@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/adapters/http/request/permission/module.d.ts

@@ -1,4 +1,4 @@
-import type { IPermissionEvaluator, PermissionEvaluationContext } from '@authup/access';
+import type { IPermissionEvaluator, PermissionCompileContext, PermissionCompileResult, PermissionEvaluationContext } from '@authup/access';
 import type { IAppEvent } from 'routup';
 export declare class RequestPermissionEvaluator implements IPermissionEvaluator {
     protected event: IAppEvent;
@@ -8,6 +8,7 @@ export declare class RequestPermissionEvaluator implements IPermissionEvaluator
     preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
     preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
     evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
-    protected extendContext(ctx: PermissionEvaluationContext): PermissionEvaluationContext;
+    compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
+    protected extendContext<T extends PermissionEvaluationContext | PermissionCompileContext>(ctx: T): T;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/request/permission/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAMrE,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,2BAA2B;CAiB3D"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM/D,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;IAM/E,SAAS,CAAC,aAAa,CAAC,CAAC,SAAS,2BAA2B,GAAG,wBAAwB,EAAE,GAAG,EAAE,CAAC,GAAI,CAAC;CAiBxG"}

package/dist/adapters/http/request/permission/module.mjs

@@ -26,6 +26,9 @@ var RequestPermissionEvaluator = class {
 	async evaluateOneOf(ctx) {
 		return this.evaluator.evaluateOneOf(this.extendContext(ctx));
 	}
+	async compile(ctx) {
+		return this.evaluator.compile(this.extendContext(ctx));
+	}
 	extendContext(ctx) {
 		const scopes = useRequestScopes(this.event);
 		const identity = useRequestIdentity(this.event);

package/dist/adapters/http/request/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext(ctx: PermissionEvaluationContext) {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (scopes.includes(ScopeName.GLOBAL) && identity) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIUC,cAAcD,KAAkC;EACtD,MAAMK,SAASV,iBAAiB,KAAKE,KAAK;EAC1C,MAAMS,WAAWZ,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIQ,OAAOE,SAAShB,UAAUiB,MAAM,KAAKF,UAAU;GAC/CN,IAAIS,OAAOT,IAAIS,QAAQ,IAAIhB,WAAAA;GAC3BO,IAAIS,KAAKC,IAAIlB,kBAAkBmB,UAAUL,QAAAA;EAC7C;EAEA,OAAON;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","compile","scopes","identity","includes","GLOBAL","data","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionCompileContext,\n    PermissionCompileResult,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async compile(ctx: PermissionCompileContext) : Promise<PermissionCompileResult> {\n        return this.evaluator.compile(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext<T extends PermissionEvaluationContext | PermissionCompileContext>(ctx: T) : T {\n        const scopes = useRequestScopes(this.event);\n        const identity = useRequestIdentity(this.event);\n\n        // Only attach the identity policy data when an identity was actually\n        // resolved. Setting it to `undefined` would still make\n        // `PolicyData.has('identity')` true (key presence), so the built-in\n        // identity evaluator would run its validator against `undefined` and\n        // throw an uncaught error instead of a clean permission denial — see\n        // the deleted-subject edge case in issue #3184.\n        if (scopes.includes(ScopeName.GLOBAL) && identity) {\n            ctx.data = ctx.data || new PolicyData();\n            ctx.data.set(BuiltInPolicyType.IDENTITY, identity);\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIA,MAAMK,QAAQL,KAAkE;EAC5E,OAAO,KAAKF,UAAUO,QAAQ,KAAKJ,cAAcD,GAAAA,CAAAA;CACrD;CAIUC,cAAgFD,KAAY;EAClG,MAAMM,SAASX,iBAAiB,KAAKE,KAAK;EAC1C,MAAMU,WAAWb,mBAAmB,KAAKG,KAAK;EAQ9C,IAAIS,OAAOE,SAASjB,UAAUkB,MAAM,KAAKF,UAAU;GAC/CP,IAAIU,OAAOV,IAAIU,QAAQ,IAAIjB,WAAAA;GAC3BO,IAAIU,KAAKC,IAAInB,kBAAkBoB,UAAUL,QAAAA;EAC7C;EAEA,OAAOP;CACX;AACJ"}

package/dist/adapters/http/request/types.d.ts

@@ -0,0 +1,3 @@
+import type { CERTIFICATE_SOURCES } from './constants.ts';
+export type CertificateSource = typeof CERTIFICATE_SOURCES[number];
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/request/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC"}

package/dist/adapters/http/ui/render.mjs

@@ -1,17 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
 import { rebasePublicAssetURLs } from "./base-path.mjs";
 import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
-import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
 import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
 import "../middleware/index.mjs";
 import { getURLBasePath } from "@authup/kit";
 import path from "node:path";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { useRequestCookie } from "@routup/basic/cookie";
-import { load } from "locter";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
+import { read } from "locter";
 import fs from "node:fs";
 //#region src/adapters/http/ui/render.ts
 const COLOR_MODE_COOKIE = "vc-color-mode";
@@ -36,7 +36,7 @@ async function renderUIPage(event, ctx) {
 	} else {
 		html = cachedHtml ??= await fs.promises.readFile(path.join(UI_DIST_PATH, "client", "index.html"), "utf-8");
 		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(UI_DIST_PATH, "client", ".vite", "ssr-manifest.json"), "utf-8"));
-		render = cachedRender ??= (await load(path.join(UI_DIST_PATH, "server", "server.js"))).render;
+		render = cachedRender ??= (await read(path.join(UI_DIST_PATH, "server", "server.js"))).render;
 	}
 	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
 	const [appHtml, preloadLinks] = await render({

