaderError();
+	}
+	let certificates;
+	try {
+		certificates = parseClientCertificateChain(pem);
+	} catch {
+		throw certificateHeaderError();
+	}
+	if (certificates.length !== 1 || !certificates[0]) throw certificateHeaderError();
+	return {
+		certificate: certificates[0],
+		chain: []
+	};
+}
+function parseStructuredCertificateList(value) {
+	assertHeaderLength(value);
+	const items = value.split(",").map((item) => item.trim());
+	if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) throw certificateHeaderError();
+	return items.map(parseStructuredCertificate);
+}
+function parseStructuredCertificate(value) {
+	const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());
+	if (!match?.[1]) throw certificateHeaderError();
+	try {
+		const raw = base64ToArrayBuffer(match[1]);
+		if (raw.byteLength === 0) throw certificateHeaderError();
+		const certificate = new X509Certificate(raw);
+		if (certificate.toString("base64").replace(/=+$/, "") !== match[1].replace(/=+$/, "")) throw certificateHeaderError();
+		return certificate;
+	} catch {
+		throw certificateHeaderError();
+	}
+}
+function assertHeaderLength(value) {
+	if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) throw certificateHeaderError();
+}
+function certificateHeaderError() {
+	return new BadRequestError("The forwarded client certificate header is malformed.");
+}
+//#endregion
+export { extractClientCertificateEvidence };
+
+//# sourceMappingURL=client-certificate.mjs.map

package/dist/adapters/http/request/client-certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-certificate.mjs","names":["X509Certificate","BadRequestError","base64ToArrayBuffer","buildClientCertificateThumbprint","parseClientCertificateChain","MAX_CERTIFICATE_HEADER_LENGTH","MAX_CERTIFICATE_CHAIN_LENGTH","STRUCTURED_BINARY_PATTERN","extractClientCertificateEvidence","event","source","undefined","result","extractStandardEvidence","extractForwardedEvidence","thumbprint","certificate","leafHeader","headers","get","chainHeader","certificateHeaderError","assertHeaderLength","parseStructuredCertificate","chain","parseStructuredCertificateList","value","pem","includes","decodeURIComponent","replace","certificates","length","items","split","map","item","trim","some","match","exec","raw","byteLength","toString"],"sources":["../../../../src/adapters/http/request/client-certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport '../../../core/client-certificate/reflect.ts';\nimport { X509Certificate } from '@peculiar/x509';\nimport { BadRequestError } from '@authup/errors';\nimport { base64ToArrayBuffer } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport type { ClientCertificateEvidence } from '../../../core/index.ts';\nimport {\n    buildClientCertificateThumbprint,\n    parseClientCertificateChain,\n} from '../../../core/index.ts';\nimport type { CertificateSource } from './types.ts';\n\nconst MAX_CERTIFICATE_HEADER_LENGTH = 128 * 1024;\nconst MAX_CERTIFICATE_CHAIN_LENGTH = 10;\nconst STRUCTURED_BINARY_PATTERN = /^:([A-Za-z0-9+/]*={0,2}):$/;\n\nexport async function extractClientCertificateEvidence(\n    event: IAppEvent,\n    source: CertificateSource,\n): Promise<ClientCertificateEvidence | undefined> {\n    if (source === 'disabled') {\n        return undefined;\n    }\n\n    let result: Omit<ClientCertificateEvidence, 'thumbprint'> | undefined;\n    if (source === 'standard') {\n        result = extractStandardEvidence(event);\n    } else if (source === 'forwarded') {\n        result = extractForwardedEvidence(event);\n    } else {\n        throw new BadRequestError('The client certificate source is not configured correctly.');\n    }\n    if (!result) {\n        return undefined;\n    }\n\n    return {\n        ...result,\n        thumbprint: await buildClientCertificateThumbprint(result.certificate),\n    };\n}\n\nfunction extractStandardEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const leafHeader = event.headers.get('client-cert');\n    const chainHeader = event.headers.get('client-cert-chain');\n\n    if (!leafHeader) {\n        if (chainHeader) {\n            throw certificateHeaderError();\n        }\n        return undefined;\n    }\n\n    assertHeaderLength(leafHeader);\n    const certificate = parseStructuredCertificate(leafHeader);\n    const chain = chainHeader ? parseStructuredCertificateList(chainHeader) : [];\n\n    return { certificate, chain };\n}\n\nfunction extractForwardedEvidence(\n    event: IAppEvent,\n): Omit<ClientCertificateEvidence, 'thumbprint'> | undefined {\n    const value = event.headers.get('x-forwarded-tls-client-cert');\n    if (!value) {\n        return undefined;\n    }\n\n    assertHeaderLength(value);\n\n    let pem: string;\n    try {\n        // Native raw PEM is useful in tests and a few proxy integrations. The\n        // NGINX/Traefik contract is escaped PEM: query-style `+` represents a\n        // space, while literal base64 plus signs arrive as `%2B`.\n        pem = value.includes('-----BEGIN CERTIFICATE-----') ?\n            value :\n            decodeURIComponent(value.replace(/\\+/g, '%20'));\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    let certificates: X509Certificate[];\n    try {\n        certificates = parseClientCertificateChain(pem);\n    } catch {\n        throw certificateHeaderError();\n    }\n\n    if (certificates.length !== 1 || !certificates[0]) {\n        throw certificateHeaderError();\n    }\n\n    return {\n        certificate: certificates[0],\n        chain: [],\n    };\n}\n\nfunction parseStructuredCertificateList(value: string): X509Certificate[] {\n    assertHeaderLength(value);\n    const items = value.split(',').map((item) => item.trim());\n    if (items.length > MAX_CERTIFICATE_CHAIN_LENGTH || items.some((item) => item.length === 0)) {\n        throw certificateHeaderError();\n    }\n\n    return items.map(parseStructuredCertificate);\n}\n\nfunction parseStructuredCertificate(value: string): X509Certificate {\n    const match = STRUCTURED_BINARY_PATTERN.exec(value.trim());\n    if (!match?.[1]) {\n        throw certificateHeaderError();\n    }\n\n    try {\n        const raw = base64ToArrayBuffer(match[1]);\n        if (raw.byteLength === 0) {\n            throw certificateHeaderError();\n        }\n\n        const certificate = new X509Certificate(raw);\n        if (\n            certificate.toString('base64').replace(/=+$/, '') !==\n            match[1].replace(/=+$/, '')\n        ) {\n            throw certificateHeaderError();\n        }\n\n        return certificate;\n    } catch {\n        throw certificateHeaderError();\n    }\n}\n\nfunction assertHeaderLength(value: string): void {\n    if (value.length > MAX_CERTIFICATE_HEADER_LENGTH) {\n        throw certificateHeaderError();\n    }\n}\n\nfunction certificateHeaderError(): BadRequestError {\n    return new BadRequestError('The forwarded client certificate header is malformed.');\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAMK,gCAAgC,MAAM;AAC5C,MAAMC,+BAA+B;AACrC,MAAMC,4BAA4B;AAElC,eAAsBC,iCAClBC,OACAC,QAAyB;CAEzB,IAAIA,WAAW,YACX;CAGJ,IAAIE;CACJ,IAAIF,WAAW,YACXE,SAASC,wBAAwBJ,KAAAA;MAC9B,IAAIC,WAAW,aAClBE,SAASE,yBAAyBL,KAAAA;MAElC,MAAM,IAAIR,gBAAgB,4DAAA;CAE9B,IAAI,CAACW,QACD;CAGJ,OAAO;EACH,GAAGA;EACHG,YAAY,MAAMZ,iCAAiCS,OAAOI,WAAW;CACzE;AACJ;AAEA,SAASH,wBACLJ,OAAgB;CAEhB,MAAMQ,aAAaR,MAAMS,QAAQC,IAAI,aAAA;CACrC,MAAMC,cAAcX,MAAMS,QAAQC,IAAI,mBAAA;CAEtC,IAAI,CAACF,YAAY;EACb,IAAIG,aACA,MAAMC,uBAAAA;EAEV;CACJ;CAEAC,mBAAmBL,UAAAA;CAInB,OAAO;EAAED,aAHWO,2BAA2BN,UAGtCD;EAAaQ,OAFRJ,cAAcK,+BAA+BL,WAAAA,IAAe,CAAA;CAE9C;AAChC;AAEA,SAASN,yBACLL,OAAgB;CAEhB,MAAMiB,QAAQjB,MAAMS,QAAQC,IAAI,6BAAA;CAChC,IAAI,CAACO,OACD;CAGJJ,mBAAmBI,KAAAA;CAEnB,IAAIC;CACJ,IAAI;EAIAA,MAAMD,MAAME,SAAS,6BAAA,IACjBF,QACAG,mBAAmBH,MAAMI,QAAQ,OAAO,KAAA,CAAA;CAChD,QAAQ;EACJ,MAAMT,uBAAAA;CACV;CAEA,IAAIU;CACJ,IAAI;EACAA,eAAe3B,4BAA4BuB,GAAAA;CAC/C,QAAQ;EACJ,MAAMN,uBAAAA;CACV;CAEA,IAAIU,aAAaC,WAAW,KAAK,CAACD,aAAa,IAC3C,MAAMV,uBAAAA;CAGV,OAAO;EACHL,aAAae,aAAa;EAC1BP,OAAO,CAAA;CACX;AACJ;AAEA,SAASC,+BAA+BC,OAAa;CACjDJ,mBAAmBI,KAAAA;CACnB,MAAMO,QAAQP,MAAMQ,MAAM,GAAA,CAAA,CAAKC,KAAKC,SAASA,KAAKC,KAAI,CAAA;CACtD,IAAIJ,MAAMD,SAAS1B,gCAAgC2B,MAAMK,MAAMF,SAASA,KAAKJ,WAAW,CAAA,GACpF,MAAMX,uBAAAA;CAGV,OAAOY,MAAME,IAAIZ,0BAAAA;AACrB;AAEA,SAASA,2BAA2BG,OAAa;CAC7C,MAAMa,QAAQhC,0BAA0BiC,KAAKd,MAAMW,KAAI,CAAA;CACvD,IAAI,CAACE,QAAQ,IACT,MAAMlB,uBAAAA;CAGV,IAAI;EACA,MAAMoB,MAAMvC,oBAAoBqC,MAAM,EAAE;EACxC,IAAIE,IAAIC,eAAe,GACnB,MAAMrB,uBAAAA;EAGV,MAAML,cAAc,IAAIhB,gBAAgByC,GAAAA;EACxC,IACIzB,YAAY2B,SAAS,QAAA,CAAA,CAAUb,QAAQ,OAAO,EAAA,MAC9CS,MAAM,EAAE,CAACT,QAAQ,OAAO,EAAA,GAExB,MAAMT,uBAAAA;EAGV,OAAOL;CACX,QAAQ;EACJ,MAAMK,uBAAAA;CACV;AACJ;AAEA,SAASC,mBAAmBI,OAAa;CACrC,IAAIA,MAAMM,SAAS3B,+BACf,MAAMgB,uBAAAA;AAEd;AAEA,SAASA,yBAAAA;CACL,OAAO,IAAIpB,gBAAgB,uDAAA;AAC/B"}

