@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/key/constants.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/key/constants.ts
+/**
+* Version tag leading a realm-cipher blob (v1.<key_id>.<payload>).
+*/ const REALM_CIPHER_BLOB_VERSION = "v1";
+/**
+* Marker prefixing key material stored KEK-wrapped in the key store
+* (config secretsEncryptionKey). Unprefixed material is plaintext.
+*/ const WRAPPED_KEY_MATERIAL_PREFIX = "wrapped.v1.";
+//#endregion
+export { REALM_CIPHER_BLOB_VERSION, WRAPPED_KEY_MATERIAL_PREFIX };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/key/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["REALM_CIPHER_BLOB_VERSION","WRAPPED_KEY_MATERIAL_PREFIX"],"sources":["../../../src/core/key/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Version tag leading a realm-cipher blob (v1.<key_id>.<payload>).\n */\nexport const REALM_CIPHER_BLOB_VERSION = 'v1';\n\n/**\n * Marker prefixing key material stored KEK-wrapped in the key store\n * (config secretsEncryptionKey). Unprefixed material is plaintext.\n */\nexport const WRAPPED_KEY_MATERIAL_PREFIX = 'wrapped.v1.';\n"],"mappings":";;;;;;GAUA,MAAaA,4BAA4B;;;;GAMzC,MAAaC,8BAA8B"}

package/dist/core/key/error.d.ts

@@ -0,0 +1,14 @@
+import { AuthupError } from '@authup/errors';
+export declare const REALM_CIPHER_BLOB_ERROR_INSTANCE: unique symbol;
+/**
+ * A blob-semantics decryption failure — malformed blob, unknown / foreign /
+ * non-enc key reference, or failed GCM authentication. This is the expected
+ * fail-closed class consumers map to a plain verification failure.
+ * Infrastructure errors (database outage, KEK misconfiguration) are
+ * deliberately NOT of this type — they must bubble instead of silently
+ * burning a verification attempt.
+ */
+export declare class RealmCipherBlobError extends AuthupError {
+    constructor(message: string);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/core/key/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/core/key/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAE7D,eAAO,MAAM,gCAAgC,eAAyD,CAAC;AAEvG;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,WAAW;gBACrC,OAAO,EAAE,MAAM;CAI9B"}

package/dist/core/key/error.mjs

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AuthupError, markInstanceof } from "@authup/errors";
+//#region src/core/key/error.ts
+const REALM_CIPHER_BLOB_ERROR_INSTANCE = Symbol.for("@authup/server-core/RealmCipherBlobError");
+/**
+* A blob-semantics decryption failure — malformed blob, unknown / foreign /
+* non-enc key reference, or failed GCM authentication. This is the expected
+* fail-closed class consumers map to a plain verification failure.
+* Infrastructure errors (database outage, KEK misconfiguration) are
+* deliberately NOT of this type — they must bubble instead of silently
+* burning a verification attempt.
+*/ var RealmCipherBlobError = class extends AuthupError {
+	constructor(message) {
+		super({ message });
+		markInstanceof(this, REALM_CIPHER_BLOB_ERROR_INSTANCE);
+	}
+};
+//#endregion
+export { REALM_CIPHER_BLOB_ERROR_INSTANCE, RealmCipherBlobError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/key/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["AuthupError","markInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","Symbol","for","RealmCipherBlobError","message"],"sources":["../../../src/core/key/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, markInstanceof } from '@authup/errors';\n\nexport const REALM_CIPHER_BLOB_ERROR_INSTANCE = Symbol.for('@authup/server-core/RealmCipherBlobError');\n\n/**\n * A blob-semantics decryption failure — malformed blob, unknown / foreign /\n * non-enc key reference, or failed GCM authentication. This is the expected\n * fail-closed class consumers map to a plain verification failure.\n * Infrastructure errors (database outage, KEK misconfiguration) are\n * deliberately NOT of this type — they must bubble instead of silently\n * burning a verification attempt.\n */\nexport class RealmCipherBlobError extends AuthupError {\n    constructor(message: string) {\n        super({ message });\n        markInstanceof(this, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n    }\n}\n"],"mappings":";;;;;AASA,MAAaE,mCAAmCC,OAAOC,IAAI,0CAAA;;;;;;;;GAU3D,IAAaC,uBAAb,cAA0CL,YAAAA;CACtC,YAAYM,SAAiB;EACzB,MAAM,EAAEA,QAAQ,CAAA;EAChBL,eAAe,MAAMC,gCAAAA;CACzB;AACJ"}

package/dist/core/key/index.d.ts

@@ -0,0 +1,10 @@
+export * from './check.ts';
+export * from './certificate-error.ts';
+export * from './certificate.ts';
+export * from './constants.ts';
+export * from './error.ts';
+export * from './provisioner.ts';
+export * from './realm-cipher.ts';
+export * from './types.ts';
+export * from './wrap.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/key/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/key/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}

