@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/identity/resolver/module.d.ts

@@ -1,11 +1,10 @@
 import type { Identity } from '@authup/core-kit';
 import { IdentityType } from '@authup/core-kit';
 import type { IIdentityResolver, IdentityResolverContext } from './types.ts';
-import type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
+import type { IClientIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
 export declare class IdentityResolver implements IIdentityResolver {
     protected clientRepository: IClientIdentityRepository;
     protected userRepository: IUserIdentityRepository;
-    protected robotRepository: IRobotIdentityRepository;
     constructor(ctx: IdentityResolverContext);
     /**
      * A UUID key is resolved globally by primary key — `realmKey` scopes NAME
@@ -16,7 +15,6 @@ export declare class IdentityResolver implements IIdentityResolver {
      */
     resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;
     private resolveClient;
-    private resolveRobot;
     private resolveUser;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/identity/resolver/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEzH,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC;gBAExC,GAAG,EAAE,uBAAuB;IAMxC;;;;;;OAMG;IACG,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAgBb,aAAa;YAsBb,YAAY;YAsBZ,WAAW;CAqB5B"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAGX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;gBAEtC,GAAG,EAAE,uBAAuB;IAKxC;;;;;;OAMG;IACG,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAab,aAAa;YAsBb,WAAW;CAqB5B"}

package/dist/core/identity/resolver/module.mjs

@@ -7,11 +7,9 @@ import { IdentityType } from "@authup/core-kit";
 var IdentityResolver = class {
 	clientRepository;
 	userRepository;
-	robotRepository;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
 		this.userRepository = ctx.userRepository;
-		this.robotRepository = ctx.robotRepository;
 	}
 	/**
 	* A UUID key is resolved globally by primary key — `realmKey` scopes NAME
@@ -22,7 +20,6 @@ var IdentityResolver = class {
 	*/ async resolve(type, key, realmKey) {
 		switch (type) {
 			case IdentityType.CLIENT: return this.resolveClient(key, realmKey);
-			case IdentityType.ROBOT: return this.resolveRobot(key, realmKey);
 			case IdentityType.USER: return this.resolveUser(key, realmKey);
 		}
 		return null;
@@ -37,16 +34,6 @@ var IdentityResolver = class {
 		};
 		return null;
 	}
-	async resolveRobot(key, realmKey) {
-		let data;
-		if (isUUID(key)) data = await this.robotRepository.findOneById(key);
-		else data = await this.robotRepository.findOneByName(key, realmKey);
-		if (data) return {
-			type: IdentityType.ROBOT,
-			data
-		};
-		return null;
-	}
 	async resolveUser(key, realmKey) {
 		let data;
 		if (isUUID(key)) data = await this.userRepository.findOneById(key);

package/dist/core/identity/resolver/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    /**\n     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME\n     * resolution only (UUIDs are globally unique, and the realm hint on the\n     * password grant is always set via the master fallback, so applying it to\n     * UUID keys would break realm-less id-identified logins). See\n     * architecture.md → Password grant realm resolution.\n     */\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;;IASA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n    }\n\n    /**\n     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME\n     * resolution only (UUIDs are globally unique, and the realm hint on the\n     * password grant is always set via the master fallback, so applying it to\n     * UUID keys would break realm-less id-identified logins). See\n     * architecture.md → Password grant realm resolution.\n     */\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,iBAAiBC,IAAID;CAC9B;;;;;;;IASA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKP,aAAaU,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKT,aAAaY,MACd,OAAO,KAAKC,YAAYL,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIK;EAEJ,IAAIb,OAAOO,GAAAA,GACPM,OAAO,MAAM,KAAKX,iBAAiBY,YAAYP,GAAAA;OAE/CM,OAAO,MAAM,KAAKX,iBAAiBa,cAAcR,KAAKC,QAAAA;EAG1D,IAAIK,MACA,OAAO;GACHP,MAAMP,aAAaU;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVL,KACAC,UAC6B;EAC7B,IAAIK;EAEJ,IAAIb,OAAOO,GAAAA,GACPM,OAAO,MAAM,KAAKV,eAAeW,YAAYP,GAAAA;OAE7CM,OAAO,MAAM,KAAKV,eAAeY,cAAcR,KAAKC,QAAAA;EAGxD,IAAIK,MACA,OAAO;GACHP,MAAMP,aAAaY;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}

package/dist/core/identity/resolver/types.d.ts

@@ -1,9 +1,8 @@
 import type { Identity, IdentityType } from '@authup/core-kit';
-import type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
+import type { IClientIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
 export type IdentityResolverContext = {
     clientRepository: IClientIdentityRepository;
     userRepository: IUserIdentityRepository;
-    robotRepository: IRobotIdentityRepository;
 };
 export interface IIdentityResolver {
     resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;

package/dist/core/identity/resolver/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACR,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,uBAAuB,GAAG;IAClC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,cAAc,EAAE,uBAAuB,CAAC;IACxC,eAAe,EAAE,wBAAwB,CAAA;CAC5C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAC9B,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;CAC9F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACR,yBAAyB,EACzB,uBAAuB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,uBAAuB,GAAG;IAClC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,cAAc,EAAE,uBAAuB,CAAA;CAC1C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAC9B,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;CAC9F"}

package/dist/core/identity/role/module.d.ts

@@ -1,13 +1,11 @@
 import type { Role } from '@authup/core-kit';
 import type { IdentityPolicyData } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 import type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';
 export declare class IdentityRoleProvider implements IIdentityRoleProvider {
     protected clientRepository: IClientRepository;
     protected userRepository: IUserRepository;
-    protected robotRepository: IRobotRepository;
     constructor(ctx: IdentityRoleProviderContext);
     getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
     private reduceByIdentityClient;

package/dist/core/identity/role/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAiBjC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;gBAE9B,GAAG,EAAE,2BAA2B;IAKtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAcjE,OAAO,CAAC,sBAAsB;CAiBjC"}

package/dist/core/identity/role/module.mjs

@@ -5,23 +5,20 @@ import.meta.url;
 var IdentityRoleProvider = class {
 	clientRepository;
 	userRepository;
-	robotRepository;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
 		this.userRepository = ctx.userRepository;
-		this.robotRepository = ctx.robotRepository;
 	}
 	async getRolesFor(identity) {
 		switch (identity.type) {
 			case "client": return this.clientRepository.getBoundRoles(identity.id);
 			case "user": return this.userRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
-			case "robot": return this.robotRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
 		}
 		return [];
 	}
 	reduceByIdentityClient(entities, identity) {
 		if (!identity.clientId) return entities;
-		return entities.filter((entity) => !entity.client_id || entity.client_id === identity.clientId);
+		return entities.filter((entity) => !entity.clientId || entity.clientId === identity.clientId);
 	}
 };
 //#endregion

package/dist/core/identity/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        // Keep client-agnostic (global / realm) roles — client_id null — in\n        // addition to roles scoped to the authenticating client. Dropping the\n        // null case stripped every global/realm role from a token issued via\n        // a real client (e.g. the per-realm `web` client used by the\n        // realm-selection login), leaving permissions/roles empty.\n        return entities.filter(\n            (entity) => !entity.client_id || entity.client_id === identity.clientId,\n        );\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAQX,OAAOA,SAASE,QACXC,WAAW,CAACA,OAAOC,aAAaD,OAAOC,cAAcX,SAASQ,QAAQ;CAE/E;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { clientId?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        // Keep client-agnostic (global / realm) roles — clientId null — in\n        // addition to roles scoped to the authenticating client. Dropping the\n        // null case stripped every global/realm role from a token issued via\n        // a real client (e.g. the per-realm `web` client used by the\n        // realm-selection login), leaving permissions/roles empty.\n        return entities.filter(\n            (entity) => !entity.clientId || entity.clientId === identity.clientId,\n        );\n    }\n}\n"],"mappings":";;;;AAaA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKL,iBAAiBM,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKN,eAAeK,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAQX,OAAOA,SAASE,QACXC,WAAW,CAACA,OAAOF,YAAYE,OAAOF,aAAaR,SAASQ,QAAQ;CAE7E;AACJ"}

package/dist/core/identity/role/types.d.ts

@@ -1,7 +1,6 @@
 import type { Role } from '@authup/core-kit';
 import type { IdentityPolicyData } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 export interface IIdentityRoleProvider {
     getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
@@ -9,6 +8,5 @@ export interface IIdentityRoleProvider {
 export type IdentityRoleProviderContext = {
     clientRepository: IClientRepository;
     userRepository: IUserRepository;
-    robotRepository: IRobotRepository;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/role/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IAClC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC9D;AAED,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IAClC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC9D;AAED,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;CACnC,CAAC"}

package/dist/core/index.d.ts

@@ -1,9 +1,13 @@
 export * from './authentication/index.ts';
+export * from './client-certificate/index.ts';
 export * from './entities/index.ts';
+export * from './key/index.ts';
 export * from './mail/index.ts';
+export * from './metrics/index.ts';
 export * from './oauth2/index.ts';
 export * from './identity/index.ts';
 export * from './ldap/index.ts';
 export * from './provisioning/index.ts';
+export * from './query/index.ts';
 export * from './security/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/core/index.mjs

@@ -1,54 +1,107 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./entities/consent/types.mjs";
 import { ClientCredentialsService } from "./authentication/credential/entities/client/module.mjs";
-import { RobotCredentialsService } from "./authentication/credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "./authentication/credential/entities/user/module.mjs";
 import { BaseCredentialsAuthenticator } from "./authentication/base.mjs";
 import { ClientAuthenticator } from "./authentication/entities/client/module.mjs";
-import { RobotAuthenticator } from "./authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
+import { LoginThrottleService } from "./authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
 import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
+import { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain } from "./client-certificate/module.mjs";
+import "./client-certificate/index.mjs";
+import { createRelationsReadGate } from "./query/relations.mjs";
+import { clientSchema } from "./entities/client/schema.mjs";
+import { clientPermissionSchema } from "./entities/client-permission/schema.mjs";
+import { clientRoleSchema } from "./entities/client-role/schema.mjs";
+import { clientScopeSchema } from "./entities/client-scope/schema.mjs";
+import { consentSchema } from "./entities/consent/schema.mjs";
+import { eventSchema } from "./entities/event/schema.mjs";
+import { identityProviderSchema } from "./entities/identity-provider/schema.mjs";
+import { identityProviderRoleMappingSchema } from "./entities/identity-provider-role-mapping/schema.mjs";
+import { keySchema } from "./entities/key/schema.mjs";
+import { permissionSchema } from "./entities/permission/schema.mjs";
+import { permissionPolicySchema } from "./entities/permission-policy/schema.mjs";
+import { policySchema } from "./entities/policy/schema.mjs";
+import { realmSchema } from "./entities/realm/schema.mjs";
+import { roleSchema } from "./entities/role/schema.mjs";
+import { roleAttributeSchema } from "./entities/role-attribute/schema.mjs";
+import { rolePermissionSchema } from "./entities/role-permission/schema.mjs";
+import { scopeSchema } from "./entities/scope/schema.mjs";
+import { sessionSchema } from "./entities/session/schema.mjs";
+import { trustAnchorSchema } from "./entities/trust-anchor/schema.mjs";
+import { userSchema } from "./entities/user/schema.mjs";
+import { userAttributeSchema } from "./entities/user-attribute/schema.mjs";
+import { userAuthenticatorSchema } from "./entities/user-authenticator/schema.mjs";
+import { userPermissionSchema } from "./entities/user-permission/schema.mjs";
+import { userRoleSchema } from "./entities/user-role/schema.mjs";
+import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./query/module.mjs";
+import "./query/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
 import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./identity/permission/junction-grant.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
 import { ClientScopeService } from "./entities/client-scope/service.mjs";
+import { ConsentService } from "./entities/consent/service.mjs";
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./entities/event/constants.mjs";
+import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./entities/event/diff.mjs";
+import { EntityEventHandler } from "./entities/event/entity-event-handler.mjs";
+import { sanitizeEventData } from "./entities/event/sanitize.mjs";
+import { EventService } from "./entities/event/service.mjs";
+import { REALM_CIPHER_BLOB_ERROR_INSTANCE, RealmCipherBlobError } from "./key/error.mjs";
+import { isRealmCipherBlobError } from "./key/check.mjs";
+import { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError } from "./key/certificate-error.mjs";
+import { assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, parseCertificateChain } from "./key/certificate.mjs";
+import { REALM_CIPHER_BLOB_VERSION, WRAPPED_KEY_MATERIAL_PREFIX } from "./key/constants.mjs";
+import { KeyProvisioner } from "./key/provisioner.mjs";
+import { RealmCipher } from "./key/realm-cipher.mjs";
+import { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial } from "./key/wrap.mjs";
+import "./key/index.mjs";
+import { KeyService } from "./entities/key/service.mjs";
 import { PermissionService } from "./entities/permission/service.mjs";
 import { PermissionPolicyService } from "./entities/permission-policy/service.mjs";
 import { PolicyService } from "./entities/policy/service.mjs";
 import { RealmService } from "./entities/realm/service.mjs";
-import { RobotService } from "./entities/robot/service.mjs";
-import { RobotPermissionService } from "./entities/robot-permission/service.mjs";
-import { RobotRoleService } from "./entities/robot-role/service.mjs";
 import { RoleService } from "./entities/role/service.mjs";
 import { RoleAttributeService } from "./entities/role-attribute/service.mjs";
 import { RolePermissionService } from "./entities/role-permission/service.mjs";
 import { ScopeService } from "./entities/scope/service.mjs";
 import { SessionService } from "./entities/session/service.mjs";
+import { TrustAnchorService } from "./entities/trust-anchor/service.mjs";
 import { UserService } from "./entities/user/service.mjs";
 import { UserAttributeService } from "./entities/user-attribute/service.mjs";
-import { UserPermissionService } from "./entities/user-permission/service.mjs";
-import { UserRoleService } from "./entities/user-role/service.mjs";
-import { IdentityProviderRoleMappingService } from "./entities/identity-provider-role-mapping/service.mjs";
-import "./entities/index.mjs";
+import { USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX } from "./entities/user-authenticator/constants.mjs";
+import { generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse } from "./entities/user-authenticator/helpers.mjs";
 import { defineMailTemplate } from "./mail/template/define.mjs";
 import { MailTemplateName } from "./mail/template/types.mjs";
 import { MAIL_TEMPLATE_REGISTRY } from "./mail/template/registry.mjs";
 import { MailTemplateRenderer } from "./mail/renderer.mjs";
 import "./mail/index.mjs";
+import { buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, verifyWebauthnAuthentication, verifyWebauthnRegistration } from "./entities/user-authenticator/webauthn.mjs";
+import { UserAuthenticatorService } from "./entities/user-authenticator/service.mjs";
+import { USER_AUTHENTICATOR_FILTER_KEYS } from "./entities/user-authenticator/types.mjs";
+import { UserPermissionService } from "./entities/user-permission/service.mjs";
+import { UserRoleService } from "./entities/user-role/service.mjs";
+import { IdentityProviderRoleMappingService } from "./entities/identity-provider-role-mapping/service.mjs";
+import "./entities/index.mjs";
+import { NoopAuthFlowMetrics } from "./metrics/noop.mjs";
+import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
+import { PolicyEngine } from "./security/policy/engine.mjs";
+import { OAuth2AccessPolicyEvaluator } from "./oauth2/access-policy/module.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./oauth2/authorization/code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./oauth2/authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./oauth2/authorization/code/verifier/module.mjs";
 import { OAuth2ClientAuthenticator } from "./oauth2/client/authenticator.mjs";
 import { assertClientGrantAllowed } from "./oauth2/client/grant-type.mjs";
 import { OAuth2AuthorizationCodeRequestVerifier } from "./oauth2/authorization/code-request/verifier/module.mjs";
 import { OAuth2AuthorizationCodeRequestValidator } from "./oauth2/authorization/code-request/validator.mjs";
 import { OAuth2AuthorizationStateManager } from "./oauth2/authorization/state/module.mjs";
+import { toIdentityPolicyData } from "./identity/permission/identity-policy-data.mjs";
 import { OAuth2Authorization } from "./oauth2/authorization/module.mjs";
 import { OAuth2EndSessionService } from "./oauth2/end-session/service.mjs";
 import { OAuth2EndSessionRequestValidator } from "./oauth2/end-session/validator.mjs";
@@ -58,10 +111,11 @@ import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.
 import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { PasswordGrantType } from "./oauth2/grant-types/password.mjs";
 import { OAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh-token.mjs";
-import { RobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
+import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./oauth2/openid/claims.mjs";
 import { OAuth2ScopeAttributesResolver } from "./oauth2/scope/resolver.mjs";
 import { OAuth2AccessTokenIssuer } from "./oauth2/token/issuer/access/module.mjs";
+import { OAuth2MfaTokenIssuer } from "./oauth2/token/issuer/mfa/module.mjs";
 import { OAuth2OpenIDTokenIssuer } from "./oauth2/token/issuer/open-id/module.mjs";
 import { OAuth2RefreshTokenIssuer } from "./oauth2/token/issuer/refresh/module.mjs";
 import { OAuth2TokenRevoker } from "./oauth2/token/revoker/module.mjs";
@@ -70,8 +124,6 @@ import { OAuth2TokenVerifier } from "./oauth2/token/verifier/module.mjs";
 import "./oauth2/index.mjs";
 import { PASSWORD_RESET_EXPIRES_IN_MINUTES } from "./identity/password-recovery/constants.mjs";
 import { PasswordRecoveryService } from "./identity/password-recovery/service.mjs";
-import { PermissionBindingPolicyEvaluator } from "./security/policy/evaluator.mjs";
-import { PolicyEngine } from "./security/policy/engine.mjs";
 import { PermissionCheckerService } from "./identity/permission/checker/service.mjs";
 import { IdentityPermissionProvider } from "./identity/permission/module.mjs";
 import { PolicyCheckerService } from "./identity/policy/checker/service.mjs";
@@ -105,7 +157,6 @@ import { RoleProvisioningValidator } from "./provisioning/entities/role/validato
 import { createProvisioningEntitiesValidator } from "./provisioning/entities/utils.mjs";
 import { ClientProvisioningValidator } from "./provisioning/entities/client/validator.mjs";
 import { PolicyProvisioningValidator } from "./provisioning/entities/policy/validator.mjs";
-import { RobotProvisioningValidator } from "./provisioning/entities/robot/validator.mjs";
 import { ScopeProvisioningValidator } from "./provisioning/entities/scope/validator.mjs";
 import { UserProvisioningValidator } from "./provisioning/entities/user/validator.mjs";
 import { RealmProvisioningValidator } from "./provisioning/entities/realm/validator.mjs";
@@ -118,9 +169,8 @@ import { PolicyProvisioningSynchronizer } from "./provisioning/synchronizer/poli
 import { RealmProvisioningSynchronizer } from "./provisioning/synchronizer/realm/module.mjs";
 import { RoleProvisioningSynchronizer } from "./provisioning/synchronizer/role/module.mjs";
 import { GraphProvisioningSynchronizer } from "./provisioning/synchronizer/root/module.mjs";
-import { RobotProvisioningSynchronizer } from "./provisioning/synchronizer/robot/module.mjs";
 import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, CredentialsAuthenticator, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, UserAttributeService, UserAuthenticator, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WebClientProvisioner, applyJunctionCreateGrant, assertClientGrantAllowed, base64URLEncode, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, defineMailTemplate, generateOAuth2CodeVerifier, normalizeEntityProvisioningStrategy };
+export { BaseCredentialsAuthenticator, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, eventSchema, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/key/certificate-error.d.ts

@@ -0,0 +1,10 @@
+import { AuthupError } from '@authup/errors';
+export declare const KEY_CERTIFICATE_ERROR_INSTANCE: unique symbol;
+/**
+ * Certificate parsing/key-association failure independent of any transport.
+ * API-facing services may translate this to their own boundary error.
+ */
+export declare class KeyCertificateError extends AuthupError {
+    constructor(message: string);
+}
+//# sourceMappingURL=certificate-error.d.ts.map

package/dist/core/key/certificate-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate-error.d.ts","sourceRoot":"","sources":["../../../src/core/key/certificate-error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAE7D,eAAO,MAAM,8BAA8B,eAAwD,CAAC;AAEpG;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;gBACpC,OAAO,EAAE,MAAM;CAI9B"}

package/dist/core/key/certificate-error.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthupError, markInstanceof } from "@authup/errors";
+//#region src/core/key/certificate-error.ts
+const KEY_CERTIFICATE_ERROR_INSTANCE = Symbol.for("@authup/server-core/KeyCertificateError");
+/**
+* Certificate parsing/key-association failure independent of any transport.
+* API-facing services may translate this to their own boundary error.
+*/ var KeyCertificateError = class extends AuthupError {
+	constructor(message) {
+		super({ message });
+		markInstanceof(this, KEY_CERTIFICATE_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError };
+
+//# sourceMappingURL=certificate-error.mjs.map

package/dist/core/key/certificate-error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate-error.mjs","names":["AuthupError","markInstanceof","KEY_CERTIFICATE_ERROR_INSTANCE","Symbol","for","KeyCertificateError","message"],"sources":["../../../src/core/key/certificate-error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, markInstanceof } from '@authup/errors';\n\nexport const KEY_CERTIFICATE_ERROR_INSTANCE = Symbol.for('@authup/server-core/KeyCertificateError');\n\n/**\n * Certificate parsing/key-association failure independent of any transport.\n * API-facing services may translate this to their own boundary error.\n */\nexport class KeyCertificateError extends AuthupError {\n    constructor(message: string) {\n        super({ message });\n        markInstanceof(this, KEY_CERTIFICATE_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaE,iCAAiCC,OAAOC,IAAI,yCAAA;;;;GAMzD,IAAaC,sBAAb,cAAyCL,YAAAA;CACrC,YAAYM,SAAiB;EACzB,MAAM,EAAEA,QAAQ,CAAA;EAChBL,eAAe,MAAMC,8BAAAA;CACzB;AACJ"}

package/dist/core/key/certificate.d.ts

@@ -0,0 +1,15 @@
+import { X509Certificate } from 'node:crypto';
+import type { OAuth2JsonWebKey } from '@authup/specs';
+export declare function parseCertificateChain(pem: string): X509Certificate[];
+export declare function assertCertificateMatchesKey(chain: X509Certificate[], spkiBase64: string): void;
+export declare function buildX5c(chain: X509Certificate[]): string[];
+export declare function buildX5tS256(chain: X509Certificate[]): Promise<string>;
+/**
+ * Derive the RFC 7517 x5c / x5t#S256 JWK members from a stored PEM chain.
+ *
+ * Fail-open by design: one malformed legacy/database row must not take down
+ * the whole realm's JWKS — the usable public key is still published, just
+ * without the certificate members.
+ */
+export declare function buildCertificateJwkFields(certificate: string | null): Promise<Partial<Pick<OAuth2JsonWebKey, 'x5c' | 'x5t#S256'>>>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/core/key/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../../src/core/key/certificate.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,eAAe,EAElB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAWpE;AAED,wBAAgB,2BAA2B,CACvC,KAAK,EAAE,eAAe,EAAE,EACxB,UAAU,EAAE,MAAM,GACnB,IAAI,CA4BN;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,CAE3D;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5E;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC3C,WAAW,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAc9D"}

package/dist/core/key/certificate.mjs

@@ -0,0 +1,72 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { KeyCertificateError } from "./certificate-error.mjs";
+import { base64URLEncode } from "@authup/kit";
+import { ValidationError } from "@authup/errors";
+import { X509Certificate, createPublicKey } from "node:crypto";
+import { subtle } from "uncrypto";
+//#region src/core/key/certificate.ts
+const CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+function parseCertificateChain(pem) {
+	const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);
+	if (!blocks || blocks.length === 0) throw new ValidationError("The certificate chain could not be parsed.");
+	try {
+		return blocks.map((block) => new X509Certificate(block));
+	} catch {
+		throw new ValidationError("The certificate chain could not be parsed.");
+	}
+}
+function assertCertificateMatchesKey(chain, spkiBase64) {
+	const certificate = chain[0];
+	if (!certificate) throw new KeyCertificateError("The certificate chain is empty.");
+	const certificateKey = certificate.publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	let importedKey;
+	try {
+		importedKey = createPublicKey({
+			key: Buffer.from(spkiBase64, "base64"),
+			type: "spki",
+			format: "der"
+		}).export({
+			type: "spki",
+			format: "der"
+		});
+	} catch {
+		throw new KeyCertificateError("The imported public key material is invalid.");
+	}
+	if (Buffer.compare(certificateKey, importedKey) !== 0) throw new KeyCertificateError("The certificate does not match the key material.");
+}
+function buildX5c(chain) {
+	return chain.map((certificate) => certificate.raw.toString("base64"));
+}
+async function buildX5tS256(chain) {
+	const certificate = chain[0];
+	if (!certificate) throw new KeyCertificateError("The certificate chain is empty.");
+	const digest = await subtle.digest("SHA-256", certificate.raw);
+	return base64URLEncode(String.fromCharCode(...new Uint8Array(digest)));
+}
+/**
+* Derive the RFC 7517 x5c / x5t#S256 JWK members from a stored PEM chain.
+*
+* Fail-open by design: one malformed legacy/database row must not take down
+* the whole realm's JWKS — the usable public key is still published, just
+* without the certificate members.
+*/ async function buildCertificateJwkFields(certificate) {
+	if (!certificate) return {};
+	try {
+		const chain = parseCertificateChain(certificate);
+		return {
+			x5c: buildX5c(chain),
+			"x5t#S256": await buildX5tS256(chain)
+		};
+	} catch {
+		return {};
+	}
+}
+//#endregion
+export { assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, parseCertificateChain };
+
+//# sourceMappingURL=certificate.mjs.map

package/dist/core/key/certificate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.mjs","names":["X509Certificate","createPublicKey","ValidationError","base64URLEncode","subtle","KeyCertificateError","CERTIFICATE_BLOCK_PATTERN","parseCertificateChain","pem","blocks","match","length","map","block","assertCertificateMatchesKey","chain","spkiBase64","certificate","certificateKey","publicKey","export","type","format","importedKey","key","Buffer","from","compare","buildX5c","raw","toString","buildX5tS256","digest","String","fromCharCode","Uint8Array","buildCertificateJwkFields","x5c"],"sources":["../../../src/core/key/certificate.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    X509Certificate,\n    createPublicKey,\n} from 'node:crypto';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type { OAuth2JsonWebKey } from '@authup/specs';\nimport { subtle } from 'uncrypto';\nimport { KeyCertificateError } from './certificate-error.ts';\n\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n\nexport function parseCertificateChain(pem: string): X509Certificate[] {\n    const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n    if (!blocks || blocks.length === 0) {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n\n    try {\n        return blocks.map((block) => new X509Certificate(block));\n    } catch {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n}\n\nexport function assertCertificateMatchesKey(\n    chain: X509Certificate[],\n    spkiBase64: string,\n): void {\n    const certificate = chain[0];\n    if (!certificate) {\n        throw new KeyCertificateError('The certificate chain is empty.');\n    }\n\n    const certificateKey = certificate.publicKey.export({\n        type: 'spki',\n        format: 'der',\n    });\n\n    let importedKey : Buffer;\n    try {\n        importedKey = createPublicKey({\n            key: Buffer.from(spkiBase64, 'base64'),\n            type: 'spki',\n            format: 'der',\n        }).export({\n            type: 'spki',\n            format: 'der',\n        });\n    } catch {\n        throw new KeyCertificateError('The imported public key material is invalid.');\n    }\n\n    if (Buffer.compare(certificateKey, importedKey) !== 0) {\n        throw new KeyCertificateError('The certificate does not match the key material.');\n    }\n}\n\nexport function buildX5c(chain: X509Certificate[]): string[] {\n    return chain.map((certificate) => certificate.raw.toString('base64'));\n}\n\nexport async function buildX5tS256(chain: X509Certificate[]): Promise<string> {\n    const certificate = chain[0];\n    if (!certificate) {\n        throw new KeyCertificateError('The certificate chain is empty.');\n    }\n\n    const digest = await subtle.digest('SHA-256', certificate.raw);\n\n    return base64URLEncode(\n        String.fromCharCode(...new Uint8Array(digest)),\n    );\n}\n\n/**\n * Derive the RFC 7517 x5c / x5t#S256 JWK members from a stored PEM chain.\n *\n * Fail-open by design: one malformed legacy/database row must not take down\n * the whole realm's JWKS — the usable public key is still published, just\n * without the certificate members.\n */\nexport async function buildCertificateJwkFields(\n    certificate: string | null,\n): Promise<Partial<Pick<OAuth2JsonWebKey, 'x5c' | 'x5t#S256'>>> {\n    if (!certificate) {\n        return {};\n    }\n\n    try {\n        const chain = parseCertificateChain(certificate);\n        return {\n            x5c: buildX5c(chain),\n            'x5t#S256': await buildX5tS256(chain),\n        };\n    } catch {\n        return {};\n    }\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAMM,4BAA4B;AAElC,SAAgBC,sBAAsBC,KAAW;CAC7C,MAAMC,SAASD,IAAIE,MAAMJ,yBAAAA;CACzB,IAAI,CAACG,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAIT,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAOO,OAAOG,KAAKC,UAAU,IAAIb,gBAAgBa,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAIX,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,SAAgBY,4BACZC,OACAC,YAAkB;CAElB,MAAMC,cAAcF,MAAM;CAC1B,IAAI,CAACE,aACD,MAAM,IAAIZ,oBAAoB,iCAAA;CAGlC,MAAMa,iBAAiBD,YAAYE,UAAUC,OAAO;EAChDC,MAAM;EACNC,QAAQ;CACZ,CAAA;CAEA,IAAIC;CACJ,IAAI;EACAA,cAActB,gBAAgB;GAC1BuB,KAAKC,OAAOC,KAAKV,YAAY,QAAA;GAC7BK,MAAM;GACNC,QAAQ;EACZ,CAAA,CAAA,CAAGF,OAAO;GACNC,MAAM;GACNC,QAAQ;EACZ,CAAA;CACJ,QAAQ;EACJ,MAAM,IAAIjB,oBAAoB,8CAAA;CAClC;CAEA,IAAIoB,OAAOE,QAAQT,gBAAgBK,WAAAA,MAAiB,GAChD,MAAM,IAAIlB,oBAAoB,kDAAA;AAEtC;AAEA,SAAgBuB,SAASb,OAAwB;CAC7C,OAAOA,MAAMH,KAAKK,gBAAgBA,YAAYY,IAAIC,SAAS,QAAA,CAAA;AAC/D;AAEA,eAAsBC,aAAahB,OAAwB;CACvD,MAAME,cAAcF,MAAM;CAC1B,IAAI,CAACE,aACD,MAAM,IAAIZ,oBAAoB,iCAAA;CAGlC,MAAM2B,SAAS,MAAM5B,OAAO4B,OAAO,WAAWf,YAAYY,GAAG;CAE7D,OAAO1B,gBACH8B,OAAOC,aAAY,GAAI,IAAIC,WAAWH,MAAAA,CAAAA,CAAAA;AAE9C;;;;;;;GASA,eAAsBI,0BAClBnB,aAA0B;CAE1B,IAAI,CAACA,aACD,OAAO,CAAC;CAGZ,IAAI;EACA,MAAMF,QAAQR,sBAAsBU,WAAAA;EACpC,OAAO;GACHoB,KAAKT,SAASb,KAAAA;GACd,YAAY,MAAMgB,aAAahB,KAAAA;EACnC;CACJ,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}

package/dist/core/key/check.d.ts

@@ -0,0 +1,3 @@
+import { type RealmCipherBlobError } from './error.ts';
+export declare function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError;
+//# sourceMappingURL=check.d.ts.map

package/dist/core/key/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/core/key/check.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEzF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF"}

package/dist/core/key/check.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { REALM_CIPHER_BLOB_ERROR_INSTANCE } from "./error.mjs";
+import { hasInstanceof } from "@authup/errors";
+//#region src/core/key/check.ts
+function isRealmCipherBlobError(input) {
+	return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);
+}
+//#endregion
+export { isRealmCipherBlobError };
+
+//# sourceMappingURL=check.mjs.map

package/dist/core/key/check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.mjs","names":["hasInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","isRealmCipherBlobError","input"],"sources":["../../../src/core/key/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { hasInstanceof } from '@authup/errors';\nimport { REALM_CIPHER_BLOB_ERROR_INSTANCE, type RealmCipherBlobError } from './error.ts';\n\nexport function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError {\n    return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;;AAUA,SAAgBE,uBAAuBC,OAAc;CACjD,OAAOH,cAAcG,OAAOF,gCAAAA;AAChC"}

package/dist/core/key/constants.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Version tag leading a realm-cipher blob (v1.<key_id>.<payload>).
+ */
+export declare const REALM_CIPHER_BLOB_VERSION = "v1";
+/**
+ * Marker prefixing key material stored KEK-wrapped in the key store
+ * (config secretsEncryptionKey). Unprefixed material is plaintext.
+ */
+export declare const WRAPPED_KEY_MATERIAL_PREFIX = "wrapped.v1.";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/key/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/core/key/constants.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,gBAAgB,CAAC"}