package/dist/adapters/http/ui/render.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","load","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { load } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await load(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n    // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n    // logout) mutate state behind explicit clicks and hydrate the logged-in\n    // session from first-party cookies. Framing them would make click-gating\n    // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n    // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n\n    // The auth pages' URLs routinely carry sensitive query params\n    // (id_token_hint, code, redirect, state) — never leak them via Referer.\n    event.response.headers.set('referrer-policy', 'no-referrer');\n\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}
+{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","read","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await read(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n    // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n    // logout) mutate state behind explicit clicks and hydrate the logged-in\n    // session from first-party cookies. Framing them would make click-gating\n    // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n    // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n\n    // The auth pages' URLs routinely carry sensitive query params\n    // (id_token_hint, code, redirect, state) — never leak them via Referer.\n    event.response.headers.set('referrer-policy', 'no-referrer');\n\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}

package/dist/adapters/http/ui/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAuBjB"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/adapters/http/ui/serve.mjs

@@ -16,7 +16,10 @@ import { useRequestQuery } from "@routup/basic/query";
 		features: options.features,
 		redirect: sanitizeRelativeRedirect(query.redirect)
 	};
-	if (options.realmAware) data.realmId = typeof query.realm_id === "string" ? query.realm_id : void 0;
+	if (options.realmAware) {
+		const realmId = typeof query.realmId === "string" ? query.realmId : query.realm_id;
+		data.realmId = typeof realmId === "string" ? realmId : void 0;
+	}
 	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
 	return renderUIPage(event, {
 		url: options.url,

package/dist/adapters/http/ui/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realm_id` / `token` query params (e.g.\n    // prefill from an email deep link). Off by default so a page never\n    // reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        data.realmId = typeof query.realm_id === 'string' ? query.realm_id : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YACRH,KAAKI,UAAU,OAAOL,MAAMM,aAAa,WAAWN,MAAMM,WAAWC,KAAAA;CAGzE,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}
+{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YAAY;EACpB,MAAMC,UAAU,OAAOL,MAAMK,YAAY,WAAWL,MAAMK,UAAUL,MAAMM;EAC1EL,KAAKI,UAAU,OAAOA,YAAY,WAAWA,UAAUE,KAAAA;CAC3D;CAEA,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/app/index.mjs

@@ -10,34 +10,37 @@ import { ConfigModule } from "./modules/config/module.mjs";
 import { CacheModule } from "./modules/cache/module.mjs";
 import { SessionRepository } from "./modules/authentication/repositories/session.mjs";
 import { AuthenticationModule } from "./modules/authentication/module.mjs";
-import { DatabaseInjectionKey } from "./modules/database/constants.mjs";
-import { LoggerInjectionKey } from "./modules/logger/constants.mjs";
-import { LoggerModule } from "./modules/logger/module.mjs";
-import { DatabaseModule } from "./modules/database/module.mjs";
 import { RealmRepositoryAdapter } from "./modules/database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "./modules/database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "./modules/database/repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "./modules/database/repositories/client-role/repository.mjs";
 import { ClientScopeRepositoryAdapter } from "./modules/database/repositories/client-scope/repository.mjs";
+import { EventRepositoryAdapter } from "./modules/database/repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./modules/database/repositories/identity-provider/repository.mjs";
+import { KeyRepositoryAdapter } from "./modules/database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./modules/database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./modules/database/repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "./modules/database/repositories/permission-provider/module.mjs";
 import { PolicyRepositoryAdapter } from "./modules/database/repositories/policy/repository.mjs";
-import { RobotRepositoryAdapter } from "./modules/database/repositories/robot/repository.mjs";
-import { RobotPermissionRepositoryAdapter } from "./modules/database/repositories/robot-permission/repository.mjs";
-import { RobotRoleRepositoryAdapter } from "./modules/database/repositories/robot-role/repository.mjs";
 import { RoleRepositoryAdapter } from "./modules/database/repositories/role/repository.mjs";
 import { RoleAttributeRepositoryAdapter } from "./modules/database/repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "./modules/database/repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "./modules/database/repositories/scope/repository.mjs";
+import { TrustAnchorRepositoryAdapter } from "./modules/database/repositories/trust-anchor/repository.mjs";
 import { UserRepositoryAdapter } from "./modules/database/repositories/user/repository.mjs";
 import { UserAttributeRepositoryAdapter } from "./modules/database/repositories/user-attribute/repository.mjs";
+import { UserAuthenticatorRepositoryAdapter } from "./modules/database/repositories/user-authenticator/repository.mjs";
 import { UserPermissionRepositoryAdapter } from "./modules/database/repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "./modules/database/repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./modules/database/repositories/identity-provider-role-mapping/repository.mjs";
+import { DatabaseInjectionKey } from "./modules/database/constants.mjs";
+import { LoggerInjectionKey } from "./modules/logger/constants.mjs";
+import { LoggerModule } from "./modules/logger/module.mjs";
+import { DatabaseModule } from "./modules/database/module.mjs";
 import { ComponentsModule } from "./modules/components/module.mjs";
 import { HTTPInjectionKey } from "./modules/http/constants.mjs";
+import { MetricsInjectionKey } from "./modules/metrics/constants.mjs";
+import { PromAuthFlowMetrics } from "./modules/metrics/prom.mjs";
 import { OAuth2InjectionToken } from "./modules/oauth2/constants.mjs";
 import { IdentityInjectionKey } from "./modules/identity/constants.mjs";
 import { IdentityProviderAccountRepository } from "./modules/identity/repositories/provider/account/module.mjs";
@@ -45,7 +48,6 @@ import { IdentityProviderAttributeMappingRepository } from "./modules/identity/r
 import { IdentityProviderPermissionMappingRepository } from "./modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./modules/identity/repositories/provider/mapper/role.mjs";
 import { ClientIdentityRepository } from "./modules/identity/repositories/client.mjs";
-import { RobotIdentityRepository } from "./modules/identity/repositories/robot.mjs";
 import { UserIdentityRepository } from "./modules/identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./modules/ldap/constants.mjs";
 import { LdapModule } from "./modules/ldap/module.mjs";
@@ -62,4 +64,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, UserAttributeRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins };

package/dist/app/modules/authentication/repositories/session.d.ts

@@ -1,4 +1,5 @@
 import type { Session } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
 import type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';
 import type { Repository } from 'typeorm';
 import type { ISessionRepository, SessionFindManyOptions, SessionOwner } from '../../../../core/index.ts';
@@ -11,9 +12,9 @@ export declare class SessionRepository implements ISessionRepository {
     protected repository: Repository<Session>;
     constructor(ctx: SessionRepositoryContext);
     findOneById(id: string): Promise<Session | null>;
-    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
     findAllByOwner(owner: SessionOwner): Promise<Session[]>;
-    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
+    findAllByQuery(query: IQuery): Promise<Session[]>;
     save(input: Partial<Session>): Promise<Session>;
     remove(session: Session): Promise<void>;
     removeById(id: string): Promise<void>;

package/dist/app/modules/authentication/repositories/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EACR,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACf,MAAM,2BAA2B,CAAC;AAKnC,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBhD,QAAQ,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAkD7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASvD,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAmB9D,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EACR,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACf,MAAM,2BAA2B,CAAC;AAInC,KAAK,wBAAwB,GAAG;IAC5B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAA;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;IAEzB,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAI/B,GAAG,EAAE,wBAAwB;IAOnC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBhD,QAAQ,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sBAA2B,GACrC,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IA0B7C,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IASvD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgBjD,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO9C"}

package/dist/app/modules/authentication/repositories/session.mjs

@@ -1,12 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { SESSION_FILTER_KEYS } from "../../../../core/authentication/session/types.mjs";
-import "../../../../core/index.mjs";
+import { applyQuery } from "../../database/repositories/query.mjs";
 import { applyRealmScopeSelect } from "../../database/repositories/helpers.mjs";
 import { AuthenticationCachePrefix } from "./constants.mjs";
 import { buildCacheKey } from "@authup/server-kit";
-import { applyQuery } from "typeorm-extension";
 //#region src/app/modules/authentication/repositories/session.ts
 var SessionRepository = class {
 	cache;
@@ -25,36 +23,9 @@ var SessionRepository = class {
 	}
 	async findMany(query, options = {}) {
 		const qb = this.repository.createQueryBuilder("session");
-		const { pagination } = applyQuery(qb, query, {
-			defaultAlias: "session",
-			fields: { allowed: [
-				"id",
-				"sub",
-				"sub_kind",
-				"ip_address",
-				"user_agent",
-				"expires_at",
-				"refreshed_at",
-				"seen_at",
-				"created_at",
-				"updated_at",
-				"user_id",
-				"client_id",
-				"robot_id",
-				"realm_id"
-			] },
-			filters: { allowed: [...SESSION_FILTER_KEYS] },
-			relations: { allowed: ["realm"] },
-			sort: { allowed: [
-				"seen_at",
-				"expires_at",
-				"created_at",
-				"updated_at"
-			] },
-			pagination: { maxLimit: 50 }
-		});
-		applyRealmScopeSelect(qb, "session", ["sub", "sub_kind"]);
-		if (options.owner) qb.andWhere("session.sub = :ownerSub AND session.sub_kind = :ownerSubKind", {
+		const { pagination } = applyQuery(qb, query);
+		applyRealmScopeSelect(qb, "session", ["sub", "subKind"]);
+		if (options.owner) qb.andWhere("session.sub = :ownerSub AND session.subKind = :ownerSubKind", {
 			ownerSub: options.owner.sub,
 			ownerSubKind: options.owner.subKind
 		});
@@ -68,18 +39,15 @@ var SessionRepository = class {
 		};
 	}
 	async findAllByOwner(owner) {
-		return this.repository.createQueryBuilder("session").where("session.sub = :sub AND session.sub_kind = :subKind", {
+		return this.repository.createQueryBuilder("session").where("session.sub = :sub AND session.subKind = :subKind", {
 			sub: owner.sub,
 			subKind: owner.subKind
 		}).getMany();
 	}
 	async findAllByQuery(query) {
 		const qb = this.repository.createQueryBuilder("session");
-		applyQuery(qb, query, {
-			defaultAlias: "session",
-			filters: { allowed: [...SESSION_FILTER_KEYS] }
-		});
-		applyRealmScopeSelect(qb, "session", ["sub", "sub_kind"]);
+		applyQuery(qb, query);
+		applyRealmScopeSelect(qb, "session", ["sub", "subKind"]);
 		return qb.getMany();
 	}
 	async save(input) {
@@ -88,7 +56,7 @@ var SessionRepository = class {
 		await this.cache.set(buildCacheKey({
 			prefix: AuthenticationCachePrefix.SESSION,
 			key: session.id
-		}), session, { ttl: new Date(session.expires_at).getTime() - Date.now() });
+		}), session, { ttl: new Date(session.expiresAt).getTime() - Date.now() });
 		return session;
 	}
 	async remove(session) {