package/dist/core/key/index.mjs

@@ -0,0 +1,12 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { REALM_CIPHER_BLOB_ERROR_INSTANCE, RealmCipherBlobError } from "./error.mjs";
+import { isRealmCipherBlobError } from "./check.mjs";
+import { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError } from "./certificate-error.mjs";
+import { assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, parseCertificateChain } from "./certificate.mjs";
+import { REALM_CIPHER_BLOB_VERSION, WRAPPED_KEY_MATERIAL_PREFIX } from "./constants.mjs";
+import { KeyProvisioner } from "./provisioner.mjs";
+import { RealmCipher } from "./realm-cipher.mjs";
+import { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial } from "./wrap.mjs";
+export { KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, WRAPPED_KEY_MATERIAL_PREFIX, assertCertificateMatchesKey, buildCertificateJwkFields, buildX5c, buildX5tS256, isRealmCipherBlobError, isWrappedKeyMaterial, parseCertificateChain, unwrapKeyMaterial, wrapKeyMaterial };

package/dist/core/key/provisioner.d.ts

@@ -0,0 +1,22 @@
+import type { Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { IKeyProvisioner, IKeyStore } from './types.ts';
+export type KeyProvisionerContext = {
+    keyStore: IKeyStore;
+    logger?: Logger;
+};
+/**
+ * Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at
+ * realm creation and as a startup backfill, so keys are visible in the
+ * management API from the moment a realm exists instead of appearing on
+ * first use. resolveOrCreate stays as the zero-rows self-healing backstop.
+ */
+export declare class KeyProvisioner implements IKeyProvisioner {
+    protected keyStore: IKeyStore;
+    protected logger?: Logger;
+    constructor(ctx: KeyProvisionerContext);
+    ensureForRealm(realm: Realm | {
+        id: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=provisioner.d.ts.map

package/dist/core/key/provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../../src/core/key/provisioner.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,MAAM,qBAAqB,GAAG;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC;IAE9B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,qBAAqB;IAKhC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAkBrE"}

package/dist/core/key/provisioner.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { JWKUse } from "@authup/specs";
+//#region src/core/key/provisioner.ts
+/**
+* Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at
+* realm creation and as a startup backfill, so keys are visible in the
+* management API from the moment a realm exists instead of appearing on
+* first use. resolveOrCreate stays as the zero-rows self-healing backstop.
+*/ var KeyProvisioner = class {
+	keyStore;
+	logger;
+	constructor(ctx) {
+		this.keyStore = ctx.keyStore;
+		this.logger = ctx.logger;
+	}
+	async ensureForRealm(realm) {
+		const uses = [JWKUse.SIGNATURE, JWKUse.ENCRYPTION];
+		for (const use of uses) try {
+			await this.keyStore.resolveOrCreate(realm.id, use);
+		} catch (e) {
+			if (this.logger) this.logger.warn(`Failed to provision ${use} key for realm ${realm.id}: ${e instanceof Error ? e.message : String(e)}`);
+		}
+	}
+};
+//#endregion
+export { KeyProvisioner };
+
+//# sourceMappingURL=provisioner.mjs.map

package/dist/core/key/provisioner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.mjs","names":["JWKUse","KeyProvisioner","keyStore","logger","ctx","ensureForRealm","realm","uses","SIGNATURE","ENCRYPTION","use","resolveOrCreate","id","e","warn","Error","message","String"],"sources":["../../../src/core/key/provisioner.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport type { IKeyProvisioner, IKeyStore } from './types.ts';\n\nexport type KeyProvisionerContext = {\n    keyStore: IKeyStore,\n    logger?: Logger,\n};\n\n/**\n * Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at\n * realm creation and as a startup backfill, so keys are visible in the\n * management API from the moment a realm exists instead of appearing on\n * first use. resolveOrCreate stays as the zero-rows self-healing backstop.\n */\nexport class KeyProvisioner implements IKeyProvisioner {\n    protected keyStore: IKeyStore;\n\n    protected logger?: Logger;\n\n    constructor(ctx: KeyProvisionerContext) {\n        this.keyStore = ctx.keyStore;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const uses : `${JWKUse}`[] = [JWKUse.SIGNATURE, JWKUse.ENCRYPTION];\n\n        for (const use of uses) {\n            try {\n                await this.keyStore.resolveOrCreate(realm.id, use);\n            } catch (e) {\n                // rows-exist-but-none-active throws by design (a deliberate\n                // admin kill switch) — the provisioning guarantee is only\n                // \"at least one row exists\", so log and continue.\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision ${use} key for realm ${realm.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAuBA,IAAaC,iBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA4B;EACpC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,SAASC,IAAID;CACtB;CAEA,MAAME,eAAeC,OAA8C;EAC/D,MAAMC,OAAuB,CAACP,OAAOQ,WAAWR,OAAOS,UAAAA;EAEvD,KAAK,MAAMC,OAAOH,MACd,IAAI;GACA,MAAM,KAAKL,SAASS,gBAAgBL,MAAMM,IAAIF,GAAAA;EAClD,SAASG,GAAG;GAIR,IAAI,KAAKV,QACL,KAAKA,OAAOW,KACR,uBAAuBJ,IAAI,iBAAiBJ,MAAMM,GAAG,IAAIC,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGjH;CAER;AACJ"}

package/dist/core/key/realm-cipher.d.ts

@@ -0,0 +1,20 @@
+import type { ISymmetricCipher } from '@authup/server-kit';
+import type { IKeyStore, IRealmCipher } from './types.ts';
+export type RealmCipherContext = {
+    keyStore: IKeyStore;
+};
+export declare class RealmCipher implements IRealmCipher {
+    protected keyStore: IKeyStore;
+    /**
+     * Imported ciphers by key id — key MATERIAL is immutable, so entries
+     * never invalidate. Status and realm binding are deliberately NOT
+     * cached: decrypt re-resolves the key row every call so disabling a
+     * key acts as an immediate, reversible kill switch.
+     */
+    protected ciphers: Map<string, ISymmetricCipher>;
+    constructor(ctx: RealmCipherContext);
+    encrypt(plain: string, realmId: string): Promise<string>;
+    decrypt(blob: string, realmId: string): Promise<string>;
+    protected resolveCipher(keyId: string, material: string): ISymmetricCipher;
+}
+//# sourceMappingURL=realm-cipher.d.ts.map

package/dist/core/key/realm-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-cipher.d.ts","sourceRoot":"","sources":["../../../src/core/key/realm-cipher.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK3D,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,qBAAa,WAAY,YAAW,YAAY;IAC5C,SAAS,CAAC,QAAQ,EAAG,SAAS,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,OAAO,EAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBAEtC,GAAG,EAAE,kBAAkB;IAK7B,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAezD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAoC9D,SAAS,CAAC,aAAa,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GAChB,gBAAgB;CASvB"}

package/dist/core/key/realm-cipher.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmCipherBlobError } from "./error.mjs";
+import "./constants.mjs";
+import { KeyStatus } from "@authup/core-kit";
+import { SymmetricCipher } from "@authup/server-kit";
+import { AuthupError } from "@authup/errors";
+import { JWKUse } from "@authup/specs";
+//#region src/core/key/realm-cipher.ts
+var RealmCipher = class {
+	keyStore;
+	/**
+	* Imported ciphers by key id — key MATERIAL is immutable, so entries
+	* never invalidate. Status and realm binding are deliberately NOT
+	* cached: decrypt re-resolves the key row every call so disabling a
+	* key acts as an immediate, reversible kill switch.
+	*/ ciphers;
+	constructor(ctx) {
+		this.keyStore = ctx.keyStore;
+		this.ciphers = /* @__PURE__ */ new Map();
+	}
+	async encrypt(plain, realmId) {
+		const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);
+		if (!key.decryptionKey) throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);
+		const cipher = this.resolveCipher(key.id, key.decryptionKey);
+		return [
+			"v1",
+			key.id,
+			await cipher.encrypt(plain)
+		].join(".");
+	}
+	async decrypt(blob, realmId) {
+		const parts = blob.split(".");
+		if (parts.length !== 3 || parts[0] !== "v1") throw new RealmCipherBlobError("The cipher blob is malformed.");
+		const [, keyId, payload] = parts;
+		const key = await this.keyStore.resolveById(keyId);
+		if (!key || key.use !== JWKUse.ENCRYPTION || !key.decryptionKey) throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);
+		if (key.status === KeyStatus.DISABLED) throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);
+		if (key.realmId !== realmId) throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);
+		const cipher = this.resolveCipher(key.id, key.decryptionKey);
+		try {
+			return await cipher.decrypt(payload);
+		} catch {
+			throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);
+		}
+	}
+	resolveCipher(keyId, material) {
+		let cipher = this.ciphers.get(keyId);
+		if (!cipher) {
+			cipher = new SymmetricCipher(material);
+			this.ciphers.set(keyId, cipher);
+		}
+		return cipher;
+	}
+};
+//#endregion
+export { RealmCipher };
+
+//# sourceMappingURL=realm-cipher.mjs.map

package/dist/core/key/realm-cipher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-cipher.mjs","names":["AuthupError","KeyStatus","SymmetricCipher","JWKUse","REALM_CIPHER_BLOB_VERSION","RealmCipherBlobError","RealmCipher","keyStore","ciphers","ctx","Map","encrypt","plain","realmId","key","resolveOrCreate","ENCRYPTION","decryptionKey","cipher","resolveCipher","id","join","decrypt","blob","parts","split","length","keyId","payload","resolveById","use","status","DISABLED","material","get","set"],"sources":["../../../src/core/key/realm-cipher.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport { REALM_CIPHER_BLOB_VERSION } from './constants.ts';\nimport { RealmCipherBlobError } from './error.ts';\nimport type { IKeyStore, IRealmCipher } from './types.ts';\n\nexport type RealmCipherContext = {\n    keyStore: IKeyStore,\n};\n\nexport class RealmCipher implements IRealmCipher {\n    protected keyStore : IKeyStore;\n\n    /**\n     * Imported ciphers by key id — key MATERIAL is immutable, so entries\n     * never invalidate. Status and realm binding are deliberately NOT\n     * cached: decrypt re-resolves the key row every call so disabling a\n     * key acts as an immediate, reversible kill switch.\n     */\n    protected ciphers : Map<string, ISymmetricCipher>;\n\n    constructor(ctx: RealmCipherContext) {\n        this.keyStore = ctx.keyStore;\n        this.ciphers = new Map();\n    }\n\n    async encrypt(plain: string, realmId: string) : Promise<string> {\n        const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);\n        if (!key.decryptionKey) {\n            throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryptionKey);\n\n        return [\n            REALM_CIPHER_BLOB_VERSION,\n            key.id,\n            await cipher.encrypt(plain),\n        ].join('.');\n    }\n\n    async decrypt(blob: string, realmId: string) : Promise<string> {\n        const parts = blob.split('.');\n        if (parts.length !== 3 || parts[0] !== REALM_CIPHER_BLOB_VERSION) {\n            throw new RealmCipherBlobError('The cipher blob is malformed.');\n        }\n\n        const [, keyId, payload] = parts;\n\n        const key = await this.keyStore.resolveById(keyId);\n        if (\n            !key ||\n            key.use !== JWKUse.ENCRYPTION ||\n            !key.decryptionKey\n        ) {\n            throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);\n        }\n\n        if (key.status === KeyStatus.DISABLED) {\n            throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);\n        }\n\n        if (key.realmId !== realmId) {\n            throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryptionKey);\n\n        try {\n            return await cipher.decrypt(payload);\n        } catch {\n            // failed GCM authentication / corrupt payload — blob semantics,\n            // not infrastructure.\n            throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);\n        }\n    }\n\n    protected resolveCipher(\n        keyId: string,\n        material: string,\n    ) : ISymmetricCipher {\n        let cipher = this.ciphers.get(keyId);\n        if (!cipher) {\n            cipher = new SymmetricCipher(material);\n            this.ciphers.set(keyId, cipher);\n        }\n\n        return cipher;\n    }\n}\n"],"mappings":";;;;;;;;;;AAoBA,IAAaM,cAAb,MAAaA;CACCC;;;;;;IAQV;CAEA,YAAYE,KAAyB;EACjC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,0BAAU,IAAIE,IAAAA;CACvB;CAEA,MAAMC,QAAQC,OAAeC,SAAmC;EAC5D,MAAMC,MAAM,MAAM,KAAKP,SAASQ,gBAAgBF,SAASV,OAAOa,UAAU;EAC1E,IAAI,CAACF,IAAIG,eACL,MAAM,IAAIjB,YAAY,qDAAqDa,QAAQ,EAAE;EAGzF,MAAMK,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,aAAa;EAE3D,OAAO;;GAEHH,IAAIM;GACJ,MAAMF,OAAOP,QAAQC,KAAAA;GACxB,CAACS,KAAK,GAAA;CACX;CAEA,MAAMC,QAAQC,MAAcV,SAAmC;EAC3D,MAAMW,QAAQD,KAAKE,MAAM,GAAA;EACzB,IAAID,MAAME,WAAW,KAAKF,MAAM,OAAA,MAC5B,MAAM,IAAInB,qBAAqB,+BAAA;EAGnC,MAAM,GAAGsB,OAAOC,WAAWJ;EAE3B,MAAMV,MAAM,MAAM,KAAKP,SAASsB,YAAYF,KAAAA;EAC5C,IACI,CAACb,OACDA,IAAIgB,QAAQ3B,OAAOa,cACnB,CAACF,IAAIG,eAEL,MAAM,IAAIZ,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAIiB,WAAW9B,UAAU+B,UACzB,MAAM,IAAI3B,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAID,YAAYA,SAChB,MAAM,IAAIR,qBAAqB,gEAAgEsB,MAAM,GAAG;EAG5G,MAAMT,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,aAAa;EAE3D,IAAI;GACA,OAAO,MAAMC,OAAOI,QAAQM,OAAAA;EAChC,QAAQ;GAGJ,MAAM,IAAIvB,qBAAqB,2CAA2CsB,MAAM,GAAG;EACvF;CACJ;CAEUR,cACNQ,OACAM,UACiB;EACjB,IAAIf,SAAS,KAAKV,QAAQ0B,IAAIP,KAAAA;EAC9B,IAAI,CAACT,QAAQ;GACTA,SAAS,IAAIhB,gBAAgB+B,QAAAA;GAC7B,KAAKzB,QAAQ2B,IAAIR,OAAOT,MAAAA;EAC5B;EAEA,OAAOA;CACX;AACJ"}

package/dist/core/key/types.d.ts

@@ -0,0 +1,59 @@
+import type { Key } from '@authup/core-kit';
+import type { JWKUse } from '@authup/specs';
+export interface IKeyProvisioner {
+    /**
+     * Ensure the realm holds at least one sig and one enc key row.
+     * Idempotent; never throws (provisioning must not fail realm creation
+     * or startup).
+     *
+     * @param realm
+     */
+    ensureForRealm(realm: {
+        id: string;
+    }): Promise<void>;
+}
+export interface IKeyStore {
+    /**
+     * Resolve the realm's highest-priority ACTIVE key for the given use,
+     * with usable (unwrapped) material. Mints one iff ZERO rows exist for
+     * (realm, use) — the self-healing zero-config backstop (provisioning
+     * mints eagerly). Rows existing but none active fails loud: an admin
+     * who disabled every key meant it.
+     *
+     * @param realmId
+     * @param use
+     */
+    resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    /**
+     * Resolve a key by explicit id with usable (unwrapped) material.
+     * Read-only; status enforcement is the consumer's concern.
+     *
+     * @param id
+     */
+    resolveById(id: string): Promise<Key | null>;
+}
+/**
+ * Realm-scoped at-rest encryption over the key store's enc keys.
+ * Blobs are self-describing (v1.&lt;key_id&gt;.&lt;payload&gt;), so decryption
+ * resolves its key by id — concurrent key creation and future key
+ * rotation never orphan a blob.
+ */
+export interface IRealmCipher {
+    /**
+     * Encrypt under the realm's current enc key (created on first use).
+     *
+     * @param plain
+     * @param realmId
+     */
+    encrypt(plain: string, realmId: string): Promise<string>;
+    /**
+     * Decrypt a blob via the key id it carries. The referenced key must
+     * belong to the given realm — the binding assert is mandatory, so a
+     * foreign realm's blob can never decrypt.
+     *
+     * @param blob
+     * @param realmId
+     */
+    decrypt(blob: string, realmId: string): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/key/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/key/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,SAAS;IACtB;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAElE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/key/wrap.d.ts

@@ -0,0 +1,5 @@
+import type { ISymmetricCipher } from '@authup/server-kit';
+export declare function isWrappedKeyMaterial(value: string): boolean;
+export declare function wrapKeyMaterial(cipher: ISymmetricCipher, value: string): Promise<string>;
+export declare function unwrapKeyMaterial(cipher: ISymmetricCipher | null | undefined, value: string): Promise<string>;
+//# sourceMappingURL=wrap.d.ts.map

package/dist/core/key/wrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../../src/core/key/wrap.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAE5D;AAED,wBAAsB,eAAe,CACjC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAElB;AAED,wBAAsB,iBAAiB,CACnC,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC3C,KAAK,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAalB"}

package/dist/core/key/wrap.mjs

@@ -0,0 +1,21 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { WRAPPED_KEY_MATERIAL_PREFIX } from "./constants.mjs";
+import { AuthupError } from "@authup/errors";
+//#region src/core/key/wrap.ts
+function isWrappedKeyMaterial(value) {
+	return value.startsWith(WRAPPED_KEY_MATERIAL_PREFIX);
+}
+async function wrapKeyMaterial(cipher, value) {
+	return `${WRAPPED_KEY_MATERIAL_PREFIX}${await cipher.encrypt(value)}`;
+}
+async function unwrapKeyMaterial(cipher, value) {
+	if (!isWrappedKeyMaterial(value)) return value;
+	if (!cipher) throw new AuthupError("The key store holds wrapped key material, but no secretsEncryptionKey (SECRETS_ENCRYPTION_KEY) is configured.");
+	return cipher.decrypt(value.substring(WRAPPED_KEY_MATERIAL_PREFIX.length));
+}
+//#endregion
+export { isWrappedKeyMaterial, unwrapKeyMaterial, wrapKeyMaterial };
+
+//# sourceMappingURL=wrap.mjs.map

package/dist/core/key/wrap.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.mjs","names":["AuthupError","WRAPPED_KEY_MATERIAL_PREFIX","isWrappedKeyMaterial","value","startsWith","wrapKeyMaterial","cipher","encrypt","unwrapKeyMaterial","decrypt","substring","length"],"sources":["../../../src/core/key/wrap.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { WRAPPED_KEY_MATERIAL_PREFIX } from './constants.ts';\n\nexport function isWrappedKeyMaterial(value: string) : boolean {\n    return value.startsWith(WRAPPED_KEY_MATERIAL_PREFIX);\n}\n\nexport async function wrapKeyMaterial(\n    cipher: ISymmetricCipher,\n    value: string,\n) : Promise<string> {\n    return `${WRAPPED_KEY_MATERIAL_PREFIX}${await cipher.encrypt(value)}`;\n}\n\nexport async function unwrapKeyMaterial(\n    cipher: ISymmetricCipher | null | undefined,\n    value: string,\n) : Promise<string> {\n    if (!isWrappedKeyMaterial(value)) {\n        return value;\n    }\n\n    if (!cipher) {\n        throw new AuthupError(\n            'The key store holds wrapped key material, ' +\n            'but no secretsEncryptionKey (SECRETS_ENCRYPTION_KEY) is configured.',\n        );\n    }\n\n    return cipher.decrypt(value.substring(WRAPPED_KEY_MATERIAL_PREFIX.length));\n}\n"],"mappings":";;;;;;AAWA,SAAgBE,qBAAqBC,OAAa;CAC9C,OAAOA,MAAMC,WAAWH,2BAAAA;AAC5B;AAEA,eAAsBI,gBAClBC,QACAH,OAAa;CAEb,OAAO,GAAGF,8BAA8B,MAAMK,OAAOC,QAAQJ,KAAAA;AACjE;AAEA,eAAsBK,kBAClBF,QACAH,OAAa;CAEb,IAAI,CAACD,qBAAqBC,KAAAA,GACtB,OAAOA;CAGX,IAAI,CAACG,QACD,MAAM,IAAIN,YACN,+GACA;CAIR,OAAOM,OAAOG,QAAQN,MAAMO,UAAUT,4BAA4BU,MAAM,CAAA;AAC5E"}

package/dist/core/mail/template/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/registry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,sBAAsB,EAAE;KAAG,CAAC,IAAI,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;CAG9E,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/registry.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,sBAAsB,EAAE;KAAG,CAAC,IAAI,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;CAI9E,CAAC"}

package/dist/core/mail/template/registry.mjs

@@ -2,12 +2,14 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { MailTemplateName } from "./types.mjs";
+import { mfaEmailOtpMailTemplate } from "./templates/mfa-email-otp.mjs";
 import { passwordResetMailTemplate } from "./templates/password-reset.mjs";
 import { registrationActivationMailTemplate } from "./templates/registration-activation.mjs";
 //#region src/core/mail/template/registry.ts
 const MAIL_TEMPLATE_REGISTRY = {
 	[MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,
-	[MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate
+	[MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,
+	[MailTemplateName.MFA_EMAIL_OTP]: mfaEmailOtpMailTemplate
 };
 //#endregion
 export { MAIL_TEMPLATE_REGISTRY };

package/dist/core/mail/template/registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry.mjs","names":["passwordResetMailTemplate","registrationActivationMailTemplate","MailTemplateName","MAIL_TEMPLATE_REGISTRY","REGISTRATION_ACTIVATION","PASSWORD_RESET"],"sources":["../../../../src/core/mail/template/registry.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { passwordResetMailTemplate } from './templates/password-reset.ts';\nimport { registrationActivationMailTemplate } from './templates/registration-activation.ts';\nimport type { MailTemplate } from './types.ts';\nimport { MailTemplateName } from './types.ts';\n\nexport const MAIL_TEMPLATE_REGISTRY: { [N in MailTemplateName]: MailTemplate<N> } = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,\n    [MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,\n};\n"],"mappings":";;;;;;;AAYA,MAAaG,yBAAuE;EAC/ED,iBAAiBE,0BAA0BH;EAC3CC,iBAAiBG,iBAAiBL;AACvC"}
+{"version":3,"file":"registry.mjs","names":["mfaEmailOtpMailTemplate","passwordResetMailTemplate","registrationActivationMailTemplate","MailTemplateName","MAIL_TEMPLATE_REGISTRY","REGISTRATION_ACTIVATION","PASSWORD_RESET","MFA_EMAIL_OTP"],"sources":["../../../../src/core/mail/template/registry.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { mfaEmailOtpMailTemplate } from './templates/mfa-email-otp.ts';\nimport { passwordResetMailTemplate } from './templates/password-reset.ts';\nimport { registrationActivationMailTemplate } from './templates/registration-activation.ts';\nimport type { MailTemplate } from './types.ts';\nimport { MailTemplateName } from './types.ts';\n\nexport const MAIL_TEMPLATE_REGISTRY: { [N in MailTemplateName]: MailTemplate<N> } = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: registrationActivationMailTemplate,\n    [MailTemplateName.PASSWORD_RESET]: passwordResetMailTemplate,\n    [MailTemplateName.MFA_EMAIL_OTP]: mfaEmailOtpMailTemplate,\n};\n"],"mappings":";;;;;;;;AAaA,MAAaI,yBAAuE;EAC/ED,iBAAiBE,0BAA0BH;EAC3CC,iBAAiBG,iBAAiBL;EAClCE,iBAAiBI,gBAAgBP;AACtC"}

package/dist/core/mail/template/templates/mfa-email-otp.d.ts

@@ -0,0 +1,3 @@
+import { MailTemplateName } from '../types.ts';
+export declare const mfaEmailOtpMailTemplate: import("../types.ts").MailTemplate<MailTemplateName.MFA_EMAIL_OTP>;
+//# sourceMappingURL=mfa-email-otp.d.ts.map

package/dist/core/mail/template/templates/mfa-email-otp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-email-otp.d.ts","sourceRoot":"","sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,eAAO,MAAM,uBAAuB,oEAyBlC,CAAC"}

package/dist/core/mail/template/templates/mfa-email-otp.mjs

@@ -0,0 +1,34 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { code, note, paragraph } from "../../format/blocks.mjs";
+import { defineMailTemplate } from "../define.mjs";
+import { MailTemplateName } from "../types.mjs";
+import { TranslatorTranslationMailKey } from "@authup/i18n";
+//#region src/core/mail/template/templates/mfa-email-otp.ts
+const mfaEmailOtpMailTemplate = defineMailTemplate({
+	name: MailTemplateName.MFA_EMAIL_OTP,
+	build: async (params, t) => {
+		const [subject, intro, codeLabel, hint] = await Promise.all([
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),
+			t(TranslatorTranslationMailKey.CODE),
+			t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT)
+		]);
+		const expiry = params.expiresInMinutes ? await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) : void 0;
+		return {
+			subject,
+			preview: intro,
+			blocks: [
+				paragraph(intro),
+				code(codeLabel, params.code),
+				...expiry ? [note(expiry)] : [],
+				note(hint)
+			]
+		};
+	}
+});
+//#endregion
+export { mfaEmailOtpMailTemplate };
+
+//# sourceMappingURL=mfa-email-otp.mjs.map

package/dist/core/mail/template/templates/mfa-email-otp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-email-otp.mjs","names":["TranslatorTranslationMailKey","code","note","paragraph","defineMailTemplate","MailTemplateName","mfaEmailOtpMailTemplate","name","MFA_EMAIL_OTP","build","params","t","subject","intro","codeLabel","hint","Promise","all","MFA_EMAIL_OTP_SUBJECT","MFA_EMAIL_OTP_INTRO","CODE","MFA_EMAIL_OTP_HINT","expiry","expiresInMinutes","MFA_EMAIL_OTP_EXPIRY","minutes","undefined","preview","blocks"],"sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { code, note, paragraph } from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const mfaEmailOtpMailTemplate = defineMailTemplate({\n    name: MailTemplateName.MFA_EMAIL_OTP,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT),\n        ]);\n\n        const expiry = params.expiresInMinutes ?\n            await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) :\n            undefined;\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(expiry ? [note(expiry)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAYA,MAAaM,0BAA0BF,mBAAmB;CACtDG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,QAAQ,MAAMC,QAAQC,IAAI;GACxDN,EAAEX,6BAA6BkB,qBAAqB;GACpDP,EAAEX,6BAA6BmB,mBAAmB;GAClDR,EAAEX,6BAA6BoB,IAAI;GACnCT,EAAEX,6BAA6BqB,kBAAkB;GACpD;EAED,MAAMC,SAASZ,OAAOa,mBAClB,MAAMZ,EAAEX,6BAA6BwB,sBAAsB,EAAEC,SAASf,OAAOa,iBAAiB,CAAA,IAC9FG,KAAAA;EAEJ,OAAO;GACHd;GACAe,SAASd;GACTe,QAAQ;IACJzB,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;OACvBqB,SAAS,CAACpB,KAAKoB,MAAAA,CAAAA,IAAW,CAAA;IAC9BpB,KAAKa,IAAAA;;EAEb;CACJ;AACJ,CAAA"}

package/dist/core/mail/template/types.d.ts

@@ -2,7 +2,8 @@ import type { TranslatorTranslationMailKey } from '@authup/i18n';
 import type { MailBlock } from '../format/types.ts';
 export declare enum MailTemplateName {
     REGISTRATION_ACTIVATION = "registration-activation",
-    PASSWORD_RESET = "password-reset"
+    PASSWORD_RESET = "password-reset",
+    MFA_EMAIL_OTP = "mfa-email-otp"
 }
 export type MailTemplateParamsMap = {
     [MailTemplateName.REGISTRATION_ACTIVATION]: {
@@ -14,6 +15,10 @@ export type MailTemplateParamsMap = {
         url?: string;
         expiresInMinutes?: number;
     };
+    [MailTemplateName.MFA_EMAIL_OTP]: {
+        code: string;
+        expiresInMinutes?: number;
+    };
 };
 /**
  * Locale-bound translator handed to a template's `build`. Resolves a key

package/dist/core/mail/template/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oBAAY,gBAAgB;IACxB,uBAAuB,4BAA4B;IACnD,cAAc,mBAAmB;CACpC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACjC,GAAG,EAAE,GAAG,4BAA4B,EAAE,EACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,EAAE,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CACD,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAChC,CAAC,EAAE,sBAAsB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/mail/template/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oBAAY,gBAAgB;IACxB,uBAAuB,4BAA4B;IACnD,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;CAClC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACjC,GAAG,EAAE,GAAG,4BAA4B,EAAE,EACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAEhB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,EAAE,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IACtE,IAAI,EAAE,CAAC,CAAC;IACR,KAAK,CACD,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAChC,CAAC,EAAE,sBAAsB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACvC,CAAC"}

package/dist/core/mail/template/types.mjs

@@ -5,6 +5,7 @@ import.meta.url;
 var MailTemplateName = /*#__PURE__*/ function(MailTemplateName) {
 	MailTemplateName["REGISTRATION_ACTIVATION"] = "registration-activation";
 	MailTemplateName["PASSWORD_RESET"] = "password-reset";
+	MailTemplateName["MFA_EMAIL_OTP"] = "mfa-email-otp";
 	return MailTemplateName;
 }({});
 //#endregion

package/dist/core/mail/template/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;QAAAA"}
+{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n    MFA_EMAIL_OTP = 'mfa-email-otp',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n    [MailTemplateName.MFA_EMAIL_OTP]: {\n        code: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;;QAAAA"}

package/dist/core/metrics/index.d.ts

@@ -0,0 +1,3 @@
+export * from './noop.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/metrics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/index.ts"],"names":[],"mappings":"AAOA,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/core/metrics/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { NoopAuthFlowMetrics } from "./noop.mjs";
+export { NoopAuthFlowMetrics };

package/dist/core/metrics/noop.d.ts

@@ -0,0 +1,8 @@
+import type { IAuthFlowMetrics } from './types.ts';
+export declare class NoopAuthFlowMetrics implements IAuthFlowMetrics {
+    recordLogin(): void;
+    recordTokenGrant(): void;
+    recordAuthorize(): void;
+    recordRefreshReplay(): void;
+}
+//# sourceMappingURL=noop.d.ts.map

package/dist/core/metrics/noop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noop.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/noop.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,WAAW,IAAI,IAAI;IAInB,gBAAgB,IAAI,IAAI;IAIxB,eAAe,IAAI,IAAI;IAIvB,mBAAmB,IAAI,IAAI;CAG9B"}

package/dist/core/metrics/noop.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/metrics/noop.ts
+var NoopAuthFlowMetrics = class {
+	recordLogin() {}
+	recordTokenGrant() {}
+	recordAuthorize() {}
+	recordRefreshReplay() {}
+};
+//#endregion
+export { NoopAuthFlowMetrics };
+
+//# sourceMappingURL=noop.mjs.map

package/dist/core/metrics/noop.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"noop.mjs","names":["NoopAuthFlowMetrics","recordLogin","recordTokenGrant","recordAuthorize","recordRefreshReplay"],"sources":["../../../src/core/metrics/noop.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAuthFlowMetrics } from './types.ts';\n\nexport class NoopAuthFlowMetrics implements IAuthFlowMetrics {\n    recordLogin(): void {\n        // noop\n    }\n\n    recordTokenGrant(): void {\n        // noop\n    }\n\n    recordAuthorize(): void {\n        // noop\n    }\n\n    recordRefreshReplay(): void {\n        // noop\n    }\n}\n"],"mappings":";;;;AASA,IAAaA,sBAAb,MAAaA;CACTC,cAAoB,CAEpB;CAEAC,mBAAyB,CAEzB;CAEAC,kBAAwB,CAExB;CAEAC,sBAA4B,CAE5B;AACJ"}

package/dist/core/metrics/types.d.ts

@@ -0,0 +1,19 @@
+import type { OAuth2TokenGrant } from '@authup/specs';
+export type AuthFlowLoginResult = 'success' | 'failure';
+/**
+ * `denied` is reserved — dead until an application-access policy (plan 052)
+ * can deny an authorize; emitted in the label domain from day one so
+ * dashboards stay stable when it turns live.
+ */
+export type AuthFlowAuthorizeOutcome = 'issued' | 'denied' | 'login_required' | 'mfa_required' | 'error';
+export interface IAuthFlowMetrics {
+    recordLogin(result: AuthFlowLoginResult): void;
+    /**
+     * Successful token grants only — failures appear in the generic
+     * per-route status-code histogram on /token.
+     */
+    recordTokenGrant(grantType: `${OAuth2TokenGrant}`): void;
+    recordAuthorize(outcome: AuthFlowAuthorizeOutcome): void;
+    recordRefreshReplay(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/metrics/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/metrics/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;AAEzG,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAE/C;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAEzD,eAAe,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAEzD,mBAAmB,IAAI,IAAI,CAAC;CAC/B"}

package/dist/core/oauth2/access-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/access-policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/access-policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/access-policy/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2AccessPolicyEvaluator } from "./module.mjs";
+export { OAuth2AccessPolicyEvaluator };

package/dist/core/oauth2/access-policy/module.d.ts

@@ -0,0 +1,12 @@
+import type { IdentityPolicyData } from '@authup/access';
+import type { Logger } from '@authup/server-kit';
+import { PolicyEngine } from '../../security/policy/engine.ts';
+import type { IOAuth2AccessPolicyEvaluator, IOAuth2AccessPolicyProvider, OAuth2AccessPolicyEvaluatorContext } from './types.ts';
+export declare class OAuth2AccessPolicyEvaluator implements IOAuth2AccessPolicyEvaluator {
+    protected policyProvider: IOAuth2AccessPolicyProvider;
+    protected engine: PolicyEngine;
+    protected logger?: Logger;
+    constructor(ctx: OAuth2AccessPolicyEvaluatorContext);
+    evaluate(policyId: string, subject: IdentityPolicyData): Promise<boolean>;
+}
+//# sourceMappingURL=module.d.ts.map