@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/core/oauth2/scope/resolver.d.ts

@@ -1,4 +1,4 @@
-import type { Client, Robot, User } from '@authup/core-kit';
+import type { Client, User } from '@authup/core-kit';
 import { OAuth2SubKind } from '@authup/specs';
 import type { ObjectLiteral } from 'validup';
 type ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {
@@ -6,7 +6,6 @@ type ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {
 };
 export declare class OAuth2ScopeAttributesResolver {
     protected clientAttributes: ScopeFields<Client>;
-    protected robotAttributes: ScopeFields<Robot>;
     protected userAttributes: ScopeFields<User>;
     /**
      * Resolve attributes for sub kind.
@@ -16,7 +15,6 @@ export declare class OAuth2ScopeAttributesResolver {
      */
     resolveFor(type: OAuth2SubKind, scope: string | string[]): string[];
     resolveForClient(scope: string | string[]): string[];
-    resolveForRobot(scope: string | string[]): string[];
     resolveForUser(scope: string | string[]): string[];
 }
 export {};

package/dist/core/oauth2/scope/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,WAAW,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;CACtC,CAAC;AAEF,qBAAa,6BAA6B;IACtC,SAAS,CAAC,gBAAgB,EAAG,WAAW,CAAC,MAAM,CAAC,CAG9C;IAEF,SAAS,CAAC,eAAe,EAAG,WAAW,CAAC,KAAK,CAAC,CAG5C;IAEF,SAAS,CAAC,cAAc,EAAG,WAAW,CAAC,IAAI,CAAC,CAI1C;IAEF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAYxD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBrD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBpD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;CAiBtD"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/scope/resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAqB,MAAM,eAAe,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,WAAW,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;CACtC,CAAC;AAEF,qBAAa,6BAA6B;IACtC,SAAS,CAAC,gBAAgB,EAAG,WAAW,CAAC,MAAM,CAAC,CAG9C;IAEF,SAAS,CAAC,cAAc,EAAG,WAAW,CAAC,IAAI,CAAC,CAI1C;IAEF;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQxD,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;IAkBrD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAI,MAAM,EAAE;CAiBtD"}

package/dist/core/oauth2/scope/resolver.mjs

@@ -11,34 +11,25 @@ var OAuth2ScopeAttributesResolver = class {
 		[ScopeName.IDENTITY]: ["name"],
 		[ScopeName.OPEN_ID]: [
 			"name",
-			"display_name",
-			"updated_at",
-			"active"
-		]
-	};
-	robotAttributes = {
-		[ScopeName.IDENTITY]: ["name"],
-		[ScopeName.OPEN_ID]: [
-			"name",
-			"display_name",
-			"updated_at",
+			"displayName",
+			"updatedAt",
 			"active"
 		]
 	};
 	userAttributes = {
 		[ScopeName.IDENTITY]: [
 			"name",
-			"display_name",
-			"last_name",
-			"first_name"
+			"displayName",
+			"lastName",
+			"firstName"
 		],
 		[ScopeName.EMAIL]: ["email"],
 		[ScopeName.OPEN_ID]: [
 			"name",
-			"updated_at",
-			"first_name",
-			"last_name",
-			"display_name",
+			"updatedAt",
+			"firstName",
+			"lastName",
+			"displayName",
 			"active",
 			"email"
 		]
@@ -50,7 +41,6 @@ var OAuth2ScopeAttributesResolver = class {
 	* @param scope
 	*/ resolveFor(type, scope) {
 		if (type === OAuth2SubKind.CLIENT) return this.resolveForClient(scope);
-		if (type === OAuth2SubKind.ROBOT) return this.resolveForRobot(scope);
 		return this.resolveForUser(scope);
 	}
 	resolveForClient(scope) {
@@ -65,18 +55,6 @@ var OAuth2ScopeAttributesResolver = class {
 		}
 		return distinctArray(attributes);
 	}
-	resolveForRobot(scope) {
-		const attributes = [];
-		const scopes = unwrapOAuth2Scope(scope);
-		for (const scope of scopes) {
-			if (hasOwnProperty(this.robotAttributes, scope)) attributes.push(...this.robotAttributes[scope]);
-			if (scope === ScopeName.GLOBAL) {
-				attributes.push(...Object.values(this.robotAttributes).flat());
-				break;
-			}
-		}
-		return distinctArray(attributes);
-	}
 	resolveForUser(scope) {
 		const attributes = [];
 		const scopes = unwrapOAuth2Scope(scope);

package/dist/core/oauth2/scope/resolver.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","robotAttributes","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","ROBOT","resolveForRobot","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Robot, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected robotAttributes : ScopeFields<Robot> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'display_name', 'updated_at', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'display_name', 'last_name', 'first_name'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updated_at', 'first_name', 'last_name', 'display_name', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        if (type === OAuth2SubKind.ROBOT) {\n            return this.resolveForRobot(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForRobot(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.robotAttributes, scope)) {\n                attributes.push(...this.robotAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.robotAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUC,kBAAuC;GAC5CT,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAgB;GAAc;;CAChE;CAEUE,iBAAqC;GAC1CV,UAAUO,WAAW;GAAC;GAAQ;GAAgB;GAAa;;GAC3DP,UAAUW,QAAQ,CAAC,OAAA;GACnBX,UAAUQ,UAAU;GAAC;GAAQ;GAAc;GAAc;GAAa;GAAgB;GAAU;;CACrG;;;;;;IAQAI,WAAWC,MAAqBC,OAA0B;EACtD,IAAID,SAASX,cAAca,QACvB,OAAO,KAAKC,iBAAiBF,KAAAA;EAGjC,IAAID,SAASX,cAAce,OACvB,OAAO,KAAKC,gBAAgBJ,KAAAA;EAGhC,OAAO,KAAKK,eAAeL,KAAAA;CAC/B;CAEAE,iBAAiBF,OAAqC;EAClD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKK,kBAAkBQ,KAAAA,GACtCM,WAAWE,KAAI,GAAI,KAAKhB,iBAAiBQ,MAAM;GAGnD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKnB,gBAAgB,CAAA,CAAEoB,KAAI,CAAA;IAC5D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAF,gBAAgBJ,OAAqC;EACjD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKQ,iBAAiBK,KAAAA,GACrCM,WAAWE,KAAI,GAAI,KAAKb,gBAAgBK,MAAM;GAGlD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,eAAe,CAAA,CAAEiB,KAAI,CAAA;IAC3D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;CAEAD,eAAeL,OAAqC;EAChD,MAAMM,aAAwB,CAAA;EAC9B,MAAMC,SAASlB,kBAAkBW,KAAAA;EAEjC,KAAK,MAAMA,SAASO,QAAQ;GACxB,IAAIpB,eAAe,KAAKS,gBAAgBI,KAAAA,GACpCM,WAAWE,KAAI,GAAI,KAAKZ,eAAeI,MAAM;GAGjD,IAAIA,UAAUd,UAAUuB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKf,cAAc,CAAA,CAAEgB,KAAI,CAAA;IAC1D;GACJ;EACJ;EAEA,OAAOtB,cAAcgB,UAAAA;CACzB;AACJ"}
+{"version":3,"file":"resolver.mjs","names":["ScopeName","hasOwnProperty","OAuth2SubKind","unwrapOAuth2Scope","distinctArray","OAuth2ScopeAttributesResolver","clientAttributes","IDENTITY","OPEN_ID","userAttributes","EMAIL","resolveFor","type","scope","CLIENT","resolveForClient","resolveForUser","attributes","scopes","push","GLOBAL","Object","values","flat"],"sources":["../../../../src/core/oauth2/scope/resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, User } from '@authup/core-kit';\nimport { ScopeName } from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport { OAuth2SubKind, unwrapOAuth2Scope } from '@authup/specs';\nimport { distinctArray } from 'smob';\nimport type { ObjectLiteral } from 'validup';\n\ntype ScopeFields<T extends ObjectLiteral = ObjectLiteral> = {\n    [key: string]: (keyof T & string)[]\n};\n\nexport class OAuth2ScopeAttributesResolver {\n    protected clientAttributes : ScopeFields<Client> = {\n        [ScopeName.IDENTITY]: ['name'],\n        [ScopeName.OPEN_ID]: ['name', 'displayName', 'updatedAt', 'active'],\n    };\n\n    protected userAttributes : ScopeFields<User> = {\n        [ScopeName.IDENTITY]: ['name', 'displayName', 'lastName', 'firstName'],\n        [ScopeName.EMAIL]: ['email'],\n        [ScopeName.OPEN_ID]: ['name', 'updatedAt', 'firstName', 'lastName', 'displayName', 'active', 'email'],\n    };\n\n    /**\n     * Resolve attributes for sub kind.\n     *\n     * @param type\n     * @param scope\n     */\n    resolveFor(type: OAuth2SubKind, scope: string | string[]) {\n        if (type === OAuth2SubKind.CLIENT) {\n            return this.resolveForClient(scope);\n        }\n\n        return this.resolveForUser(scope);\n    }\n\n    resolveForClient(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.clientAttributes, scope)) {\n                attributes.push(...this.clientAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.clientAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n\n    resolveForUser(scope: string | string[]) : string[] {\n        const attributes : string[] = [];\n        const scopes = unwrapOAuth2Scope(scope);\n\n        for (const scope of scopes) {\n            if (hasOwnProperty(this.userAttributes, scope)) {\n                attributes.push(...this.userAttributes[scope]);\n            }\n\n            if (scope === ScopeName.GLOBAL) {\n                attributes.push(...Object.values(this.userAttributes).flat());\n                break;\n            }\n        }\n\n        return distinctArray(attributes);\n    }\n}\n"],"mappings":";;;;;;;;AAkBA,IAAaK,gCAAb,MAAaA;CACCC,mBAAyC;GAC9CN,UAAUO,WAAW,CAAC,MAAA;GACtBP,UAAUQ,UAAU;GAAC;GAAQ;GAAe;GAAa;;CAC9D;CAEUC,iBAAqC;GAC1CT,UAAUO,WAAW;GAAC;GAAQ;GAAe;GAAY;;GACzDP,UAAUU,QAAQ,CAAC,OAAA;GACnBV,UAAUQ,UAAU;GAAC;GAAQ;GAAa;GAAa;GAAY;GAAe;GAAU;;CACjG;;;;;;IAQAG,WAAWC,MAAqBC,OAA0B;EACtD,IAAID,SAASV,cAAcY,QACvB,OAAO,KAAKC,iBAAiBF,KAAAA;EAGjC,OAAO,KAAKG,eAAeH,KAAAA;CAC/B;CAEAE,iBAAiBF,OAAqC;EAClD,MAAMI,aAAwB,CAAA;EAC9B,MAAMC,SAASf,kBAAkBU,KAAAA;EAEjC,KAAK,MAAMA,SAASK,QAAQ;GACxB,IAAIjB,eAAe,KAAKK,kBAAkBO,KAAAA,GACtCI,WAAWE,KAAI,GAAI,KAAKb,iBAAiBO,MAAM;GAGnD,IAAIA,UAAUb,UAAUoB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKhB,gBAAgB,CAAA,CAAEiB,KAAI,CAAA;IAC5D;GACJ;EACJ;EAEA,OAAOnB,cAAca,UAAAA;CACzB;CAEAD,eAAeH,OAAqC;EAChD,MAAMI,aAAwB,CAAA;EAC9B,MAAMC,SAASf,kBAAkBU,KAAAA;EAEjC,KAAK,MAAMA,SAASK,QAAQ;GACxB,IAAIjB,eAAe,KAAKQ,gBAAgBI,KAAAA,GACpCI,WAAWE,KAAI,GAAI,KAAKV,eAAeI,MAAM;GAGjD,IAAIA,UAAUb,UAAUoB,QAAQ;IAC5BH,WAAWE,KAAI,GAAIE,OAAOC,OAAO,KAAKb,cAAc,CAAA,CAAEc,KAAI,CAAA;IAC1D;GACJ;EACJ;EAEA,OAAOnB,cAAca,UAAAA;CACzB;AACJ"}

package/dist/core/oauth2/session-token/types.d.ts

@@ -1,17 +1,17 @@
 import type { SessionToken, SessionTokenKind } from '@authup/core-kit';
 export type SessionTokenCreateInput = {
     id: string;
-    session_id: string;
+    sessionId: string;
     kind: SessionTokenKind;
-    parent_id?: string | null;
-    refresh_token_id?: string | null;
-    ip_address: string;
-    user_agent: string;
-    expires_at: string;
+    parentId?: string | null;
+    refreshTokenId?: string | null;
+    ipAddress: string;
+    userAgent: string;
+    expiresAt: string;
 };
 export type SessionTokenRef = {
     id: string;
-    expires_at: string;
+    expiresAt: string;
 };
 export interface ISessionTokenRepository {
     /**
@@ -61,7 +61,7 @@ export interface ISessionTokenRepository {
      */
     revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
     /**
-     * Delete every token row whose `expires_at` is before the given timestamp.
+     * Delete every token row whose `expiresAt` is before the given timestamp.
      *
      * @param before iso timestamp
      */

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -30,12 +30,12 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		await this.repository.saveWithSignature(data, token);
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
-			session_id: data.session_id,
+			sessionId: data.session_id,
 			kind: "access",
-			refresh_token_id: input.refresh_token_id ?? null,
-			ip_address: data.remote_address ?? "",
-			user_agent: data.user_agent ?? "",
-			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+			refreshTokenId: input.refresh_token_id ?? null,
+			ipAddress: data.remote_address ?? "",
+			userAgent: data.user_agent ?? "",
+			expiresAt: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
 		});
 		return [token, data];
 	}
@@ -50,8 +50,8 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		});
 		const realmRoles = [];
 		const globalRoles = [];
-		for (const role of roles) if (!role.realm_id) globalRoles.push(role.name);
-		else if (input.realm_id && role.realm_id === input.realm_id) realmRoles.push(role.name);
+		for (const role of roles) if (!role.realmId) globalRoles.push(role.name);
+		else if (input.realm_id && role.realmId === input.realm_id) realmRoles.push(role.name);
 		return {
 			realm_access: { roles: realmRoles },
 			global_access: { roles: globalRoles }

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","refresh_token_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'access',\n                refresh_token_id: input.refresh_token_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realm_id) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realm_id === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,kBAAkBlB,MAAMkB,oBAAoB;GAC5CC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAMyB,OAAO,CAACzB,MAAM0B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAK/B,qBAAqBgC,YAAY;GACtDC,MAAM7B,MAAM0B;GACZT,IAAIjB,MAAMyB;GACVK,UAAU9B,MAAM+B;GAChBC,SAAShC,MAAMiC;GACfC,WAAWlC,MAAMmC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKL,UACNI,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAIxC,MAAMiC,YAAYK,KAAKL,aAAajC,MAAMiC,UACjDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","refreshTokenId","refresh_token_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'access',\n                refreshTokenId: input.refresh_token_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realmId) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realmId === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,gBAAgBnB,MAAMoB,oBAAoB;GAC1CC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAAA;CACnB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAM4B,OAAO,CAAC5B,MAAM6B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKlC,qBAAqBmC,YAAY;GACtDC,MAAMhC,MAAM6B;GACZZ,IAAIjB,MAAM4B;GACVK,UAAUjC,MAAMkC;GAChBC,SAASnC,MAAMoC;GACfC,WAAWrC,MAAMsC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKN,SACNK,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI3C,MAAMoC,YAAYK,KAAKN,YAAYnC,MAAMoC,UAChDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -26,12 +26,12 @@ var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		await this.repository.saveWithSignature(data, token);
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
-			session_id: data.session_id,
+			sessionId: data.session_id,
 			kind: "refresh",
-			parent_id: input.parent_id ?? null,
-			ip_address: data.remote_address ?? "",
-			user_agent: data.user_agent ?? "",
-			expires_at: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
+			parentId: input.parent_id ?? null,
+			ipAddress: data.remote_address ?? "",
+			userAgent: data.user_agent ?? "",
+			expiresAt: (/* @__PURE__ */ new Date(data.exp * 1e3)).toISOString()
 		});
 		return [token, data];
 	}

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","parent_id","ip_address","remote_address","user_agent","expires_at","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                session_id: data.session_id,\n                kind: 'refresh',\n                parent_id: input.parent_id ?? null,\n                ip_address: data.remote_address ?? '',\n                user_agent: data.user_agent ?? '',\n                expires_at: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTD,YAAYT,KAAKS;GACjBP,MAAM;GACNW,WAAWhB,MAAMgB,aAAa;GAC9BC,YAAYd,KAAKe,kBAAkB;GACnCC,YAAYhB,KAAKgB,cAAc;GAC/BC,6BAAY,IAAIC,KAAKlB,KAAKI,MAAM,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAGJ,OAAO,CAACb,OAAON,IAAAA;CACnB;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","parentId","parent_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'refresh',\n                parentId: input.parent_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,UAAUjB,MAAMkB,aAAa;GAC7BC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAAA;CACnB;AACJ"}

package/dist/core/oauth2/token/signer/module.mjs

@@ -12,23 +12,23 @@ var OAuth2TokenSigner = class {
 	async sign(payload) {
 		if (!payload.realm_id) throw JWKError.invalidRealm();
 		const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);
-		if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+		if (!key.decryptionKey) throw JWKError.decryptionKeyMissing();
 		let token;
 		if (key.type === JWKType.OCT) token = await signToken(payload, {
 			type: JWKType.OCT,
-			key: key.decryption_key,
+			key: key.decryptionKey,
 			keyId: key.id
 		});
 		else if (key.type === JWKType.EC) token = await signToken(payload, {
 			type: key.type,
-			key: key.decryption_key,
-			algorithm: key.signature_algorithm,
+			key: key.decryptionKey,
+			algorithm: key.signatureAlgorithm,
 			keyId: key.id
 		});
 		else token = await signToken(payload, {
 			type: key.type,
-			key: key.decryption_key,
-			algorithm: key.signature_algorithm,
+			key: key.decryptionKey,
+			algorithm: key.signatureAlgorithm,
 			keyId: key.id
 		});
 		return token;

package/dist/core/oauth2/token/signer/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","JWKUse","OAuth2TokenSigner","keyStore","sign","payload","realm_id","invalidRealm","key","resolveOrCreate","SIGNATURE","decryption_key","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signature_algorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyStore : IKeyStore;\n\n    constructor(keyStore : IKeyStore) {\n        this.keyStore = keyStore;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        // highest-priority ACTIVE key — passive keys only verify, and an\n        // all-disabled realm fails loud inside the store.\n        const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);\n\n        if (!key.decryption_key) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryption_key,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryption_key,\n                    algorithm: key.signature_algorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYA,UAAsB;EAC9B,KAAKA,WAAWA;CACpB;CAEA,MAAMC,KAAmCC,SAA8B;EACnE,IAAI,CAACA,QAAQC,UACT,MAAMP,SAASQ,aAAY;EAK/B,MAAMC,MAAM,MAAM,KAAKL,SAASM,gBAAgBJ,QAAQC,UAAUL,OAAOS,SAAS;EAElF,IAAI,CAACF,IAAIG,gBACL,MAAMZ,SAASa,qBAAoB;EAGvC,IAAIC;EACJ,IAAIL,IAAIM,SAASd,QAAQe,KACrBF,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMd,QAAQe;GACdP,KAAKA,IAAIG;GACTK,OAAOR,IAAIS;EACf,CAAA;OAED,IAAIT,IAAIM,SAASd,QAAQkB,IAC5BL,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;OAGJJ,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;EAIR,OAAOJ;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["signToken","JWKError","JWKType","JWKUse","OAuth2TokenSigner","keyStore","sign","payload","realm_id","invalidRealm","key","resolveOrCreate","SIGNATURE","decryptionKey","decryptionKeyMissing","token","type","OCT","keyId","id","EC","algorithm","signatureAlgorithm"],"sources":["../../../../../src/core/oauth2/token/signer/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { type TokenECAlgorithm, type TokenRSAAlgorithm, signToken } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { JWKError, JWKType, JWKUse } from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenSigner } from './types.ts';\n\nexport class OAuth2TokenSigner implements IOAuth2TokenSigner {\n    protected keyStore : IKeyStore;\n\n    constructor(keyStore : IKeyStore) {\n        this.keyStore = keyStore;\n    }\n\n    async sign<T extends OAuth2TokenPayload>(payload: T) : Promise<string> {\n        if (!payload.realm_id) {\n            throw JWKError.invalidRealm();\n        }\n\n        // highest-priority ACTIVE key — passive keys only verify, and an\n        // all-disabled realm fails loud inside the store.\n        const key = await this.keyStore.resolveOrCreate(payload.realm_id, JWKUse.SIGNATURE);\n\n        if (!key.decryptionKey) {\n            throw JWKError.decryptionKeyMissing();\n        }\n\n        let token : string;\n        if (key.type === JWKType.OCT) {\n            token = await signToken(\n                payload,\n                {\n                    type: JWKType.OCT,\n                    key: key.decryptionKey,\n                    keyId: key.id,\n                },\n            );\n        } else if (key.type === JWKType.EC) {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryptionKey,\n                    algorithm: key.signatureAlgorithm as TokenECAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        } else {\n            token = await signToken(\n                payload,\n                {\n                    type: key.type,\n                    key: key.decryptionKey,\n                    algorithm: key.signatureAlgorithm as TokenRSAAlgorithm,\n                    keyId: key.id,\n                },\n            );\n        }\n\n        return token;\n    }\n}\n"],"mappings":";;;;;;AAaA,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYA,UAAsB;EAC9B,KAAKA,WAAWA;CACpB;CAEA,MAAMC,KAAmCC,SAA8B;EACnE,IAAI,CAACA,QAAQC,UACT,MAAMP,SAASQ,aAAY;EAK/B,MAAMC,MAAM,MAAM,KAAKL,SAASM,gBAAgBJ,QAAQC,UAAUL,OAAOS,SAAS;EAElF,IAAI,CAACF,IAAIG,eACL,MAAMZ,SAASa,qBAAoB;EAGvC,IAAIC;EACJ,IAAIL,IAAIM,SAASd,QAAQe,KACrBF,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMd,QAAQe;GACdP,KAAKA,IAAIG;GACTK,OAAOR,IAAIS;EACf,CAAA;OAED,IAAIT,IAAIM,SAASd,QAAQkB,IAC5BL,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;OAGJJ,QAAQ,MAAMf,UACVO,SACA;GACIS,MAAMN,IAAIM;GACVN,KAAKA,IAAIG;GACTQ,WAAWX,IAAIY;GACfJ,OAAOR,IAAIS;EACf,CAAA;EAIR,OAAOJ;CACX;AACJ"}

package/dist/core/oauth2/token/verifier/module.mjs

@@ -32,26 +32,26 @@ var OAuth2TokenVerifier = class {
 		if (key.status === KeyStatus.DISABLED) throw JWKError.notFound(header.kid);
 		switch (key.type) {
 			case JWKType.OCT:
-				if (!key.decryption_key) throw JWKError.decryptionKeyMissing();
+				if (!key.decryptionKey) throw JWKError.decryptionKeyMissing();
 				payload = await verifyToken(token, {
 					type: JWKType.OCT,
-					key: key.decryption_key
+					key: key.decryptionKey
 				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			case JWKType.EC:
-				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
+				if (!key.encryptionKey) throw JWKError.decryptionKeyMissing();
 				payload = await verifyToken(token, {
 					type: key.type,
-					key: key.encryption_key,
-					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
+					key: key.encryptionKey,
+					...key.signatureAlgorithm ? { algorithms: [key.signatureAlgorithm] } : []
 				}, { ignoreExpiry: options.ignoreExpiry });
 				break;
 			default:
-				if (!key.encryption_key) throw JWKError.decryptionKeyMissing();
+				if (!key.encryptionKey) throw JWKError.decryptionKeyMissing();
 				payload = await verifyToken(token, {
 					type: key.type,
-					key: key.encryption_key,
-					...key.signature_algorithm ? { algorithms: [key.signature_algorithm] } : []
+					key: key.encryptionKey,
+					...key.signatureAlgorithm ? { algorithms: [key.signatureAlgorithm] } : []
 				}, { ignoreExpiry: options.ignoreExpiry });
 		}
 		if (!payload.jti) throw JWTError.payloadPropertyInvalid("jti");

package/dist/core/oauth2/token/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","KeyStatus","JWKError","JWKType","JWKUse","JWTError","OAuth2TokenVerifier","keyStore","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","resolveById","notFound","use","SIGNATURE","status","DISABLED","type","OCT","decryption_key","decryptionKeyMissing","ignoreExpiry","EC","encryption_key","signature_algorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm,\n    type TokenRSAAlgorithm,\n    extractTokenHeader,\n    verifyToken,\n} from '@authup/server-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWKError,\n    JWKType,\n    JWKUse,\n    JWTError,\n} from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyStore : IKeyStore;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyStore : IKeyStore,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyStore = keyStore;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyStore.resolveById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // the key store also holds at-rest encryption keys (use: enc) —\n        // those must never verify a token.\n        if (key.use !== JWKUse.SIGNATURE) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // disabled = neither signs nor verifies (passive still verifies).\n        if (key.status === KeyStatus.DISABLED) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryption_key,\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryption_key) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryption_key,\n                        ...(\n                            key.signature_algorithm ?\n                                { algorithms: [key.signature_algorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        // Never populate the shared signature-keyed claims cache on the\n        // exp-ignoring path. An expired token verified with `ignoreExpiry`\n        // (the RP-initiated-logout id_token_hint) would otherwise be re-cached\n        // with buildTTL's 1h fallback (a past exp yields a non-positive ttl),\n        // and the cache-first branch above returns it with no exp re-check on\n        // every subsequent verify — so `/token/introspect` would report an\n        // expired token as active for up to an hour (RFC 7662). Keep the\n        // exp-bypass scoped to this single call.\n        if (!options.ignoreExpiry) {\n            await this.tokenRepository.saveWithSignature(payload, token);\n        }\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;;AAyBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,UACAC,iBACF;EACE,KAAKD,WAAWA;EAChB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK;QAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASrB,mBAAmBa,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,SAASiB,YAAYJ,OAAOC,GAAG;EACtD,IAAI,CAACE,KACD,MAAMrB,SAASuB,SAASL,OAAOC,GAAG;EAKtC,IAAIE,IAAIG,QAAQtB,OAAOuB,WACnB,MAAMzB,SAASuB,SAASL,OAAOC,GAAG;EAItC,IAAIE,IAAIK,WAAW3B,UAAU4B,UACzB,MAAM3B,SAASuB,SAASL,OAAOC,GAAG;EAGtC,QAAQE,IAAIO,MAAZ;GACI,KAAK3B,QAAQ4B;IACT,IAAI,CAACR,IAAIS,gBACL,MAAM9B,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAM3B,QAAQ4B;KACdR,KAAKA,IAAIS;IACb,GACA,EAAEE,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ,KAAK/B,QAAQgC;IACT,IAAI,CAACZ,IAAIa,gBACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,sBACA,EAAEC,YAAY,CAACf,IAAIc,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ;IACI,IAAI,CAACX,IAAIa,gBACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,sBACA,EAAEC,YAAY,CAACf,IAAIc,mBAAAA,EAAqB,IACxC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;EAGjD;EAEA,IAAI,CAACpB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAW1C,IAAI,CAACJ,QAAQqB,cACT,MAAM,KAAK1B,gBAAgB+B,kBAAkBzB,SAASF,KAAAA;EAG1D,IAAI,CAACC,QAAQK;OAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["extractTokenHeader","verifyToken","KeyStatus","JWKError","JWKType","JWKUse","JWTError","OAuth2TokenVerifier","keyStore","tokenRepository","isInactive","id","verify","token","options","payload","findOneBySignature","jti","payloadPropertyInvalid","skipActiveCheck","notActive","header","kid","headerPropertyInvalid","key","resolveById","notFound","use","SIGNATURE","status","DISABLED","type","OCT","decryptionKey","decryptionKeyMissing","ignoreExpiry","EC","encryptionKey","signatureAlgorithm","algorithms","saveWithSignature"],"sources":["../../../../../src/core/oauth2/token/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    type TokenECAlgorithm,\n    type TokenRSAAlgorithm,\n    extractTokenHeader,\n    verifyToken,\n} from '@authup/server-kit';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport {\n    JWKError,\n    JWKType,\n    JWKUse,\n    JWTError,\n} from '@authup/specs';\nimport type { IKeyStore } from '../../../key/index.ts';\nimport type { IOAuth2TokenRepository } from '../repository/types.ts';\nimport type { IOAuth2TokenVerifier, OAuth2TokenVerifyOptions } from './types.ts';\n\nexport class OAuth2TokenVerifier implements IOAuth2TokenVerifier {\n    protected keyStore : IKeyStore;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    constructor(\n        keyStore : IKeyStore,\n        tokenRepository : IOAuth2TokenRepository,\n    ) {\n        this.keyStore = keyStore;\n        this.tokenRepository = tokenRepository;\n    }\n\n    async isInactive(id: string): Promise<boolean> {\n        return this.tokenRepository.isInactive(id);\n    }\n\n    async verify(token: string, options: OAuth2TokenVerifyOptions = {}) : Promise<OAuth2TokenPayload> {\n        let payload = await this.tokenRepository.findOneBySignature(token);\n        if (payload) {\n            if (!payload.jti) {\n                throw JWTError.payloadPropertyInvalid('jti');\n            }\n\n            if (!options.skipActiveCheck) {\n                const isInactive = await this.isInactive(payload.jti);\n                if (isInactive) {\n                    throw JWTError.notActive();\n                }\n            }\n\n            return payload;\n        }\n\n        const header = extractTokenHeader(token);\n        if (!header.kid) {\n            throw JWTError.headerPropertyInvalid('kid');\n        }\n\n        const key = await this.keyStore.resolveById(header.kid);\n        if (!key) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // the key store also holds at-rest encryption keys (use: enc) —\n        // those must never verify a token.\n        if (key.use !== JWKUse.SIGNATURE) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        // disabled = neither signs nor verifies (passive still verifies).\n        if (key.status === KeyStatus.DISABLED) {\n            throw JWKError.notFound(header.kid);\n        }\n\n        switch (key.type) {\n            case JWKType.OCT: {\n                if (!key.decryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: JWKType.OCT,\n                        key: key.decryptionKey,\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            case JWKType.EC: {\n                if (!key.encryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryptionKey,\n                        ...(\n                            key.signatureAlgorithm ?\n                                { algorithms: [key.signatureAlgorithm] } :\n                                []\n                        ) as TokenECAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n                break;\n            }\n            default: {\n                if (!key.encryptionKey) {\n                    throw JWKError.decryptionKeyMissing();\n                }\n\n                payload = await verifyToken(\n                    token,\n                    {\n                        type: key.type,\n                        key: key.encryptionKey,\n                        ...(\n                            key.signatureAlgorithm ?\n                                { algorithms: [key.signatureAlgorithm] } :\n                                []\n                        ) as TokenRSAAlgorithm[],\n                    },\n                    { ignoreExpiry: options.ignoreExpiry },\n                );\n            }\n        }\n\n        if (!payload.jti) {\n            throw JWTError.payloadPropertyInvalid('jti');\n        }\n\n        // Never populate the shared signature-keyed claims cache on the\n        // exp-ignoring path. An expired token verified with `ignoreExpiry`\n        // (the RP-initiated-logout id_token_hint) would otherwise be re-cached\n        // with buildTTL's 1h fallback (a past exp yields a non-positive ttl),\n        // and the cache-first branch above returns it with no exp re-check on\n        // every subsequent verify — so `/token/introspect` would report an\n        // expired token as active for up to an hour (RFC 7662). Keep the\n        // exp-bypass scoped to this single call.\n        if (!options.ignoreExpiry) {\n            await this.tokenRepository.saveWithSignature(payload, token);\n        }\n\n        if (!options.skipActiveCheck) {\n            const isInactive = await this.isInactive(payload.jti);\n            if (isInactive) {\n                throw JWTError.notActive();\n            }\n        }\n\n        return payload;\n    }\n}\n"],"mappings":";;;;;;;AAyBA,IAAaO,sBAAb,MAAaA;CACCC;CAEAC;CAEV,YACID,UACAC,iBACF;EACE,KAAKD,WAAWA;EAChB,KAAKC,kBAAkBA;CAC3B;CAEA,MAAMC,WAAWC,IAA8B;EAC3C,OAAO,KAAKF,gBAAgBC,WAAWC,EAAAA;CAC3C;CAEA,MAAMC,OAAOC,OAAeC,UAAoC,CAAC,GAAiC;EAC9F,IAAIC,UAAU,MAAM,KAAKN,gBAAgBO,mBAAmBH,KAAAA;EAC5D,IAAIE,SAAS;GACT,IAAI,CAACA,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;GAG1C,IAAI,CAACJ,QAAQK;QAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;GAAA;GAIhC,OAAOL;EACX;EAEA,MAAMM,SAASrB,mBAAmBa,KAAAA;EAClC,IAAI,CAACQ,OAAOC,KACR,MAAMhB,SAASiB,sBAAsB,KAAA;EAGzC,MAAMC,MAAM,MAAM,KAAKhB,SAASiB,YAAYJ,OAAOC,GAAG;EACtD,IAAI,CAACE,KACD,MAAMrB,SAASuB,SAASL,OAAOC,GAAG;EAKtC,IAAIE,IAAIG,QAAQtB,OAAOuB,WACnB,MAAMzB,SAASuB,SAASL,OAAOC,GAAG;EAItC,IAAIE,IAAIK,WAAW3B,UAAU4B,UACzB,MAAM3B,SAASuB,SAASL,OAAOC,GAAG;EAGtC,QAAQE,IAAIO,MAAZ;GACI,KAAK3B,QAAQ4B;IACT,IAAI,CAACR,IAAIS,eACL,MAAM9B,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAM3B,QAAQ4B;KACdR,KAAKA,IAAIS;IACb,GACA,EAAEE,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ,KAAK/B,QAAQgC;IACT,IAAI,CAACZ,IAAIa,eACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,qBACA,EAAEC,YAAY,CAACf,IAAIc,kBAAAA,EAAoB,IACvC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;IAEzC;GAEJ;IACI,IAAI,CAACX,IAAIa,eACL,MAAMlC,SAAS+B,qBAAoB;IAGvCnB,UAAU,MAAMd,YACZY,OACA;KACIkB,MAAMP,IAAIO;KACVP,KAAKA,IAAIa;KACT,GACIb,IAAIc,qBACA,EAAEC,YAAY,CAACf,IAAIc,kBAAAA,EAAoB,IACvC,CAAA;IAEZ,GACA,EAAEH,cAAcrB,QAAQqB,aAAa,CAAA;EAGjD;EAEA,IAAI,CAACpB,QAAQE,KACT,MAAMX,SAASY,uBAAuB,KAAA;EAW1C,IAAI,CAACJ,QAAQqB,cACT,MAAM,KAAK1B,gBAAgB+B,kBAAkBzB,SAASF,KAAAA;EAG1D,IAAI,CAACC,QAAQK;OAELT,MADqB,KAAKA,WAAWK,QAAQE,GAAG,GAEhD,MAAMX,SAASc,UAAS;EAAA;EAIhC,OAAOL;CACX;AACJ"}

package/dist/core/provisioning/entities/index.d.ts

@@ -2,7 +2,6 @@ export * from './client/index.ts';
 export * from './permission/index.ts';
 export * from './policy/index.ts';
 export * from './realm/index.ts';
-export * from './robot/index.ts';
 export * from './role/index.ts';
 export * from './root/index.ts';
 export * from './scope/index.ts';

package/dist/core/provisioning/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/entities/index.mjs

@@ -11,8 +11,6 @@ import { ClientProvisioningValidator } from "./client/validator.mjs";
 import "./client/index.mjs";
 import { PolicyProvisioningValidator } from "./policy/validator.mjs";
 import "./policy/index.mjs";
-import { RobotProvisioningValidator } from "./robot/validator.mjs";
-import "./robot/index.mjs";
 import { ScopeProvisioningValidator } from "./scope/validator.mjs";
 import "./scope/index.mjs";
 import { UserProvisioningValidator } from "./user/validator.mjs";
@@ -21,4 +19,4 @@ import { RealmProvisioningValidator } from "./realm/validator.mjs";
 import "./realm/index.mjs";
 import { RootProvisioningValidator } from "./root/validator.mjs";
 import "./root/index.mjs";
-export { ClientProvisioningValidator, PermissionProvisioningRelationsValidator, PermissionProvisioningValidator, PolicyProvisioningValidator, RealmProvisioningValidator, RobotProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator, createProvisioningEntitiesValidator };
+export { ClientProvisioningValidator, PermissionProvisioningRelationsValidator, PermissionProvisioningValidator, PolicyProvisioningValidator, RealmProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator, createProvisioningEntitiesValidator };

package/dist/core/provisioning/entities/policy/validator.d.ts

@@ -1,6 +1,8 @@
+import type { ContainerInput, ContainerRunOptions } from 'validup';
 import { Container } from 'validup';
 import type { PolicyProvisioningEntity } from './types.ts';
 export declare class PolicyProvisioningValidator extends Container<PolicyProvisioningEntity> {
+    run(input?: ContainerInput<PolicyProvisioningEntity>, options?: ContainerRunOptions<PolicyProvisioningEntity>): Promise<PolicyProvisioningEntity>;
     protected initialize(): void;
 }
 //# sourceMappingURL=validator.d.ts.map

package/dist/core/provisioning/entities/policy/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,qBAAa,2BAA4B,SAAQ,SAAS,CAAC,wBAAwB,CAAC;IAChF,SAAS,CAAC,UAAU;CAmBvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,SAAS,EAAiC,MAAM,SAAS,CAAC;AAInE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,qBAAa,2BAA4B,SAAQ,SAAS,CAAC,wBAAwB,CAAC;IACjE,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,wBAAwB,CAAC,EAChD,OAAO,CAAC,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,GACxD,OAAO,CAAC,wBAAwB,CAAC;IAuBpC,SAAS,CAAC,UAAU;CAmBvB"}

package/dist/core/provisioning/entities/policy/validator.mjs

@@ -5,11 +5,20 @@ import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
 import "../../strategy/index.mjs";
 import { createProvisioningEntitiesValidator } from "../utils.mjs";
 import { PolicyValidator } from "@authup/core-kit";
-import { Container } from "validup";
+import { BuiltInPolicyType } from "@authup/access";
+import { Container, ValidupError, defineIssueItem } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
 //#region src/core/provisioning/entities/policy/validator.ts
 var PolicyProvisioningValidator = class extends Container {
+	async run(input, options) {
+		const output = await super.run(input, options);
+		if (output.attributes?.type === BuiltInPolicyType.COMPOSITE && (!output.children || output.children.length === 0)) throw new ValidupError([defineIssueItem({
+			path: ["children"],
+			message: "A composite policy must define at least one child policy."
+		})]);
+		return output;
+	}
 	initialize() {
 		super.initialize();
 		const strategyValidator = new ProvisioningStrategyValidator();

package/dist/core/provisioning/entities/policy/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["PolicyValidator","createValidator","Container","z","ProvisioningStrategyValidator","createProvisioningEntitiesValidator","PolicyProvisioningValidator","initialize","strategyValidator","mount","optional","attributesValidator","record","string","any","array","check"],"sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { PolicyValidator } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { PolicyProvisioningEntity } from './types.ts';\n\nexport class PolicyProvisioningValidator extends Container<PolicyProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new PolicyValidator();\n        this.mount('attributes', attributesValidator);\n\n        this.mount('extraAttributes', { optional: true }, createValidator(\n            z.record(z.string(), z.any()),\n        ));\n\n        this.mount('children', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(this)),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;AAeA,IAAaM,8BAAb,cAAiDJ,UAAAA;CACnCK,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIJ,8BAAAA;EAC9B,KAAKK,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIX,gBAAAA;EAChC,KAAKS,MAAM,cAAcE,mBAAAA;EAEzB,KAAKF,MAAM,mBAAmB,EAAEC,UAAU,KAAK,GAAGT,gBAC9CE,EAAES,OAAOT,EAAEU,OAAM,GAAIV,EAAEW,IAAG,CAAA,CAAA,CAAA;EAG9B,KAAKL,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGT,gBACvCE,EACKY,MAAMZ,EAAEW,IAAG,CAAA,CAAA,CACXE,MAAMX,oCAAoC,IAAI,CAAA,CAAA,CAAA;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["BuiltInPolicyType","PolicyValidator","createValidator","Container","ValidupError","defineIssueItem","z","ProvisioningStrategyValidator","createProvisioningEntitiesValidator","PolicyProvisioningValidator","run","input","options","output","attributes","type","COMPOSITE","children","length","path","message","initialize","strategyValidator","mount","optional","attributesValidator","record","string","any","array","check"],"sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType } from '@authup/access';\nimport { PolicyValidator } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport type { ContainerInput, ContainerRunOptions } from 'validup';\nimport { Container, ValidupError, defineIssueItem } from 'validup';\nimport { z } from 'zod';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { PolicyProvisioningEntity } from './types.ts';\n\nexport class PolicyProvisioningValidator extends Container<PolicyProvisioningEntity> {\n    override async run(\n        input?: ContainerInput<PolicyProvisioningEntity>,\n        options?: ContainerRunOptions<PolicyProvisioningEntity>,\n    ): Promise<PolicyProvisioningEntity> {\n        const output = await super.run(input, options);\n\n        // A composite policy with no children can never be satisfied and makes\n        // any permission bound to it permanently un-grantable (#3304). Reject\n        // it up front so provisioning fails at config load with a clear\n        // message, rather than silently provisioning a \"stale\" permission that\n        // only fails — with an opaque empty-issue error — once evaluated.\n        if (\n            output.attributes?.type === BuiltInPolicyType.COMPOSITE &&\n            (!output.children || output.children.length === 0)\n        ) {\n            throw new ValidupError([\n                defineIssueItem({\n                    path: ['children'],\n                    message: 'A composite policy must define at least one child policy.',\n                }),\n            ]);\n        }\n\n        return output;\n    }\n\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new PolicyValidator();\n        this.mount('attributes', attributesValidator);\n\n        this.mount('extraAttributes', { optional: true }, createValidator(\n            z.record(z.string(), z.any()),\n        ));\n\n        this.mount('children', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(this)),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,IAAaS,8BAAb,cAAiDN,UAAAA;CAC7C,MAAeO,IACXC,OACAC,SACiC;EACjC,MAAMC,SAAS,MAAM,MAAMH,IAAIC,OAAOC,OAAAA;EAOtC,IACIC,OAAOC,YAAYC,SAASf,kBAAkBgB,cAC7C,CAACH,OAAOI,YAAYJ,OAAOI,SAASC,WAAW,IAEhD,MAAM,IAAId,aAAa,CACnBC,gBAAgB;GACZc,MAAM,CAAC,UAAA;GACPC,SAAS;EACb,CAAA,CAAA,CACH;EAGL,OAAOP;CACX;CAEUQ,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIf,8BAAAA;EAC9B,KAAKgB,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIxB,gBAAAA;EAChC,KAAKsB,MAAM,cAAcE,mBAAAA;EAEzB,KAAKF,MAAM,mBAAmB,EAAEC,UAAU,KAAK,GAAGtB,gBAC9CI,EAAEoB,OAAOpB,EAAEqB,OAAM,GAAIrB,EAAEsB,IAAG,CAAA,CAAA,CAAA;EAG9B,KAAKL,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGtB,gBACvCI,EACKuB,MAAMvB,EAAEsB,IAAG,CAAA,CAAA,CACXE,MAAMtB,oCAAoC,IAAI,CAAA,CAAA,CAAA;CAE3D;AACJ"}

package/dist/core/provisioning/entities/realm/relations-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AASpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE7D,qBAAa,mCAAoC,SAAQ,SAAS,CAAC,0BAA0B,CAAC;IAC1F,SAAS,CAAC,UAAU;CA8CvB"}
+{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAQpC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE7D,qBAAa,mCAAoC,SAAQ,SAAS,CAAC,0BAA0B,CAAC;IAC1F,SAAS,CAAC,UAAU;CAuCvB"}

package/dist/core/provisioning/entities/realm/relations-validator.mjs

@@ -8,8 +8,6 @@ import "../role/index.mjs";
 import { createProvisioningEntitiesValidator } from "../utils.mjs";
 import { ClientProvisioningValidator } from "../client/validator.mjs";
 import "../client/index.mjs";
-import { RobotProvisioningValidator } from "../robot/validator.mjs";
-import "../robot/index.mjs";
 import { ScopeProvisioningValidator } from "../scope/validator.mjs";
 import "../scope/index.mjs";
 import { UserProvisioningValidator } from "../user/validator.mjs";
@@ -24,13 +22,11 @@ var RealmProvisioningRelationsValidator = class extends Container {
 		const clientValidator = new ClientProvisioningValidator();
 		const roleValidator = new RoleProvisioningValidator();
 		const permissionValidator = new PermissionProvisioningValidator();
-		const robotValidator = new RobotProvisioningValidator();
 		const scopeValidator = new ScopeProvisioningValidator();
 		const userValidator = new UserProvisioningValidator();
 		this.mount("clients", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(clientValidator))));
 		this.mount("roles", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(roleValidator))));
 		this.mount("permissions", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(permissionValidator))));
-		this.mount("robots", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(robotValidator))));
 		this.mount("scopes", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(scopeValidator))));
 		this.mount("users", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(userValidator))));
 	}

package/dist/core/provisioning/entities/realm/relations-validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","ClientProvisioningValidator","PermissionProvisioningValidator","RobotProvisioningValidator","RoleProvisioningValidator","ScopeProvisioningValidator","UserProvisioningValidator","createProvisioningEntitiesValidator","RealmProvisioningRelationsValidator","initialize","clientValidator","roleValidator","permissionValidator","robotValidator","scopeValidator","userValidator","mount","optional","array","any","check"],"sources":["../../../../../src/core/provisioning/entities/realm/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { ClientProvisioningValidator } from '../client/index.ts';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RobotProvisioningValidator } from '../robot/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport { ScopeProvisioningValidator } from '../scope/index.ts';\nimport { UserProvisioningValidator } from '../user/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { RealmProvisioningRelations } from './types.ts';\n\nexport class RealmProvisioningRelationsValidator extends Container<RealmProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const clientValidator = new ClientProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n        const permissionValidator = new PermissionProvisioningValidator();\n        const robotValidator = new RobotProvisioningValidator();\n        const scopeValidator = new ScopeProvisioningValidator();\n        const userValidator = new UserProvisioningValidator();\n\n        this.mount('clients', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(clientValidator)),\n        ));\n\n        this.mount('roles', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(roleValidator)),\n        ));\n\n        this.mount('permissions', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(permissionValidator)),\n        ));\n\n        this.mount('robots', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(robotValidator)),\n        ));\n\n        this.mount('scopes', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(scopeValidator)),\n        ));\n\n        this.mount('users', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(userValidator)),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmBA,IAAaU,sCAAb,cAAyDT,UAAAA;CAC3CU,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,kBAAkB,IAAIT,4BAAAA;EAC5B,MAAMU,gBAAgB,IAAIP,0BAAAA;EAC1B,MAAMQ,sBAAsB,IAAIV,gCAAAA;EAChC,MAAMW,iBAAiB,IAAIV,2BAAAA;EAC3B,MAAMW,iBAAiB,IAAIT,2BAAAA;EAC3B,MAAMU,gBAAgB,IAAIT,0BAAAA;EAE1B,KAAKU,MAAM,WAAW,EAAEC,UAAU,KAAK,GAAGnB,gBACtCE,EACKkB,MAAMlB,EAAEmB,IAAG,CAAA,CAAA,CACXC,MAAMb,oCAAoCG,eAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKM,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGnB,gBACpCE,EACKkB,MAAMlB,EAAEmB,IAAG,CAAA,CAAA,CACXC,MAAMb,oCAAoCI,aAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKK,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGnB,gBAC1CE,EACKkB,MAAMlB,EAAEmB,IAAG,CAAA,CAAA,CACXC,MAAMb,oCAAoCK,mBAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKI,MAAM,UAAU,EAAEC,UAAU,KAAK,GAAGnB,gBACrCE,EACKkB,MAAMlB,EAAEmB,IAAG,CAAA,CAAA,CACXC,MAAMb,oCAAoCM,cAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKG,MAAM,UAAU,EAAEC,UAAU,KAAK,GAAGnB,gBACrCE,EACKkB,MAAMlB,EAAEmB,IAAG,CAAA,CAAA,CACXC,MAAMb,oCAAoCO,cAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKE,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGnB,gBACpCE,EACKkB,MAAMlB,EAAEmB,IAAG,CAAA,CAAA,CACXC,MAAMb,oCAAoCQ,aAAAA,CAAAA,CAAAA,CAAAA;CAEvD;AACJ"}
+{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","ClientProvisioningValidator","PermissionProvisioningValidator","RoleProvisioningValidator","ScopeProvisioningValidator","UserProvisioningValidator","createProvisioningEntitiesValidator","RealmProvisioningRelationsValidator","initialize","clientValidator","roleValidator","permissionValidator","scopeValidator","userValidator","mount","optional","array","any","check"],"sources":["../../../../../src/core/provisioning/entities/realm/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { ClientProvisioningValidator } from '../client/index.ts';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport { ScopeProvisioningValidator } from '../scope/index.ts';\nimport { UserProvisioningValidator } from '../user/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { RealmProvisioningRelations } from './types.ts';\n\nexport class RealmProvisioningRelationsValidator extends Container<RealmProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const clientValidator = new ClientProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n        const permissionValidator = new PermissionProvisioningValidator();\n        const scopeValidator = new ScopeProvisioningValidator();\n        const userValidator = new UserProvisioningValidator();\n\n        this.mount('clients', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(clientValidator)),\n        ));\n\n        this.mount('roles', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(roleValidator)),\n        ));\n\n        this.mount('permissions', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(permissionValidator)),\n        ));\n\n        this.mount('scopes', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(scopeValidator)),\n        ));\n\n        this.mount('users', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(userValidator)),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,IAAaS,sCAAb,cAAyDR,UAAAA;CAC3CS,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,kBAAkB,IAAIR,4BAAAA;EAC5B,MAAMS,gBAAgB,IAAIP,0BAAAA;EAC1B,MAAMQ,sBAAsB,IAAIT,gCAAAA;EAChC,MAAMU,iBAAiB,IAAIR,2BAAAA;EAC3B,MAAMS,gBAAgB,IAAIR,0BAAAA;EAE1B,KAAKS,MAAM,WAAW,EAAEC,UAAU,KAAK,GAAGjB,gBACtCE,EACKgB,MAAMhB,EAAEiB,IAAG,CAAA,CAAA,CACXC,MAAMZ,oCAAoCG,eAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKK,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGjB,gBACpCE,EACKgB,MAAMhB,EAAEiB,IAAG,CAAA,CAAA,CACXC,MAAMZ,oCAAoCI,aAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKI,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGjB,gBAC1CE,EACKgB,MAAMhB,EAAEiB,IAAG,CAAA,CAAA,CACXC,MAAMZ,oCAAoCK,mBAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKG,MAAM,UAAU,EAAEC,UAAU,KAAK,GAAGjB,gBACrCE,EACKgB,MAAMhB,EAAEiB,IAAG,CAAA,CAAA,CACXC,MAAMZ,oCAAoCM,cAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKE,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGjB,gBACpCE,EACKgB,MAAMhB,EAAEiB,IAAG,CAAA,CAAA,CACXC,MAAMZ,oCAAoCO,aAAAA,CAAAA,CAAAA,CAAAA;CAEvD;AACJ"}

package/dist/core/provisioning/entities/realm/types.d.ts

@@ -1,14 +1,12 @@
 import type { Realm } from '@authup/core-kit';
 import type { ClientProvisioningEntity } from '../client/index.ts';
 import type { PermissionProvisioningEntity } from '../permission';
-import type { RobotProvisioningEntity } from '../robot';
 import type { RoleProvisioningEntity } from '../role';
 import type { ScopeProvisioningEntity } from '../scope';
 import type { BaseProvisioningEntity } from '../types.ts';
 import type { UserProvisioningEntity } from '../user';
 export type RealmProvisioningRelations = {
     users?: UserProvisioningEntity[];
-    robots?: RobotProvisioningEntity[];
     clients?: ClientProvisioningEntity[];
     roles?: RoleProvisioningEntity[];
     scopes?: ScopeProvisioningEntity[];

package/dist/core/provisioning/entities/realm/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEtD,MAAM,MAAM,0BAA0B,GAAG;IACrC,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;IAElC,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAA;IAGpC,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAGnC,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG;IAClE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAE1B,SAAS,CAAC,EAAE,0BAA0B,CAAA;CACzC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEtD,MAAM,MAAM,0BAA0B,GAAG;IACrC,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAA;IAGpC,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAGnC,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG;IAClE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAE1B,SAAS,CAAC,EAAE,0BAA0B,CAAA;CACzC,CAAC"}

package/dist/core/provisioning/entities/role/types.d.ts

@@ -11,13 +11,13 @@ export type RoleProvisioningRelations = {
      */
     globalPermissionsExclude?: string[];
     /**
-     * Default realm_scope (own | ownOrNull | any) to stamp on each
+     * Default realmScope (own | ownOrNull | any) to stamp on each
      * role-permission junction entry. Realm reach is a coarse, actor-relative
      * enum on the junction (not a policy).
      */
     globalPermissionsRealmScope?: RealmScope;
     /**
-     * Per-permission realm_scope overrides. Maps a realm_scope value to the
+     * Per-permission realmScope overrides. Maps a realmScope value to the
      * permission names that should use that scope instead of the default.
      */
     globalPermissionsRealmScopeOverrides?: Partial<Record<RealmScope, string[]>>;