package/dist/app/modules/authentication/repositories/session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","SESSION_FILTER_KEYS","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","defaultAlias","fields","allowed","filters","relations","sort","maxLimit","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expires_at","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery } from 'typeorm-extension';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { SESSION_FILTER_KEYS } from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: Record<string, any>,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query, {\n            defaultAlias: 'session',\n            fields: {\n                allowed: [\n                    'id', \n                    'sub', \n                    'sub_kind', \n                    'ip_address', \n                    'user_agent',\n                    'expires_at', \n                    'refreshed_at', \n                    'seen_at', \n                    'created_at', \n                    'updated_at',\n                    'user_id', \n                    'client_id', \n                    'robot_id', \n                    'realm_id',\n                ],\n            },\n            filters: { allowed: [...SESSION_FILTER_KEYS] },\n            relations: { allowed: ['realm'] },\n            sort: { allowed: ['seen_at', 'expires_at', 'created_at', 'updated_at'] },\n            pagination: { maxLimit: 50 },\n        });\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'sub_kind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.sub_kind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.sub_kind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: Record<string, any>): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: deliberately no `pagination` — a bulk revoke must reach every\n        // matching row. `applyQuery` with a `pagination.maxLimit` would default\n        // the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query, {\n            defaultAlias: 'session',\n            filters: { allowed: [...SESSION_FILTER_KEYS] },\n        });\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'sub_kind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expires_at).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;AA0BA,IAAaK,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BZ,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAerB,WAAWmB,IAAIF,OAAO;GACzCK,cAAc;GACdC,QAAQ,EACJC,SAAS;IACL;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;KAER;GACAC,SAAS,EAAED,SAAS,CAAA,GAAIvB,mBAAAA,EAAqB;GAC7CyB,WAAW,EAAEF,SAAS,CAAC,OAAA,EAAS;GAChCG,MAAM,EAAEH,SAAS;IAAC;IAAW;IAAc;IAAc;KAAc;GACvEH,YAAY,EAAEO,UAAU,GAAG;EAC/B,CAAA;EAEA1B,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EAExD,IAAID,QAAQW,OAERV,GAAGW,SAAS,gEAAgE;GACxEC,UAAUb,QAAQW,MAAMG;GACxBC,cAAcf,QAAQW,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMjB,GAAGkB,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGf;GACP;EACJ;CACJ;CAEA,MAAMmB,eAAeX,OAAyC;EAC1D,OAAO,KAAKvB,WAAWc,mBAAmB,SAAA,CAAA,CACrCqB,MAAM,sDAAsD;GACzDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAe1B,OAAgD;EACjE,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CpB,WAAWmB,IAAIF,OAAO;GAClBK,cAAc;GACdG,SAAS,EAAED,SAAS,CAAA,GAAIvB,mBAAAA,EAAqB;EACjD,CAAA;EAEAC,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,UAAA,CAAW;EAExD,OAAOA,GAAGuB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAMnC,UAAU,KAAKJ,WAAWwC,OAAOD,KAAAA;EACvC,MAAM,KAAKvC,WAAWsC,KAAKlC,OAAAA;EAE3B,MAAM,KAAKL,MAAM0C,IACbhD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAEsC,KAAK,IAAIC,KAAKvC,QAAQwC,UAAU,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG/D,OAAO1C;CACX;CAIA,MAAM2C,OAAO3C,SAAiC;EAC1C,MAAM,KAAKJ,WAAW+C,OAAO3C,OAAAA;EAC7B,MAAM,KAAKL,MAAMiD,KACbvD,cAAc;GACVa,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAM8C,WAAW9C,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAK2C,OAAO3C,OAAAA;CAE1B;AACJ"}
+{"version":3,"file":"session.mjs","names":["buildCacheKey","applyQuery","applyRealmScopeSelect","AuthenticationCachePrefix","SessionRepository","cache","repository","ctx","findOneById","id","session","get","prefix","SESSION","key","findOneBy","findMany","query","options","qb","createQueryBuilder","pagination","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","entities","total","getManyAndCount","data","meta","findAllByOwner","where","getMany","findAllByQuery","save","input","create","set","ttl","Date","expiresAt","getTime","now","remove","drop","removeById"],"sources":["../../../../../src/app/modules/authentication/repositories/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult, ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { Repository } from 'typeorm';\nimport { applyQuery } from '../../database/repositories/query.ts';\nimport type {\n    ISessionRepository,\n    SessionFindManyOptions,\n    SessionOwner,\n} from '../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../database/repositories/helpers.ts';\nimport { AuthenticationCachePrefix } from './constants.ts';\n\ntype SessionRepositoryContext = {\n    repository: Repository<Session>,\n    cache: ICache\n};\n\nexport class SessionRepository implements ISessionRepository {\n    protected cache : ICache;\n\n    protected repository : Repository<Session>;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionRepositoryContext) {\n        this.cache = ctx.cache;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneById(id: string): Promise<Session | null> {\n        const session = await this.cache.get<Session>(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: id, \n            }),\n        );\n\n        if (session) {\n            return session;\n        }\n\n        return this.repository.findOneBy({ id });\n    }\n\n    // -----------------------------------------------------\n\n    async findMany(\n        query: IQuery,\n        options: SessionFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Session>> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('session.sub = :ownerSub AND session.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findAllByOwner(owner: SessionOwner): Promise<Session[]> {\n        return this.repository.createQueryBuilder('session')\n            .where('session.sub = :sub AND session.subKind = :subKind', {\n                sub: owner.sub,\n                subKind: owner.subKind,\n            })\n            .getMany();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<Session[]> {\n        const qb = this.repository.createQueryBuilder('session');\n\n        // NOTE: `parameters: ['filters']` — a bulk revoke must reach every\n        // matching row. Applying the schema's `pagination.maxLimit` would\n        // default the limit to that cap when the caller sends no page (rapiq\n        // `finalizePagination`), silently truncating the delete.\n        applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'session', ['sub', 'subKind']);\n\n        return qb.getMany();\n    }\n\n    // -----------------------------------------------------\n\n    async save(input: Partial<Session>): Promise<Session> {\n        const session = this.repository.create(input);\n        await this.repository.save(session);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n            session,\n            { ttl: new Date(session.expiresAt).getTime() - Date.now() },\n        );\n\n        return session;\n    }\n\n    // -----------------------------------------------------\n\n    async remove(session: Session): Promise<void> {\n        await this.repository.remove(session);\n        await this.cache.drop(\n            buildCacheKey({\n                prefix: AuthenticationCachePrefix.SESSION,\n                key: session.id, \n            }),\n        );\n    }\n\n    async removeById(id: string): Promise<void> {\n        const session = await this.findOneById(id);\n\n        if (session) {\n            await this.remove(session);\n        }\n    }\n}\n"],"mappings":";;;;;;;;AA0BA,IAAaI,oBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA+B;EACvC,KAAKF,QAAQE,IAAIF;EACjB,KAAKC,aAAaC,IAAID;CAC1B;CAIA,MAAME,YAAYC,IAAqC;EACnD,MAAMC,UAAU,MAAM,KAAKL,MAAMM,IAC7BX,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKL;EACT,CAAA,CAAA;EAGJ,IAAIC,SACA,OAAOA;EAGX,OAAO,KAAKJ,WAAWS,UAAU,EAAEN,GAAG,CAAA;CAC1C;CAIA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAepB,WAAWkB,IAAIF,KAAAA;EAEtCf,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAA,CAAU;EAEvD,IAAID,QAAQI,OAERH,GAAGI,SAAS,+DAA+D;GACvEC,UAAUN,QAAQI,MAAMG;GACxBC,cAAcR,QAAQI,MAAMK;EAChC,CAAA;EAGJ,MAAM,CAACC,UAAUC,SAAS,MAAMV,GAAGW,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGR;GACP;EACJ;CACJ;CAEA,MAAMY,eAAeX,OAAyC;EAC1D,OAAO,KAAKhB,WAAWc,mBAAmB,SAAA,CAAA,CACrCc,MAAM,qDAAqD;GACxDT,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA,CAAA,CACCQ,QAAO;CAChB;CAEA,MAAMC,eAAenB,OAAmC;EACpD,MAAME,KAAK,KAAKb,WAAWc,mBAAmB,SAAA;EAM9CnB,WAAWkB,IAAIF,KAAAA;EAEff,sBAAsBiB,IAAI,WAAW,CAAC,OAAO,SAAA,CAAU;EAEvD,OAAOA,GAAGgB,QAAO;CACrB;CAIA,MAAME,KAAKC,OAA2C;EAClD,MAAM5B,UAAU,KAAKJ,WAAWiC,OAAOD,KAAAA;EACvC,MAAM,KAAKhC,WAAW+B,KAAK3B,OAAAA;EAE3B,MAAM,KAAKL,MAAMmC,IACbxC,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,GACAC,SACA,EAAE+B,KAAK,IAAIC,KAAKhC,QAAQiC,SAAS,CAAA,CAAEC,QAAO,IAAKF,KAAKG,IAAG,EAAG,CAAA;EAG9D,OAAOnC;CACX;CAIA,MAAMoC,OAAOpC,SAAiC;EAC1C,MAAM,KAAKJ,WAAWwC,OAAOpC,OAAAA;EAC7B,MAAM,KAAKL,MAAM0C,KACb/C,cAAc;GACVY,QAAQT,0BAA0BU;GAClCC,KAAKJ,QAAQD;EACjB,CAAA,CAAA;CAER;CAEA,MAAMuC,WAAWvC,IAA2B;EACxC,MAAMC,UAAU,MAAM,KAAKF,YAAYC,EAAAA;EAEvC,IAAIC,SACA,MAAM,KAAKoC,OAAOpC,OAAAA;CAE1B;AACJ"}

package/dist/app/modules/components/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAYpD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/components/module.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,gBAAiB,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA+BpD"}

package/dist/app/modules/components/module.mjs

@@ -2,10 +2,15 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ModuleName } from "../constants.mjs";
+import { ConfigInjectionKey } from "../config/constants.mjs";
+import "../config/index.mjs";
 import { createDatabaseUniqueEntriesComponent } from "../../../components/database/unique-entries/factory.mjs";
+import { createEventCleanerComponent } from "../../../components/event-cleaner/module.mjs";
 import { createOAuth2CleanerComponent } from "../../../components/oauth2-cleaner/module.mjs";
 import "../../../components/index.mjs";
 import { DatabaseInjectionKey } from "../database/constants.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
 import "../database/index.mjs";
 //#region src/app/modules/components/module.ts
 var ComponentsModule = class {
@@ -13,11 +18,26 @@ var ComponentsModule = class {
 	dependencies;
 	constructor() {
 		this.name = ModuleName.COMPONENTS;
-		this.dependencies = [ModuleName.DATABASE];
+		this.dependencies = [
+			ModuleName.CONFIG,
+			ModuleName.LOGGER,
+			ModuleName.DATABASE
+		];
 	}
 	async setup(container) {
+		const config = container.resolve(ConfigInjectionKey);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
-		[createOAuth2CleanerComponent(dataSource), createDatabaseUniqueEntriesComponent(dataSource)].forEach((component) => component.start());
+		const logger = container.resolve(LoggerInjectionKey);
+		const components = [createOAuth2CleanerComponent(dataSource, logger), createDatabaseUniqueEntriesComponent(dataSource)];
+		const securitySweep = config.eventLogRetentionDays > 0;
+		const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;
+		if (config.eventLogEnabled && (securitySweep || entitySweep)) components.push(createEventCleanerComponent(dataSource, logger));
+		components.forEach((component) => {
+			component.start().catch((e) => {
+				logger.error("Starting a background component failed.");
+				logger.error(e);
+			});
+		});
 	}
 };
 //#endregion

package/dist/app/modules/components/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createDatabaseUniqueEntriesComponent","createOAuth2CleanerComponent","DatabaseInjectionKey","ModuleName","ComponentsModule","name","dependencies","COMPONENTS","DATABASE","setup","container","dataSource","resolve","DataSource","components","forEach","component","start"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport { createDatabaseUniqueEntriesComponent, createOAuth2CleanerComponent } from '../../../components/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [ModuleName.DATABASE];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const components: Component[] = [\n            createOAuth2CleanerComponent(dataSource),\n            createDatabaseUniqueEntriesComponent(dataSource),\n        ];\n\n        components.forEach((component) => component.start());\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;AAcA,IAAaI,mBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOF,WAAWI;EACvB,KAAKD,eAAe,CAACH,WAAWK,QAAAA;CACpC;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,aAAaD,UAAUE,QAAQV,qBAAqBW,UAAU;EAOpEC,CAJIb,6BAA6BU,UAAAA,GAC7BX,qCAAqCW,UAAAA,CAGzCG,CAAAA,CAAWC,SAASC,cAAcA,UAAUC,MAAK,CAAA;CACrD;AAGJ"}
+{"version":3,"file":"module.mjs","names":["createDatabaseUniqueEntriesComponent","createEventCleanerComponent","createOAuth2CleanerComponent","ConfigInjectionKey","DatabaseInjectionKey","LoggerInjectionKey","ModuleName","ComponentsModule","name","dependencies","COMPONENTS","CONFIG","LOGGER","DATABASE","setup","container","config","resolve","dataSource","DataSource","logger","components","securitySweep","eventLogRetentionDays","entitySweep","eventLogEntityEnabled","eventLogEntityRetentionDays","eventLogEnabled","push","forEach","component","start","catch","e","error"],"sources":["../../../../src/app/modules/components/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Component } from '../../../components/index.ts';\nimport {\n    createDatabaseUniqueEntriesComponent,\n    createEventCleanerComponent,\n    createOAuth2CleanerComponent,\n} from '../../../components/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class ComponentsModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.COMPONENTS;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.DATABASE];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        const components: Component[] = [\n            createOAuth2CleanerComponent(dataSource, logger),\n            createDatabaseUniqueEntriesComponent(dataSource),\n        ];\n\n        // The sweep only exists when rows are written AND at least one row\n        // family carries an expiry — security events (eventLogRetentionDays)\n        // and entity-CRUD events (eventLogEntityRetentionDays) are stamped\n        // independently, so either non-zero retention needs the cleaner.\n        const securitySweep = config.eventLogRetentionDays > 0;\n        const entitySweep = config.eventLogEntityEnabled && config.eventLogEntityRetentionDays > 0;\n        if (config.eventLogEnabled && (securitySweep || entitySweep)) {\n            components.push(createEventCleanerComponent(dataSource, logger));\n        }\n\n        // start() is deliberately fire-and-forget, so a rejection must be\n        // caught here — an unhandled rejection is fatal on modern node.\n        components.forEach((component) => {\n            component.start().catch((e) => {\n                logger.error('Starting a background component failed.');\n                logger.error(e);\n            });\n        });\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoBA,IAAaO,mBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOF,WAAWI;EACvB,KAAKD,eAAe;GAACH,WAAWK;GAAQL,WAAWM;GAAQN,WAAWO;;CAC1E;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQd,kBAAAA;EACjC,MAAMe,aAAaH,UAAUE,QAAQb,qBAAqBe,UAAU;EACpE,MAAMC,SAASL,UAAUE,QAAQZ,kBAAAA;EAEjC,MAAMgB,aAA0B,CAC5BnB,6BAA6BgB,YAAYE,MAAAA,GACzCpB,qCAAqCkB,UAAAA,CAAAA;EAOzC,MAAMI,gBAAgBN,OAAOO,wBAAwB;EACrD,MAAMC,cAAcR,OAAOS,yBAAyBT,OAAOU,8BAA8B;EACzF,IAAIV,OAAOW,oBAAoBL,iBAAiBE,cAC5CH,WAAWO,KAAK3B,4BAA4BiB,YAAYE,MAAAA,CAAAA;EAK5DC,WAAWQ,SAASC,cAAAA;GAChBA,UAAUC,MAAK,CAAA,CAAGC,OAAOC,MAAAA;IACrBb,OAAOc,MAAM,yCAAA;IACbd,OAAOc,MAAMD,CAAAA;GACjB,CAAA;EACJ,CAAA;CACJ;AAGJ"}

package/dist/app/modules/config/constants.d.ts

@@ -9,6 +9,8 @@ export declare enum ConfigEnvironmentVariableName {
     HOST = "HOST",
     PORT = "PORT",
     PUBLIC_URL = "PUBLIC_URL",
+    MTLS_PUBLIC_URL = "MTLS_PUBLIC_URL",
+    CERTIFICATE_SOURCE = "CERTIFICATE_SOURCE",
     TRUSTED_ORIGINS = "TRUSTED_ORIGINS",
     TOKEN_ACCESS_MAX_AGE = "TOKEN_ACCESS_MAX_AGE",
     TOKEN_REFRESH_MAX_AGE = "TOKEN_REFRESH_MAX_AGE",
@@ -19,6 +21,18 @@ export declare enum ConfigEnvironmentVariableName {
     EMAIL_VERIFICATION_ENABLED = "EMAIL_VERIFICATION_ENABLED",
     PASSWORD_RECOVERY_ENABLED = "PASSWORD_RECOVERY_ENABLED",
     PASSWORD_MIN_LENGTH = "PASSWORD_MIN_LENGTH",
+    EVENT_LOG_ENABLED = "EVENT_LOG_ENABLED",
+    EVENT_LOG_RETENTION_DAYS = "EVENT_LOG_RETENTION_DAYS",
+    EVENT_LOG_ENTITY_ENABLED = "EVENT_LOG_ENTITY_ENABLED",
+    EVENT_LOG_ENTITY_RETENTION_DAYS = "EVENT_LOG_ENTITY_RETENTION_DAYS",
+    LOGIN_ATTEMPT_THROTTLE_ENABLED = "LOGIN_ATTEMPT_THROTTLE_ENABLED",
+    LOGIN_ATTEMPT_THRESHOLD = "LOGIN_ATTEMPT_THRESHOLD",
+    LOGIN_ATTEMPT_WINDOW = "LOGIN_ATTEMPT_WINDOW",
+    SECRETS_ENCRYPTION_KEY = "SECRETS_ENCRYPTION_KEY",
+    MFA_ENABLED = "MFA_ENABLED",
+    MFA_REQUIRED = "MFA_REQUIRED",
+    MFA_FRESHNESS_MAX_AGE = "MFA_FRESHNESS_MAX_AGE",
+    MFA_TICKET_MAX_AGE = "MFA_TICKET_MAX_AGE",
     CLIENT_AUTH_BASIC = "CLIENT_AUTH_BASIC",
     CLIENT_SYSTEM_ENABLED = "CLIENT_SYSTEM_ENABLED",
     CLIENT_SYSTEM_SECRET = "CLIENT_SYSTEM_SECRET",
@@ -27,10 +41,6 @@ export declare enum ConfigEnvironmentVariableName {
     USER_ADMIN_ENABLED = "USER_ADMIN_ENABLED",
     USER_ADMIN_PASSWORD = "USER_ADMIN_PASSWORD",
     USER_ADMIN_PASSWORD_RESET = "USER_ADMIN_PASSWORD_RESET",
-    ROBOT_AUTH_BASIC = "ROBOT_AUTH_BASIC",
-    ROBOT_ADMIN_ENABLED = "ROBOT_ADMIN_ENABLED",
-    ROBOT_ADMIN_SECRET = "ROBOT_ADMIN_SECRET",
-    ROBOT_ADMIN_SECRET_RESET = "ROBOT_ADMIN_SECRET_RESET",
     PERMISSIONS = "PERMISSIONS",
     PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = "PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"
 }

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -12,6 +12,8 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["HOST"] = "HOST";
 	ConfigEnvironmentVariableName["PORT"] = "PORT";
 	ConfigEnvironmentVariableName["PUBLIC_URL"] = "PUBLIC_URL";
+	ConfigEnvironmentVariableName["MTLS_PUBLIC_URL"] = "MTLS_PUBLIC_URL";
+	ConfigEnvironmentVariableName["CERTIFICATE_SOURCE"] = "CERTIFICATE_SOURCE";
 	ConfigEnvironmentVariableName["TRUSTED_ORIGINS"] = "TRUSTED_ORIGINS";
 	ConfigEnvironmentVariableName["TOKEN_ACCESS_MAX_AGE"] = "TOKEN_ACCESS_MAX_AGE";
 	ConfigEnvironmentVariableName["TOKEN_REFRESH_MAX_AGE"] = "TOKEN_REFRESH_MAX_AGE";
@@ -22,6 +24,18 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["EMAIL_VERIFICATION_ENABLED"] = "EMAIL_VERIFICATION_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_RECOVERY_ENABLED"] = "PASSWORD_RECOVERY_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_MIN_LENGTH"] = "PASSWORD_MIN_LENGTH";
+	ConfigEnvironmentVariableName["EVENT_LOG_ENABLED"] = "EVENT_LOG_ENABLED";
+	ConfigEnvironmentVariableName["EVENT_LOG_RETENTION_DAYS"] = "EVENT_LOG_RETENTION_DAYS";
+	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_ENABLED"] = "EVENT_LOG_ENTITY_ENABLED";
+	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_RETENTION_DAYS"] = "EVENT_LOG_ENTITY_RETENTION_DAYS";
+	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_THROTTLE_ENABLED"] = "LOGIN_ATTEMPT_THROTTLE_ENABLED";
+	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_THRESHOLD"] = "LOGIN_ATTEMPT_THRESHOLD";
+	ConfigEnvironmentVariableName["LOGIN_ATTEMPT_WINDOW"] = "LOGIN_ATTEMPT_WINDOW";
+	ConfigEnvironmentVariableName["SECRETS_ENCRYPTION_KEY"] = "SECRETS_ENCRYPTION_KEY";
+	ConfigEnvironmentVariableName["MFA_ENABLED"] = "MFA_ENABLED";
+	ConfigEnvironmentVariableName["MFA_REQUIRED"] = "MFA_REQUIRED";
+	ConfigEnvironmentVariableName["MFA_FRESHNESS_MAX_AGE"] = "MFA_FRESHNESS_MAX_AGE";
+	ConfigEnvironmentVariableName["MFA_TICKET_MAX_AGE"] = "MFA_TICKET_MAX_AGE";
 	ConfigEnvironmentVariableName["CLIENT_AUTH_BASIC"] = "CLIENT_AUTH_BASIC";
 	ConfigEnvironmentVariableName["CLIENT_SYSTEM_ENABLED"] = "CLIENT_SYSTEM_ENABLED";
 	ConfigEnvironmentVariableName["CLIENT_SYSTEM_SECRET"] = "CLIENT_SYSTEM_SECRET";
@@ -30,10 +44,6 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["USER_ADMIN_ENABLED"] = "USER_ADMIN_ENABLED";
 	ConfigEnvironmentVariableName["USER_ADMIN_PASSWORD"] = "USER_ADMIN_PASSWORD";
 	ConfigEnvironmentVariableName["USER_ADMIN_PASSWORD_RESET"] = "USER_ADMIN_PASSWORD_RESET";
-	ConfigEnvironmentVariableName["ROBOT_AUTH_BASIC"] = "ROBOT_AUTH_BASIC";
-	ConfigEnvironmentVariableName["ROBOT_ADMIN_ENABLED"] = "ROBOT_ADMIN_ENABLED";
-	ConfigEnvironmentVariableName["ROBOT_ADMIN_SECRET"] = "ROBOT_ADMIN_SECRET";
-	ConfigEnvironmentVariableName["ROBOT_ADMIN_SECRET_RESET"] = "ROBOT_ADMIN_SECRET_RESET";
 	ConfigEnvironmentVariableName["PERMISSIONS"] = "PERMISSIONS";
 	ConfigEnvironmentVariableName["PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT"] = "PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT";
 	return ConfigEnvironmentVariableName;

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyG9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJ9E"}