package/dist/adapters/http/request/constants.d.ts

@@ -5,4 +5,5 @@ export declare enum RequestHandlerOperation {
     UPDATE = "update",
     DELETE = "delete"
 }
+export declare const CERTIFICATE_SOURCES: readonly ["disabled", "standard", "forwarded"];
 //# sourceMappingURL=constants.d.ts.map

package/dist/adapters/http/request/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,uBAAuB;IAC/B,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB;AAED,eAAO,MAAM,mBAAmB,gDAItB,CAAC"}

package/dist/adapters/http/request/constants.mjs

@@ -10,7 +10,12 @@ var RequestHandlerOperation = /*#__PURE__*/ function(RequestHandlerOperation) {
 	RequestHandlerOperation["DELETE"] = "delete";
 	return RequestHandlerOperation;
 }({});
+const CERTIFICATE_SOURCES = [
+	"disabled",
+	"standard",
+	"forwarded"
+];
 //#endregion
-export { RequestHandlerOperation };
+export { CERTIFICATE_SOURCES, RequestHandlerOperation };
 
 //# sourceMappingURL=constants.mjs.map

package/dist/adapters/http/request/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["RequestHandlerOperation","CERTIFICATE_SOURCES"],"sources":["../../../../src/adapters/http/request/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nexport enum RequestHandlerOperation {\n    COMMAND = 'command',\n    CREATE = 'create',\n    READ = 'read',\n    UPDATE = 'update',\n    DELETE = 'delete',\n}\n\nexport const CERTIFICATE_SOURCES = [\n    'disabled',\n    'standard',\n    'forwarded',\n] as const;\n"],"mappings":";;;;AAOA,IAAO,0BAAKA,uBAAAA,yBAAAA;;;;;;QAAAA;;AAQZ,MAAaC,sBAAsB;CAC/B;CACA;CACA"}

package/dist/adapters/http/request/event-context.d.ts

@@ -0,0 +1,19 @@
+import type { Handler } from 'routup';
+import type { EventRequestContext } from '../../../core/index.ts';
+/**
+ * Actor + request attribution snapshot for entity-CRUD audit rows, carried
+ * across the request's async continuation via AsyncLocalStorage so the
+ * database subscribers (which have no request handle) can attribute their
+ * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —
+ * the getter returns undefined, the correct "system" semantics.
+ */
+export type RequestEventContext = EventRequestContext;
+export declare function runWithRequestEventContext<R>(ctx: RequestEventContext, fn: () => R): R;
+export declare function useRequestEventContext(): RequestEventContext | undefined;
+/**
+ * Builds the {@link RequestEventContext} from the routup event and wraps the
+ * downstream pipeline in it. Must be mounted AFTER the authorization
+ * middleware — the identity has to be resolved for actor attribution.
+ */
+export declare function createRequestEventContextMiddleware(): Handler;
+//# sourceMappingURL=event-context.d.ts.map

package/dist/adapters/http/request/event-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-context.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/event-context.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAItD,wBAAgB,0BAA0B,CAAC,CAAC,EACxC,GAAG,EAAE,mBAAmB,EACxB,EAAE,EAAE,MAAM,CAAC,GACZ,CAAC,CAEH;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAExE;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,IAAK,OAAO,CAgB9D"}

package/dist/adapters/http/request/event-context.mjs

@@ -0,0 +1,37 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "./helpers/identity.mjs";
+import "./helpers/index.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { defineCoreHandler, getRequestHeader, getRequestIP } from "routup";
+//#region src/adapters/http/request/event-context.ts
+const storage = new AsyncLocalStorage();
+function runWithRequestEventContext(ctx, fn) {
+	return storage.run(ctx, fn);
+}
+function useRequestEventContext() {
+	return storage.getStore();
+}
+/**
+* Builds the {@link RequestEventContext} from the routup event and wraps the
+* downstream pipeline in it. Must be mounted AFTER the authorization
+* middleware — the identity has to be resolved for actor attribution.
+*/ function createRequestEventContextMiddleware() {
+	return defineCoreHandler(async (event) => {
+		const identity = useRequestIdentity(event);
+		return runWithRequestEventContext({
+			actorType: identity ? identity.type : null,
+			actorId: identity ? identity.id : null,
+			actorName: identity ? identity.data.name ?? null : null,
+			requestPath: event.path,
+			requestMethod: event.method,
+			requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,
+			requestUserAgent: getRequestHeader(event, "user-agent") ?? null
+		}, () => event.next());
+	});
+}
+//#endregion
+export { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext };
+
+//# sourceMappingURL=event-context.mjs.map

package/dist/adapters/http/request/event-context.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-context.mjs","names":["AsyncLocalStorage","defineCoreHandler","getRequestHeader","getRequestIP","useRequestIdentity","storage","runWithRequestEventContext","ctx","fn","run","useRequestEventContext","getStore","createRequestEventContextMiddleware","event","identity","actorType","type","actorId","id","actorName","data","name","requestPath","path","requestMethod","method","requestIpAddress","trustProxy","requestUserAgent","next"],"sources":["../../../../src/adapters/http/request/event-context.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { defineCoreHandler, getRequestHeader, getRequestIP } from 'routup';\nimport type { Handler } from 'routup';\nimport type { EventRequestContext } from '../../../core/index.ts';\nimport { useRequestIdentity } from './helpers/index.ts';\n\n/**\n * Actor + request attribution snapshot for entity-CRUD audit rows, carried\n * across the request's async continuation via AsyncLocalStorage so the\n * database subscribers (which have no request handle) can attribute their\n * writes. Writes outside HTTP (provisioning, CLI, cron) have no store —\n * the getter returns undefined, the correct \"system\" semantics.\n */\nexport type RequestEventContext = EventRequestContext;\n\nconst storage = new AsyncLocalStorage<RequestEventContext>();\n\nexport function runWithRequestEventContext<R>(\n    ctx: RequestEventContext,\n    fn: () => R,\n): R {\n    return storage.run(ctx, fn);\n}\n\nexport function useRequestEventContext(): RequestEventContext | undefined {\n    return storage.getStore();\n}\n\n/**\n * Builds the {@link RequestEventContext} from the routup event and wraps the\n * downstream pipeline in it. Must be mounted AFTER the authorization\n * middleware — the identity has to be resolved for actor attribution.\n */\nexport function createRequestEventContextMiddleware() : Handler {\n    return defineCoreHandler(async (event) => {\n        const identity = useRequestIdentity(event);\n\n        const ctx : RequestEventContext = {\n            actorType: identity ? identity.type : null,\n            actorId: identity ? identity.id : null,\n            actorName: identity ? identity.data.name ?? null : null,\n            requestPath: event.path,\n            requestMethod: event.method,\n            requestIpAddress: getRequestIP(event, { trustProxy: true }) ?? null,\n            requestUserAgent: getRequestHeader(event, 'user-agent') ?? null,\n        };\n\n        return runWithRequestEventContext(ctx, () => event.next());\n    });\n}\n"],"mappings":";;;;;;;;AAsBA,MAAMK,UAAU,IAAIL,kBAAAA;AAEpB,SAAgBM,2BACZC,KACAC,IAAW;CAEX,OAAOH,QAAQI,IAAIF,KAAKC,EAAAA;AAC5B;AAEA,SAAgBE,yBAAAA;CACZ,OAAOL,QAAQM,SAAQ;AAC3B;;;;;GAOA,SAAgBC,sCAAAA;CACZ,OAAOX,kBAAkB,OAAOY,UAAAA;EAC5B,MAAMC,WAAWV,mBAAmBS,KAAAA;EAYpC,OAAOP,2BAA2BC;GAT9BQ,WAAWD,WAAWA,SAASE,OAAO;GACtCC,SAASH,WAAWA,SAASI,KAAK;GAClCC,WAAWL,WAAWA,SAASM,KAAKC,QAAQ,OAAO;GACnDC,aAAaT,MAAMU;GACnBC,eAAeX,MAAMY;GACrBC,kBAAkBvB,aAAaU,OAAO,EAAEc,YAAY,KAAK,CAAA,KAAM;GAC/DC,kBAAkB1B,iBAAiBW,OAAO,YAAA,KAAiB;EAG7BN,SAAWM,MAAMgB,KAAI,CAAA;CAC3D,CAAA;AACJ"}

package/dist/adapters/http/request/helpers/body-realm-id.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { isUUID } from "@authup/kit";
 //#region src/adapters/http/request/helpers/body-realm-id.ts
 function getBodyRealmID(body) {
-	const realmId = body?.realm_id;
+	const realmId = body?.realmId;
 	if (typeof realmId !== "string") return;
 	if (!isUUID(realmId)) return;
 	return realmId;

package/dist/adapters/http/request/helpers/body-realm-id.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"body-realm-id.mjs","names":["isUUID","getBodyRealmID","body","realmId","realm_id","undefined"],"sources":["../../../../../src/adapters/http/request/helpers/body-realm-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\n\nexport function getBodyRealmID(body: Record<string, any> | undefined) : string | undefined {\n    const realmId = body?.realm_id;\n    if (typeof realmId !== 'string') {\n        return undefined;\n    }\n\n    if (!isUUID(realmId)) {\n        return undefined;\n    }\n\n    return realmId;\n}\n"],"mappings":";;;;;AASA,SAAgBC,eAAeC,MAAqC;CAChE,MAAMC,UAAUD,MAAME;CACtB,IAAI,OAAOD,YAAY,UACnB;CAGJ,IAAI,CAACH,OAAOG,OAAAA,GACR;CAGJ,OAAOA;AACX"}
+{"version":3,"file":"body-realm-id.mjs","names":["isUUID","getBodyRealmID","body","realmId","undefined"],"sources":["../../../../../src/adapters/http/request/helpers/body-realm-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\n\nexport function getBodyRealmID(body: Record<string, any> | undefined) : string | undefined {\n    const realmId = body?.realmId;\n    if (typeof realmId !== 'string') {\n        return undefined;\n    }\n\n    if (!isUUID(realmId)) {\n        return undefined;\n    }\n\n    return realmId;\n}\n"],"mappings":";;;;;AASA,SAAgBC,eAAeC,MAAqC;CAChE,MAAMC,UAAUD,MAAMC;CACtB,IAAI,OAAOA,YAAY,UACnB;CAGJ,IAAI,CAACH,OAAOG,OAAAA,GACR;CAGJ,OAAOA;AACX"}

package/dist/adapters/http/request/helpers/identity.d.ts

@@ -4,8 +4,8 @@ export declare class RequestIdentity {
     readonly raw: Identity;
     constructor(identity: Identity);
     get clientId(): any;
-    get data(): import("@authup/core-kit").Client | import("@authup/core-kit").Robot | import("@authup/core-kit").User;
-    get type(): "user" | "client" | "robot";
+    get data(): import("@authup/core-kit").Client | import("@authup/core-kit").User;
+    get type(): "user" | "client";
     get id(): string;
     get realmId(): string;
     get realmName(): string;

package/dist/adapters/http/request/helpers/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,2GAEP;IAED,IAAI,IAAI,gCAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,qBAAa,eAAe;IACxB,SAAgB,GAAG,EAAG,QAAQ,CAAC;gBAEnB,QAAQ,EAAE,QAAQ;IAI9B,IAAI,QAAQ,QAOX;IAED,IAAI,IAAI,wEAEP;IAED,IAAI,IAAI,sBAEP;IAED,IAAI,EAAE,WAEL;IAED,IAAI,OAAO,WAEV;IAED,IAAI,SAAS,WAEZ;CACJ;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAEjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAI,IAAI,CAU7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,CAO3E"}

package/dist/adapters/http/request/helpers/identity.mjs

@@ -13,7 +13,7 @@ var RequestIdentity = class {
 	get clientId() {
 		const { raw } = this;
 		if (raw.type === IdentityType.CLIENT) return raw.data.id;
-		return raw.data.client_id || null;
+		return raw.data.clientId || null;
 	}
 	get data() {
 		return this.raw.data;
@@ -25,7 +25,7 @@ var RequestIdentity = class {
 		return this.raw.data.id;
 	}
 	get realmId() {
-		return this.raw.data.realm_id || this.raw.data.realm?.id;
+		return this.raw.data.realmId || this.raw.data.realm?.id;
 	}
 	get realmName() {
 		return this.raw.data.realm?.name;

package/dist/adapters/http/request/helpers/identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","client_id","realmId","realm_id","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n    public readonly raw : Identity;\n\n    constructor(identity: Identity) {\n        this.raw = identity;\n    }\n\n    get clientId() {\n        const { raw } = this;\n        if (raw.type === IdentityType.CLIENT) {\n            return raw.data.id;\n        }\n\n        return raw.data.client_id || null;\n    }\n\n    get data() {\n        return this.raw.data;\n    }\n\n    get type() {\n        return this.raw.type;\n    }\n\n    get id() {\n        return this.raw.data.id;\n    }\n\n    get realmId() {\n        return this.raw.data.realm_id || this.raw.data.realm?.id;\n    }\n\n    get realmName() {\n        return this.raw.data.realm?.name;\n    }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity | undefined {\n    return event.store[sym] as RequestIdentity | undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity) : void {\n    let data : RequestIdentity;\n\n    if (input instanceof RequestIdentity) {\n        data = input;\n    } else {\n        data = new RequestIdentity(input);\n    }\n\n    event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n    const identity = useRequestIdentity(event);\n    if (!identity) {\n        throw new UnauthorizedError();\n    }\n\n    return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKE,aAAa;CACjC;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIE,UAAU;EACV,OAAO,KAAKR,IAAIK,KAAKI,YAAY,KAAKT,IAAIK,KAAKK,OAAOJ;CAC1D;CAEA,IAAIK,YAAY;EACZ,OAAO,KAAKX,IAAIK,KAAKK,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMlB;AACvB;AAEA,SAAgBmB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIZ;CAEJ,IAAIY,iBAAiBlB,iBACjBM,OAAOY;MAEPZ,OAAO,IAAIN,gBAAgBkB,KAAAA;CAG/BH,MAAMC,MAAMlB,OAAOQ;AACvB;AAEA,SAAgBa,yBAAyBJ,OAAgB;CACrD,MAAMb,WAAWY,mBAAmBC,KAAAA;CACpC,IAAI,CAACb,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}
+{"version":3,"file":"identity.mjs","names":["IdentityType","UnauthorizedError","sym","Symbol","RequestIdentity","raw","identity","clientId","type","CLIENT","data","id","realmId","realm","realmName","name","useRequestIdentity","event","store","setRequestIdentity","input","useRequestIdentityOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/identity.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Identity } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('RIdentity');\n\nexport class RequestIdentity {\n    public readonly raw : Identity;\n\n    constructor(identity: Identity) {\n        this.raw = identity;\n    }\n\n    get clientId() {\n        const { raw } = this;\n        if (raw.type === IdentityType.CLIENT) {\n            return raw.data.id;\n        }\n\n        return raw.data.clientId || null;\n    }\n\n    get data() {\n        return this.raw.data;\n    }\n\n    get type() {\n        return this.raw.type;\n    }\n\n    get id() {\n        return this.raw.data.id;\n    }\n\n    get realmId() {\n        return this.raw.data.realmId || this.raw.data.realm?.id;\n    }\n\n    get realmName() {\n        return this.raw.data.realm?.name;\n    }\n}\n\nexport function useRequestIdentity(event: IAppEvent) : RequestIdentity | undefined {\n    return event.store[sym] as RequestIdentity | undefined;\n}\n\nexport function setRequestIdentity(event: IAppEvent, input: Identity | RequestIdentity) : void {\n    let data : RequestIdentity;\n\n    if (input instanceof RequestIdentity) {\n        data = input;\n    } else {\n        data = new RequestIdentity(input);\n    }\n\n    event.store[sym] = data;\n}\n\nexport function useRequestIdentityOrFail(event: IAppEvent) : RequestIdentity {\n    const identity = useRequestIdentity(event);\n    if (!identity) {\n        throw new UnauthorizedError();\n    }\n\n    return identity;\n}\n"],"mappings":";;;;;;AAYA,MAAME,MAAMC,OAAO,WAAA;AAEnB,IAAaC,kBAAb,MAAaA;CACOC;CAEhB,YAAYC,UAAoB;EAC5B,KAAKD,MAAMC;CACf;CAEA,IAAIC,WAAW;EACX,MAAM,EAAEF,QAAQ;EAChB,IAAIA,IAAIG,SAASR,aAAaS,QAC1B,OAAOJ,IAAIK,KAAKC;EAGpB,OAAON,IAAIK,KAAKH,YAAY;CAChC;CAEA,IAAIG,OAAO;EACP,OAAO,KAAKL,IAAIK;CACpB;CAEA,IAAIF,OAAO;EACP,OAAO,KAAKH,IAAIG;CACpB;CAEA,IAAIG,KAAK;EACL,OAAO,KAAKN,IAAIK,KAAKC;CACzB;CAEA,IAAIC,UAAU;EACV,OAAO,KAAKP,IAAIK,KAAKE,WAAW,KAAKP,IAAIK,KAAKG,OAAOF;CACzD;CAEA,IAAIG,YAAY;EACZ,OAAO,KAAKT,IAAIK,KAAKG,OAAOE;CAChC;AACJ;AAEA,SAAgBC,mBAAmBC,OAAgB;CAC/C,OAAOA,MAAMC,MAAMhB;AACvB;AAEA,SAAgBiB,mBAAmBF,OAAkBG,OAAiC;CAClF,IAAIV;CAEJ,IAAIU,iBAAiBhB,iBACjBM,OAAOU;MAEPV,OAAO,IAAIN,gBAAgBgB,KAAAA;CAG/BH,MAAMC,MAAMhB,OAAOQ;AACvB;AAEA,SAAgBW,yBAAyBJ,OAAgB;CACrD,MAAMX,WAAWU,mBAAmBC,KAAAA;CACpC,IAAI,CAACX,UACD,MAAM,IAAIL,kBAAAA;CAGd,OAAOK;AACX"}

package/dist/adapters/http/request/helpers/index.d.ts

@@ -3,6 +3,7 @@ export * from './body-realm-id.ts';
 export * from './identity.ts';
 export * from './locale.ts';
 export * from './locations.ts';
+export * from './mfa-login-ticket.ts';
 export * from './param-id.ts';
 export * from './realm-id.ts';
 export * from './redirect.ts';

package/dist/adapters/http/request/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/helpers/index.mjs

@@ -6,10 +6,11 @@ import { buildActorContext } from "./actor.mjs";
 import { getBodyRealmID } from "./body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./locale.mjs";
 import { readFromLocations } from "./locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./session-id.mjs";
 import { setRequestToken, useRequestToken } from "./token.mjs";
-export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };
+export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/request/helpers/mfa-login-ticket.d.ts

@@ -0,0 +1,16 @@
+import type { OAuth2TokenPayload } from '@authup/specs';
+import type { IAppEvent } from 'routup';
+import type { RequestIdentity } from './identity.ts';
+/**
+ * A verified "MFA-pending" login ticket (kind: mfa_token, issue #3242) —
+ * stashed on its own request slot, NEVER the main identity slot, so every
+ * identity-gated route stays default-deny for a ticket bearer. Only the
+ * challenge routes read it.
+ */
+export type RequestMfaLoginTicket = {
+    identity: RequestIdentity;
+    payload: OAuth2TokenPayload;
+};
+export declare function useRequestMfaLoginTicket(event: IAppEvent): RequestMfaLoginTicket | undefined;
+export declare function setRequestMfaLoginTicket(event: IAppEvent, input: RequestMfaLoginTicket): void;
+//# sourceMappingURL=mfa-login-ticket.d.ts.map

package/dist/adapters/http/request/helpers/mfa-login-ticket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-ticket.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/mfa-login-ticket.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI,qBAAqB,GAAG,SAAS,CAE7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,GAAI,IAAI,CAE9F"}

package/dist/adapters/http/request/helpers/mfa-login-ticket.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/mfa-login-ticket.ts
+const sym = Symbol("RMfaLoginTicket");
+function useRequestMfaLoginTicket(event) {
+	return event.store[sym];
+}
+function setRequestMfaLoginTicket(event, input) {
+	event.store[sym] = input;
+}
+//#endregion
+export { setRequestMfaLoginTicket, useRequestMfaLoginTicket };
+
+//# sourceMappingURL=mfa-login-ticket.mjs.map

package/dist/adapters/http/request/helpers/mfa-login-ticket.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-ticket.mjs","names":["sym","Symbol","useRequestMfaLoginTicket","event","store","setRequestMfaLoginTicket","input"],"sources":["../../../../../src/adapters/http/request/helpers/mfa-login-ticket.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IAppEvent } from 'routup';\nimport type { RequestIdentity } from './identity.ts';\n\nconst sym = Symbol('RMfaLoginTicket');\n\n/**\n * A verified \"MFA-pending\" login ticket (kind: mfa_token, issue #3242) —\n * stashed on its own request slot, NEVER the main identity slot, so every\n * identity-gated route stays default-deny for a ticket bearer. Only the\n * challenge routes read it.\n */\nexport type RequestMfaLoginTicket = {\n    identity: RequestIdentity,\n    payload: OAuth2TokenPayload,\n};\n\nexport function useRequestMfaLoginTicket(event: IAppEvent) : RequestMfaLoginTicket | undefined {\n    return event.store[sym] as RequestMfaLoginTicket | undefined;\n}\n\nexport function setRequestMfaLoginTicket(event: IAppEvent, input: RequestMfaLoginTicket) : void {\n    event.store[sym] = input;\n}\n"],"mappings":";;;;AAWA,MAAMA,MAAMC,OAAO,iBAAA;AAanB,SAAgBC,yBAAyBC,OAAgB;CACrD,OAAOA,MAAMC,MAAMJ;AACvB;AAEA,SAAgBK,yBAAyBF,OAAkBG,OAA4B;CACnFH,MAAMC,MAAMJ,OAAOM;AACvB"}

package/dist/adapters/http/request/helpers/realm-id.mjs

@@ -14,7 +14,7 @@ function getRequestRealmID(event) {
 }
 function applyRouteRealmIDToBody(event, data) {
 	const routeRealmId = getRequestRealmID(event);
-	if (routeRealmId) data.realm_id = routeRealmId;
+	if (routeRealmId) data.realmId = routeRealmId;
 }
 //#endregion
 export { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID };

package/dist/adapters/http/request/helpers/realm-id.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"realm-id.mjs","names":["getRequestStringParam","sym","Symbol","setRequestRealmID","event","id","store","getRequestRealmID","stored","applyRouteRealmIDToBody","data","routeRealmId","realm_id"],"sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { getRequestStringParam } from './param-id.ts';\n\nconst sym = Symbol('RRealmID');\n\nexport function setRequestRealmID(event: IAppEvent, id: string): void {\n    event.store[sym] = id;\n}\n\nexport function getRequestRealmID(event: IAppEvent): string | undefined {\n    const stored = event.store[sym] as string | undefined;\n    if (stored) {\n        return stored;\n    }\n    return getRequestStringParam(event, 'realmId');\n}\n\nexport function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void {\n    const routeRealmId = getRequestRealmID(event);\n    if (routeRealmId) {\n        data.realm_id = routeRealmId;\n    }\n}\n"],"mappings":";;;;;AAUA,MAAMC,MAAMC,OAAO,UAAA;AAEnB,SAAgBC,kBAAkBC,OAAkBC,IAAU;CAC1DD,MAAME,MAAML,OAAOI;AACvB;AAEA,SAAgBE,kBAAkBH,OAAgB;CAC9C,MAAMI,SAASJ,MAAME,MAAML;CAC3B,IAAIO,QACA,OAAOA;CAEX,OAAOR,sBAAsBI,OAAO,SAAA;AACxC;AAEA,SAAgBK,wBAAwBL,OAAkBM,MAAyB;CAC/E,MAAMC,eAAeJ,kBAAkBH,KAAAA;CACvC,IAAIO,cACAD,KAAKE,WAAWD;AAExB"}
+{"version":3,"file":"realm-id.mjs","names":["getRequestStringParam","sym","Symbol","setRequestRealmID","event","id","store","getRequestRealmID","stored","applyRouteRealmIDToBody","data","routeRealmId","realmId"],"sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { getRequestStringParam } from './param-id.ts';\n\nconst sym = Symbol('RRealmID');\n\nexport function setRequestRealmID(event: IAppEvent, id: string): void {\n    event.store[sym] = id;\n}\n\nexport function getRequestRealmID(event: IAppEvent): string | undefined {\n    const stored = event.store[sym] as string | undefined;\n    if (stored) {\n        return stored;\n    }\n    return getRequestStringParam(event, 'realmId');\n}\n\nexport function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void {\n    const routeRealmId = getRequestRealmID(event);\n    if (routeRealmId) {\n        data.realmId = routeRealmId;\n    }\n}\n"],"mappings":";;;;;AAUA,MAAMC,MAAMC,OAAO,UAAA;AAEnB,SAAgBC,kBAAkBC,OAAkBC,IAAU;CAC1DD,MAAME,MAAML,OAAOI;AACvB;AAEA,SAAgBE,kBAAkBH,OAAgB;CAC9C,MAAMI,SAASJ,MAAME,MAAML;CAC3B,IAAIO,QACA,OAAOA;CAEX,OAAOR,sBAAsBI,OAAO,SAAA;AACxC;AAEA,SAAgBK,wBAAwBL,OAAkBM,MAAyB;CAC/E,MAAMC,eAAeJ,kBAAkBH,KAAAA;CACvC,IAAIO,cACAD,KAAKE,UAAUD;AAEvB"}

package/dist/adapters/http/request/index.d.ts

@@ -1,4 +1,7 @@
 export * from './constants.ts';
+export * from './client-certificate.ts';
+export * from './event-context.ts';
 export * from './helpers/index.ts';
 export * from './permission/index.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/index.mjs

@@ -1,13 +1,15 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { RequestHandlerOperation } from "./constants.mjs";
+import { CERTIFICATE_SOURCES, RequestHandlerOperation } from "./constants.mjs";
+import { extractClientCertificateEvidence } from "./client-certificate.mjs";
 import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./permission/helper.mjs";
 import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./helpers/identity.mjs";
 import { buildActorContext } from "./helpers/actor.mjs";
 import { getBodyRealmID } from "./helpers/body-realm-id.mjs";
 import { LOCALE_COOKIE, useRequestLocale } from "./helpers/locale.mjs";
 import { readFromLocations } from "./helpers/locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./helpers/mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./helpers/realm-id.mjs";
 import { sanitizeRelativeRedirect } from "./helpers/redirect.mjs";
@@ -15,6 +17,7 @@ import { setRequestScopes, useRequestScopes } from "./helpers/scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./helpers/token.mjs";
 import "./helpers/index.mjs";
+import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./event-context.mjs";
 import { RequestPermissionEvaluator } from "./permission/module.mjs";
 import "./permission/index.mjs";
-export { LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { CERTIFICATE_SOURCES, LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, createRequestEventContextMiddleware, extractClientCertificateEvidence, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, readFromLocations, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };