@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/security/policy/evaluator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.mjs","names":["BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","accessData","ctx","data","has","PERMISSION_BINDING","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realm_id","client_id","length","invert","aggr","grant","grants","realmOutcome","scope","realm_scope","engine","evaluators","outcome","push"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Issue } from 'validup';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) &&\n                    (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realm_scope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realm_id) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine —\n            // REALM_MATCH is in policiesExcluded, so the engine would skip it).\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realm_scope },\n                ctx,\n            );\n            if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                // Reach matches and this grant carries no further restriction.\n                return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;AA2BA,IAAaS,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIR,iCAAAA;EACrB,KAAKS,oBAAoB,IAAIV,wBAAAA;EAC7B,KAAKW,sBAAsB,IAAIP,0BAAAA;EAC/B,KAAKQ,6BAA6BA;CACtC;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIjB,kBAAkBkB,kBAAkB,GAClD,OAAO;EAGX,IAAIH,IAAIC,KAAKG,YAAYnB,kBAAkBkB,kBAAkB,GACzD,OAAOH,IAAIC,KAAKI,IAAIpB,kBAAkBkB,kBAAkB;EAG5D,MAAMF,OAAOD,IAAIC,KAAKI,IAAuCpB,kBAAkBkB,kBAAkB;EAEjGH,IAAIC,KAAKK,IAAIrB,kBAAkBkB,oBAAoBF,IAAAA;EACnDD,IAAIC,KAAKM,aAAatB,kBAAkBkB,kBAAkB;EAE1D,OAAOF;CACX;CAEA,MAAMO,SAASC,OAA4BT,KAA+D;EACtG,MAAMU,SAAS,MAAM,KAAKf,UAAUgB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKhB,kBAAkBG,WAAWC,GAAAA;EACzD,IAAI,CAACY,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKpB,WAAWC,GAAAA;EACtC,IAAI,CAACmB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJtB,sBAAsB;IAClBuB,MAAM1B,gBAAgB2B;IACtBC,SAAS;IACTC,MAAMlB,IAAIkB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKtB,2BAA2BuB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,YAAY,WAAWH,KAAKC,WAAWE,YAAY,UACzET,QAAQO,WAAWG,aAAa,WAAWJ,KAAKC,WAAWG,aAAa;EACjF,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQzC,kCAAkC6B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAASpB,yBAAyB,OAAOiB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,KAAK,MAAMmB,SAASD,KAAKE,QAAQ;GAW7B,IAAI,EAACC,MAJsB,KAAKtC,oBAAoBW,SAChD,EAAE4B,OAAOH,MAAMI,YAAY,GAC3BrC,GAAAA,EAAAA,CAEca,SACd;GAGJ,IAAI,CAACoB,MAAMvB,QAEP,OAAO,EAAEG,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAQpE,MAAMS,UAAU,MAAMF,IADHlD,aAAaY,IAAIuC,UACdD,CAAAA,CAAO9B,SAASyB,MAAMvB,QAAQ;IAChD,GAAGV;IACHkB,MAAM,CAAA,GACElB,IAAIkB,QAAQ,CAAA,CAAA;GAExB,CAAA;GAEA,IAAIsB,QAAQ3B,SACR,OAAO,EAAEA,SAASpB,yBAAyB,MAAMiB,OAAOqB,MAAM,EAAE;GAGpE,IAAIS,QAAQ1B,QACRA,OAAO2B,KAAI,GAAID,QAAQ1B,MAAM;EAErC;EAIA,MAAMD,UAAUpB,yBAAyB,OAAOiB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}
+{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from 'validup';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (ctx.withConditions && lowerable && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAAA;CAC9B;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CAAA;EAER;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CAAA;EAER;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CAAA,GACEjB,IAAIiB,QAAQ,CAAA,CAAA;GAExB,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIhC,IAAIiD,kBAAkBd,aAAaF,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}

package/dist/index.mjs

@@ -10,6 +10,11 @@ import { EntitySubscriber, buildEntityDestinations } from "./adapters/database/s
 import { CachePrefix } from "./adapters/database/domains/constants.mjs";
 import { RealmSubscriber } from "./adapters/database/domains/realm/subscriber.mjs";
 import { KeyEntity } from "./adapters/database/domains/key/entity.mjs";
+import { PolicyEntity } from "./adapters/database/domains/policy/entity.mjs";
+import { PolicyAttributeEntity } from "./adapters/database/domains/policy-attribute/entity.mjs";
+import { PolicyAttributeSubscriber } from "./adapters/database/domains/policy-attribute/subscriber.mjs";
+import { PolicyRepository } from "./adapters/database/domains/policy/repository.mjs";
+import { PolicySubscriber } from "./adapters/database/domains/policy/subscriber.mjs";
 import { ClientEntity } from "./adapters/database/domains/client/entity.mjs";
 import { ClientSubscriber } from "./adapters/database/domains/client/subscriber.mjs";
 import { RoleEntity } from "./adapters/database/domains/role/entity.mjs";
@@ -20,45 +25,39 @@ import { ClientRoleEntity } from "./adapters/database/domains/client-role/entity
 import { ClientRoleSubscriber } from "./adapters/database/domains/client-role/subscriber.mjs";
 import { PermissionEntity } from "./adapters/database/domains/permission/entity.mjs";
 import { PermissionSubscriber } from "./adapters/database/domains/permission/subscriber.mjs";
-import { PolicyEntity } from "./adapters/database/domains/policy/entity.mjs";
-import { PolicyAttributeEntity } from "./adapters/database/domains/policy-attribute/entity.mjs";
-import { PolicyAttributeSubscriber } from "./adapters/database/domains/policy-attribute/subscriber.mjs";
-import { PolicyRepository } from "./adapters/database/domains/policy/repository.mjs";
-import { PolicySubscriber } from "./adapters/database/domains/policy/subscriber.mjs";
 import { ClientPermissionEntity } from "./adapters/database/domains/client-permission/entity.mjs";
 import { ClientPermissionSubscriber } from "./adapters/database/domains/client-permission/subscriber.mjs";
 import { ScopeEntity } from "./adapters/database/domains/scope/entity.mjs";
 import { ScopeSubscriber } from "./adapters/database/domains/scope/subscriber.mjs";
 import { ClientScopeEntity } from "./adapters/database/domains/client-scope/entity.mjs";
 import { ClientScopeSubscriber } from "./adapters/database/domains/client-scope/subscriber.mjs";
-import { IdentityProviderEntity } from "./adapters/database/domains/identity-provider/entity.mjs";
-import { IdentityProviderAttributeEntity } from "./adapters/database/domains/identity-provider-attribute/entity.mjs";
-import { IdentityProviderAttributeSubscriber } from "./adapters/database/domains/identity-provider-attribute/subscriber.mjs";
-import { IdentityProviderRepository } from "./adapters/database/domains/identity-provider/repository.mjs";
-import { IdentityProviderSubscriber } from "./adapters/database/domains/identity-provider/subscriber.mjs";
 import { UserEntity } from "./adapters/database/domains/user/entity.mjs";
 import { UserAttributeEntity } from "./adapters/database/domains/user-attribute/entity.mjs";
 import { UserAttributeSubscriber } from "./adapters/database/domains/user-attribute/subscriber.mjs";
 import { UserRepository } from "./adapters/database/domains/user/repository.mjs";
 import { UserSubscriber } from "./adapters/database/domains/user/subscriber.mjs";
+import { ConsentEntity } from "./adapters/database/domains/consent/entity.mjs";
+import { ConsentEntitySubscriber } from "./adapters/database/domains/consent/subscriber.mjs";
+import { EventEntity } from "./adapters/database/domains/event/entity.mjs";
+import { IdentityProviderEntity } from "./adapters/database/domains/identity-provider/entity.mjs";
+import { IdentityProviderAttributeEntity } from "./adapters/database/domains/identity-provider-attribute/entity.mjs";
+import { IdentityProviderAttributeSubscriber } from "./adapters/database/domains/identity-provider-attribute/subscriber.mjs";
+import { IdentityProviderRepository } from "./adapters/database/domains/identity-provider/repository.mjs";
+import { IdentityProviderSubscriber } from "./adapters/database/domains/identity-provider/subscriber.mjs";
 import { IdentityProviderAccountEntity } from "./adapters/database/domains/identity-provider-account/entity.mjs";
 import { IdentityProviderAccountSubscriber } from "./adapters/database/domains/identity-provider-account/subscriber.mjs";
 import { IdentityProviderAttributeMappingEntity } from "./adapters/database/domains/identity-provider-attribute-mapping/entity.mjs";
 import { IdentityProviderPermissionMappingEntity } from "./adapters/database/domains/identity-provider-permission-mapping/entity.mjs";
 import { IdentityProviderRoleMappingEntity } from "./adapters/database/domains/identity-provider-role-mapping/entity.mjs";
 import { IdentityProviderRoleSubscriber } from "./adapters/database/domains/identity-provider-role-mapping/subscriber.mjs";
-import { RobotEntity } from "./adapters/database/domains/robot/entity.mjs";
-import { RobotSubscriber } from "./adapters/database/domains/robot/subscriber.mjs";
 import { SessionEntity } from "./adapters/database/domains/session/entity.mjs";
 import { SessionTokenEntity } from "./adapters/database/domains/session-token/entity.mjs";
+import { TrustAnchorEntity } from "./adapters/database/domains/trust-anchor/entity.mjs";
 import { PermissionPolicyEntity } from "./adapters/database/domains/permission-policy/entity.mjs";
-import { RobotPermissionEntity } from "./adapters/database/domains/robot-permission/entity.mjs";
-import { RobotPermissionSubscriber } from "./adapters/database/domains/robot-permission/subscriber.mjs";
-import { RobotRoleEntity } from "./adapters/database/domains/robot-role/entity.mjs";
-import { RobotRoleSubscriber } from "./adapters/database/domains/robot-role/subscriber.mjs";
 import { RoleAttributeSubscriber } from "./adapters/database/domains/role-attribute/subscriber.mjs";
 import { RolePermissionEntity } from "./adapters/database/domains/role-permission/entity.mjs";
 import { RolePermissionSubscriber } from "./adapters/database/domains/role-permission/subscriber.mjs";
+import { UserAuthenticatorEntity } from "./adapters/database/domains/user-authenticator/entity.mjs";
 import { UserPermissionEntity } from "./adapters/database/domains/user-permission/entity.mjs";
 import { UserPermissionSubscriber } from "./adapters/database/domains/user-permission/subscriber.mjs";
 import { UserRoleEntity } from "./adapters/database/domains/user-role/entity.mjs";
@@ -67,56 +66,61 @@ import { CacheInjectionKey } from "./app/modules/cache/constants.mjs";
 import { ModuleName } from "./app/modules/constants.mjs";
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./app/modules/config/constants.mjs";
 import { expandToOrigins, getAppOrigins } from "./app/modules/config/origins.mjs";
+import { CERTIFICATE_SOURCES, RequestHandlerOperation } from "./adapters/http/request/constants.mjs";
+import { extractClientCertificateEvidence } from "./adapters/http/request/client-certificate.mjs";
+import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./adapters/http/request/permission/helper.mjs";
+import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./adapters/http/request/helpers/identity.mjs";
+import { buildActorContext } from "./adapters/http/request/helpers/actor.mjs";
+import { getBodyRealmID } from "./adapters/http/request/helpers/body-realm-id.mjs";
+import { LOCALE_COOKIE, useRequestLocale } from "./adapters/http/request/helpers/locale.mjs";
+import { readFromLocations } from "./adapters/http/request/helpers/locations.mjs";
+import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./adapters/http/request/helpers/mfa-login-ticket.mjs";
+import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./adapters/http/request/helpers/param-id.mjs";
+import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./adapters/http/request/helpers/realm-id.mjs";
+import { sanitizeRelativeRedirect } from "./adapters/http/request/helpers/redirect.mjs";
+import { setRequestScopes, useRequestScopes } from "./adapters/http/request/helpers/scopes.mjs";
+import { setRequestSessionId, useRequestSessionId } from "./adapters/http/request/helpers/session-id.mjs";
+import { setRequestToken, useRequestToken } from "./adapters/http/request/helpers/token.mjs";
+import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./adapters/http/request/event-context.mjs";
+import { RequestPermissionEvaluator } from "./adapters/http/request/permission/module.mjs";
 import { ConfigModule } from "./app/modules/config/module.mjs";
 import { CacheModule } from "./app/modules/cache/module.mjs";
 import { SessionRepository } from "./app/modules/authentication/repositories/session.mjs";
 import { AuthenticationModule } from "./app/modules/authentication/module.mjs";
-import { DatabaseInjectionKey } from "./app/modules/database/constants.mjs";
 import { DatabaseQueryResultCache } from "./adapters/database/cache/module.mjs";
 import { DataSourceOptionsBuilder } from "./adapters/database/data-source/options/module.mjs";
 import { DatabaseConflictError } from "./adapters/database/errors/conflict.mjs";
+import { getDatabaseDriverErrorCode, isUniqueConstraintDatabaseError } from "./adapters/database/errors/driver.mjs";
 import "./adapters/database/index.mjs";
-import { LoggerInjectionKey } from "./app/modules/logger/constants.mjs";
-import { LoggerModule } from "./app/modules/logger/module.mjs";
-import { DatabaseModule } from "./app/modules/database/module.mjs";
 import { RealmRepositoryAdapter } from "./app/modules/database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "./app/modules/database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "./app/modules/database/repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "./app/modules/database/repositories/client-role/repository.mjs";
 import { ClientScopeRepositoryAdapter } from "./app/modules/database/repositories/client-scope/repository.mjs";
+import { EventRepositoryAdapter } from "./app/modules/database/repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./app/modules/database/repositories/identity-provider/repository.mjs";
+import { KeyRepositoryAdapter } from "./app/modules/database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./app/modules/database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./app/modules/database/repositories/permission-policy/repository.mjs";
 import { PermissionDatabaseProvider } from "./app/modules/database/repositories/permission-provider/module.mjs";
 import { PolicyRepositoryAdapter } from "./app/modules/database/repositories/policy/repository.mjs";
-import { RobotRepositoryAdapter } from "./app/modules/database/repositories/robot/repository.mjs";
-import { RobotPermissionRepositoryAdapter } from "./app/modules/database/repositories/robot-permission/repository.mjs";
-import { RobotRoleRepositoryAdapter } from "./app/modules/database/repositories/robot-role/repository.mjs";
 import { RoleRepositoryAdapter } from "./app/modules/database/repositories/role/repository.mjs";
 import { RoleAttributeRepositoryAdapter } from "./app/modules/database/repositories/role-attribute/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "./app/modules/database/repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "./app/modules/database/repositories/scope/repository.mjs";
+import { TrustAnchorRepositoryAdapter } from "./app/modules/database/repositories/trust-anchor/repository.mjs";
 import { UserRepositoryAdapter } from "./app/modules/database/repositories/user/repository.mjs";
 import { UserAttributeRepositoryAdapter } from "./app/modules/database/repositories/user-attribute/repository.mjs";
+import { UserAuthenticatorRepositoryAdapter } from "./app/modules/database/repositories/user-authenticator/repository.mjs";
 import { UserPermissionRepositoryAdapter } from "./app/modules/database/repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "./app/modules/database/repositories/user-role/repository.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./app/modules/database/repositories/identity-provider-role-mapping/repository.mjs";
+import { DatabaseInjectionKey } from "./app/modules/database/constants.mjs";
+import { LoggerInjectionKey } from "./app/modules/logger/constants.mjs";
+import { LoggerModule } from "./app/modules/logger/module.mjs";
+import { DatabaseModule } from "./app/modules/database/module.mjs";
 import { ComponentsModule } from "./app/modules/components/module.mjs";
 import { HTTPInjectionKey } from "./app/modules/http/constants.mjs";
-import { RequestHandlerOperation } from "./adapters/http/request/constants.mjs";
-import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./adapters/http/request/permission/helper.mjs";
-import { RequestIdentity, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./adapters/http/request/helpers/identity.mjs";
-import { buildActorContext } from "./adapters/http/request/helpers/actor.mjs";
-import { getBodyRealmID } from "./adapters/http/request/helpers/body-realm-id.mjs";
-import { LOCALE_COOKIE, useRequestLocale } from "./adapters/http/request/helpers/locale.mjs";
-import { readFromLocations } from "./adapters/http/request/helpers/locations.mjs";
-import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./adapters/http/request/helpers/param-id.mjs";
-import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./adapters/http/request/helpers/realm-id.mjs";
-import { sanitizeRelativeRedirect } from "./adapters/http/request/helpers/redirect.mjs";
-import { setRequestScopes, useRequestScopes } from "./adapters/http/request/helpers/scopes.mjs";
-import { setRequestSessionId, useRequestSessionId } from "./adapters/http/request/helpers/session-id.mjs";
-import { setRequestToken, useRequestToken } from "./adapters/http/request/helpers/token.mjs";
-import { RequestPermissionEvaluator } from "./adapters/http/request/permission/module.mjs";
 import { AuthorizationMiddleware } from "./adapters/http/middleware/built-in/authorization/module.mjs";
 import { createAuthorizationMiddleware } from "./adapters/http/middleware/built-in/authorization/factory.mjs";
 import { ForceLoggedInMiddleware } from "./adapters/http/middleware/built-in/loggedin/module.mjs";
@@ -128,11 +132,14 @@ import { registerBasicMiddleware } from "./adapters/http/middleware/built-in/bas
 import { registerCorsMiddleware } from "./adapters/http/middleware/built-in/cors.mjs";
 import { registerErrorMiddleware } from "./adapters/http/middleware/built-in/error.mjs";
 import { createLoggerMiddleware, redactSensitiveURLParams } from "./adapters/http/middleware/built-in/logger.mjs";
-import { registerPrometheusMiddleware } from "./adapters/http/middleware/built-in/prometheus.mjs";
+import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./adapters/http/middleware/built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./adapters/http/middleware/built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./adapters/http/middleware/built-in/swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./adapters/http/middleware/built-in/ui-http-client.mjs";
+import { MetricsInjectionKey } from "./app/modules/metrics/constants.mjs";
+import { PromAuthFlowMetrics } from "./app/modules/metrics/prom.mjs";
 import { HTTPOAuth2Authorizer } from "./adapters/http/adapters/oauth2/authorization/module.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./adapters/http/adapters/oauth2/grant-types/utils/certificate.mjs";
 import { extractClientCredentialsFromRequest, readStringField } from "./adapters/http/adapters/oauth2/grant-types/utils/credentials.mjs";
 import { guessOauth2GrantTypeByRequest } from "./adapters/http/adapters/oauth2/grant-types/utils/guess.mjs";
 import { readRealmHint } from "./adapters/http/adapters/oauth2/grant-types/utils/realm.mjs";
@@ -141,7 +148,6 @@ import { HTTPClientCredentialsGrant } from "./adapters/http/adapters/oauth2/gran
 import { HTTPOAuth2IdentityGrantType } from "./adapters/http/adapters/oauth2/grant-types/identity.mjs";
 import { HTTPPasswordGrant } from "./adapters/http/adapters/oauth2/grant-types/password.mjs";
 import { HTTPOAuth2RefreshTokenGrant } from "./adapters/http/adapters/oauth2/grant-types/refresh_token.mjs";
-import { HTTPRobotCredentialsGrant } from "./adapters/http/adapters/oauth2/grant-types/robot-credentials.mjs";
 import { ClientController } from "./adapters/http/controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./adapters/http/controllers/entities/client-permission/module.mjs";
 import { ClientPermissionRequestValidator } from "./adapters/http/controllers/entities/client-permission/utils/validation.mjs";
@@ -149,11 +155,15 @@ import { ClientRoleRequestValidator } from "./adapters/http/controllers/entities
 import { ClientRoleController } from "./adapters/http/controllers/entities/client-role/module.mjs";
 import { ClientScopeController } from "./adapters/http/controllers/entities/client-scope/module.mjs";
 import { ClientScopeRequestValidator } from "./adapters/http/controllers/entities/client-scope/utils/validator.mjs";
+import { ConsentController } from "./adapters/http/controllers/entities/consent/module.mjs";
+import { EventController } from "./adapters/http/controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "./adapters/http/controllers/entities/identity-provider/module.mjs";
 import { IdentityProviderRoleMappingController } from "./adapters/http/controllers/entities/identity-provide-role/module.mjs";
+import { KeyController } from "./adapters/http/controllers/entities/key/module.mjs";
 import { PermissionController } from "./adapters/http/controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./adapters/http/controllers/entities/permission-policy/module.mjs";
 import { ActivateController } from "./adapters/http/controllers/workflows/activate/module.mjs";
+import { AuthenticatorChallengeController } from "./adapters/http/controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./adapters/http/controllers/workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./adapters/http/controllers/workflows/jwks/handlers/read.mjs";
 import { JwkController } from "./adapters/http/controllers/workflows/jwks/module.mjs";
@@ -165,11 +175,6 @@ import { RegisterController } from "./adapters/http/controllers/workflows/regist
 import { StatusController } from "./adapters/http/controllers/workflows/status/module.mjs";
 import { TokenController } from "./adapters/http/controllers/workflows/token/module.mjs";
 import { RealmController } from "./adapters/http/controllers/entities/realm/module.mjs";
-import { RobotController } from "./adapters/http/controllers/entities/robot/module.mjs";
-import { RobotPermissionController } from "./adapters/http/controllers/entities/robot-permission/module.mjs";
-import { RobotPermissionRequestValidator } from "./adapters/http/controllers/entities/robot-permission/utils/validation.mjs";
-import { RobotRoleController } from "./adapters/http/controllers/entities/robot-role/module.mjs";
-import { RobotRoleRequestValidator } from "./adapters/http/controllers/entities/robot-role/utils/validation.mjs";
 import { RoleController } from "./adapters/http/controllers/entities/role/module.mjs";
 import { RoleAttributeController } from "./adapters/http/controllers/entities/role-attribute/module.mjs";
 import { RoleAttributeRequestValidator } from "./adapters/http/controllers/entities/role-attribute/utils/validation.mjs";
@@ -180,9 +185,11 @@ import { PolicyAttributesValidator } from "./adapters/http/controllers/entities/
 import { PolicyValidator } from "./adapters/http/controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./adapters/http/controllers/entities/scope/module.mjs";
 import { SessionController } from "./adapters/http/controllers/entities/session/module.mjs";
+import { TrustAnchorController } from "./adapters/http/controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "./adapters/http/controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./adapters/http/controllers/entities/user-attribute/module.mjs";
 import { UserAttributeRequestValidator } from "./adapters/http/controllers/entities/user-attribute/utils/validation.mjs";
+import { UserAuthenticatorController } from "./adapters/http/controllers/entities/user-authenticator/module.mjs";
 import { UserPermissionController } from "./adapters/http/controllers/entities/user-permission/module.mjs";
 import { UserPermissionRequestValidator } from "./adapters/http/controllers/entities/user-permission/utils/validation.mjs";
 import { UserRoleController } from "./adapters/http/controllers/entities/user-role/module.mjs";
@@ -195,7 +202,6 @@ import { IdentityProviderAttributeMappingRepository } from "./app/modules/identi
 import { IdentityProviderPermissionMappingRepository } from "./app/modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./app/modules/identity/repositories/provider/mapper/role.mjs";
 import { ClientIdentityRepository } from "./app/modules/identity/repositories/client.mjs";
-import { RobotIdentityRepository } from "./app/modules/identity/repositories/robot.mjs";
 import { UserIdentityRepository } from "./app/modules/identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./app/modules/ldap/constants.mjs";
 import { LdapModule } from "./app/modules/ldap/module.mjs";
@@ -218,4 +224,4 @@ import { defineCLIResetCommand } from "./cli/commands/reset.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthorizationMiddleware, AuthorizeController, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, HTTPRobotCredentialsGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyEntity, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RobotController, RobotEntity, RobotIdentityRepository, RobotPermissionController, RobotPermissionEntity, RobotPermissionRepositoryAdapter, RobotPermissionRequestValidator, RobotPermissionSubscriber, RobotRepositoryAdapter, RobotRoleController, RobotRoleEntity, RobotRoleRepositoryAdapter, RobotRoleRequestValidator, RobotRoleSubscriber, RobotSubscriber, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, TokenController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCredentialsFromRequest, getAppOrigins, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIResetCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };