@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

package/dist/core/authentication/credential/entities/client/module.mjs

@@ -7,12 +7,12 @@ import { compare, hash } from "@authup/server-kit";
 //#region src/core/authentication/credential/entities/client/module.ts
 var ClientCredentialsService = class {
 	async verify(input, entity) {
-		if (!entity.secret || entity.auth_method !== ClientAuthMethod.SECRET) return false;
-		if (entity.secret_hashed) return compare(input, entity.secret);
+		if (!entity.secret || entity.authMethod !== ClientAuthMethod.SECRET) return false;
+		if (entity.secretHashed) return compare(input, entity.secret);
 		return input === entity.secret;
 	}
 	async protect(input, entity) {
-		if (entity.secret_hashed) return isBCryptHash(input) ? input : hash(input);
+		if (entity.secretHashed) return isBCryptHash(input) ? input : hash(input);
 		return input;
 	}
 	generateSecret() {

package/dist/core/authentication/credential/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientAuthMethod","ClientCredentialsService","verify","input","entity","secret","auth_method","SECRET","secret_hashed","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport { type Client, ClientAuthMethod } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n    async verify(input: string, entity: Client): Promise<boolean> {\n        if (!entity.secret || entity.auth_method !== ClientAuthMethod.SECRET) {\n            return false;\n        }\n\n        if (entity.secret_hashed) {\n            return compare(input, entity.secret);\n        }\n\n        // todo: secret encrypted missing (decrypt)\n\n        return input === entity.secret;\n    }\n\n    async protect(input: string, entity: Pick<Client, 'secret_hashed'>): Promise<string> {\n        if (entity.secret_hashed) {\n            return isBCryptHash(input) ?\n                input :\n                hash(input);\n        }\n\n        // todo: secret encrypted missing (encrypt)\n\n        return input;\n    }\n\n    generateSecret() {\n        return createNanoID(64);\n    }\n}\n"],"mappings":";;;;;;;AAYA,IAAaK,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAUD,OAAOE,gBAAgBN,iBAAiBO,QAC1D,OAAO;EAGX,IAAIH,OAAOI,eACP,OAAOV,QAAQK,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMI,QAAQN,OAAeC,QAAwD;EACjF,IAAIA,OAAOI,eACP,OAAOX,aAAaM,KAAAA,IAChBA,QACAJ,KAAKI,KAAAA;EAKb,OAAOA;CACX;CAEAO,iBAAiB;EACb,OAAOd,aAAa,EAAA;CACxB;AACJ"}
+{"version":3,"file":"module.mjs","names":["createNanoID","isBCryptHash","compare","hash","ClientAuthMethod","ClientCredentialsService","verify","input","entity","secret","authMethod","SECRET","secretHashed","protect","generateSecret"],"sources":["../../../../../../src/core/authentication/credential/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID, isBCryptHash } from '@authup/kit';\nimport { compare, hash } from '@authup/server-kit';\nimport { type Client, ClientAuthMethod } from '@authup/core-kit';\nimport type { ICredentialService } from '../../types.ts';\n\nexport class ClientCredentialsService implements ICredentialService<Client> {\n    async verify(input: string, entity: Client): Promise<boolean> {\n        if (!entity.secret || entity.authMethod !== ClientAuthMethod.SECRET) {\n            return false;\n        }\n\n        if (entity.secretHashed) {\n            return compare(input, entity.secret);\n        }\n\n        // todo: secret encrypted missing (decrypt)\n\n        return input === entity.secret;\n    }\n\n    async protect(input: string, entity: Pick<Client, 'secretHashed'>): Promise<string> {\n        if (entity.secretHashed) {\n            return isBCryptHash(input) ?\n                input :\n                hash(input);\n        }\n\n        // todo: secret encrypted missing (encrypt)\n\n        return input;\n    }\n\n    generateSecret() {\n        return createNanoID(64);\n    }\n}\n"],"mappings":";;;;;;;AAYA,IAAaK,2BAAb,MAAaA;CACT,MAAMC,OAAOC,OAAeC,QAAkC;EAC1D,IAAI,CAACA,OAAOC,UAAUD,OAAOE,eAAeN,iBAAiBO,QACzD,OAAO;EAGX,IAAIH,OAAOI,cACP,OAAOV,QAAQK,OAAOC,OAAOC,MAAM;EAKvC,OAAOF,UAAUC,OAAOC;CAC5B;CAEA,MAAMI,QAAQN,OAAeC,QAAuD;EAChF,IAAIA,OAAOI,cACP,OAAOX,aAAaM,KAAAA,IAChBA,QACAJ,KAAKI,KAAAA;EAKb,OAAOA;CACX;CAEAO,iBAAiB;EACb,OAAOd,aAAa,EAAA;CACxB;AACJ"}

package/dist/core/authentication/credential/entities/index.d.ts

@@ -1,4 +1,3 @@
 export * from './client/index.ts';
-export * from './robot/index.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/credential/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/authentication/credential/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/authentication/credential/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/core/authentication/credential/entities/index.mjs

@@ -3,8 +3,6 @@ import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./client/module.mjs";
 import "./client/index.mjs";
-import { RobotCredentialsService } from "./robot/module.mjs";
-import "./robot/index.mjs";
 import { UserCredentialsService } from "./user/module.mjs";
 import "./user/index.mjs";
-export { ClientCredentialsService, RobotCredentialsService, UserCredentialsService };
+export { ClientCredentialsService, UserCredentialsService };

package/dist/core/authentication/credential/index.mjs

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./entities/client/module.mjs";
-import { RobotCredentialsService } from "./entities/robot/module.mjs";
 import { UserCredentialsService } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
-export { ClientCredentialsService, RobotCredentialsService, UserCredentialsService };
+export { ClientCredentialsService, UserCredentialsService };

package/dist/core/authentication/entities/client/module.mjs

@@ -20,7 +20,7 @@ var ClientAuthenticator = class extends BaseCredentialsAuthenticator {
 		const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);
 		if (!identity || identity.type !== IdentityType.CLIENT) throw new EntityCredentialsInvalidError({ entity: "client" });
 		if (!identity.data.active) throw new EntityInactiveError({ entity: "client" });
-		if (identity.data.auth_method === ClientAuthMethod.SECRET) {
+		if (identity.data.authMethod === ClientAuthMethod.SECRET) {
 			if (!await this.credentialsService.verify(secret, identity.data)) throw new EntityCredentialsInvalidError({ entity: "client" });
 		} else throw OAuth2ClientError.invalid();
 		return identity.data;

package/dist/core/authentication/entities/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","auth_method","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.auth_method === ClientAuthMethod.SECRET) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,gBAAgBrB,iBAAiBsB;OAE3C,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientAuthMethod","IdentityType","EntityCredentialsInvalidError","EntityInactiveError","OAuth2ClientError","ClientCredentialsService","BaseCredentialsAuthenticator","ClientAuthenticator","identityResolver","credentialsService","authenticate","key","secret","realmId","identity","resolve","CLIENT","type","entity","data","active","authMethod","SECRET","verified","verify","invalid"],"sources":["../../../../../src/core/authentication/entities/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client } from '@authup/core-kit';\nimport { ClientAuthMethod, IdentityType } from '@authup/core-kit';\nimport { EntityCredentialsInvalidError, EntityInactiveError } from '@authup/errors';\nimport { OAuth2ClientError } from '@authup/specs';\nimport type { IIdentityResolver } from '../../../identity/index.ts';\nimport { ClientCredentialsService } from '../../credential/index.ts';\nimport { BaseCredentialsAuthenticator } from '../../base.ts';\n\nexport class ClientAuthenticator extends BaseCredentialsAuthenticator<Client> {\n    protected identityResolver : IIdentityResolver;\n\n    protected credentialsService : ClientCredentialsService;\n\n    constructor(identityResolver: IIdentityResolver) {\n        super();\n\n        this.identityResolver = identityResolver;\n        this.credentialsService = new ClientCredentialsService();\n    }\n\n    async authenticate(key: string, secret: string, realmId?: string): Promise<Client> {\n        const identity = await this.identityResolver.resolve(IdentityType.CLIENT, key, realmId);\n        if (!identity || identity.type !== IdentityType.CLIENT) {\n            throw new EntityCredentialsInvalidError({ entity: 'client' });\n        }\n\n        if (!identity.data.active) {\n            throw new EntityInactiveError({ entity: 'client' });\n        }\n\n        if (identity.data.authMethod === ClientAuthMethod.SECRET) {\n            const verified = await this.credentialsService.verify(secret, identity.data);\n            if (!verified) {\n                throw new EntityCredentialsInvalidError({ entity: 'client' });\n            }\n        } else {\n            throw OAuth2ClientError.invalid();\n        }\n\n        return identity.data;\n    }\n}\n"],"mappings":";;;;;;;;;;AAeA,IAAaO,sBAAb,cAAyCD,6BAAAA;CAC3BE;CAEAC;CAEV,YAAYD,kBAAqC;EAC7C,MAAK;EAEL,KAAKA,mBAAmBA;EACxB,KAAKC,qBAAqB,IAAIJ,yBAAAA;CAClC;CAEA,MAAMK,aAAaC,KAAaC,QAAgBC,SAAmC;EAC/E,MAAMC,WAAW,MAAM,KAAKN,iBAAiBO,QAAQd,aAAae,QAAQL,KAAKE,OAAAA;EAC/E,IAAI,CAACC,YAAYA,SAASG,SAAShB,aAAae,QAC5C,MAAM,IAAId,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAG/D,IAAI,CAACJ,SAASK,KAAKC,QACf,MAAM,IAAIjB,oBAAoB,EAAEe,QAAQ,SAAS,CAAA;EAGrD,IAAIJ,SAASK,KAAKE,eAAerB,iBAAiBsB,QAE1C;OAAA,CAACC,MADkB,KAAKd,mBAAmBe,OAAOZ,QAAQE,SAASK,IAAI,GAEvE,MAAM,IAAIjB,8BAA8B,EAAEgB,QAAQ,SAAS,CAAA;EAAA,OAG/D,MAAMd,kBAAkBqB,QAAO;EAGnC,OAAOX,SAASK;CACpB;AACJ"}

package/dist/core/authentication/entities/index.d.ts

@@ -1,4 +1,3 @@
 export * from './client/index.ts';
-export * from './robot/index.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/core/authentication/entities/index.mjs

@@ -3,8 +3,6 @@ import "node:url";
 import.meta.url;
 import { ClientAuthenticator } from "./client/module.mjs";
 import "./client/index.mjs";
-import { RobotAuthenticator } from "./robot/module.mjs";
-import "./robot/index.mjs";
 import { UserAuthenticator } from "./user/module.mjs";
 import "./user/index.mjs";
-export { ClientAuthenticator, RobotAuthenticator, UserAuthenticator };
+export { ClientAuthenticator, UserAuthenticator };

package/dist/core/authentication/index.mjs

@@ -2,12 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "./credential/entities/client/module.mjs";
-import { RobotCredentialsService } from "./credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "./credential/entities/user/module.mjs";
 import "./credential/index.mjs";
 import { BaseCredentialsAuthenticator } from "./base.mjs";
 import { ClientAuthenticator } from "./entities/client/module.mjs";
-import { RobotAuthenticator } from "./entities/robot/module.mjs";
 import { UserAuthenticator } from "./entities/user/module.mjs";
 import "./entities/index.mjs";
 import { LoginThrottleService } from "./login-throttle/service.mjs";
@@ -16,4 +14,4 @@ import { CredentialsAuthenticator } from "./module.mjs";
 import { SessionManager } from "./session/module.mjs";
 import { SESSION_FILTER_KEYS } from "./session/types.mjs";
 import "./session/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, RobotAuthenticator, RobotCredentialsService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/session/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}

package/dist/core/authentication/session/module.mjs

@@ -16,38 +16,35 @@ var SessionManager = class {
 	*
 	* @param input
 	*/ async create(input) {
-		input.ip_address = input.ip_address || "127.0.0.1";
-		input.user_agent = input.user_agent || "system";
-		input.expires_at = input.expires_at || new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
-		switch (input.sub_kind) {
+		input.ipAddress = input.ipAddress || "127.0.0.1";
+		input.userAgent = input.userAgent || "system";
+		input.expiresAt = input.expiresAt || new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		switch (input.subKind) {
 			case IdentityType.CLIENT:
-				input.client_id = input.sub;
-				break;
-			case IdentityType.ROBOT:
-				input.robot_id = input.sub;
+				input.clientId = input.sub;
 				break;
 			case IdentityType.USER:
-				input.user_id = input.sub;
+				input.userId = input.sub;
 				break;
 		}
 		return this.repository.save(input);
 	}
 	async ping(session) {
-		if (session.seen_at) {
-			if (new Date(session.seen_at).getTime() + 5 * 1e3 > Date.now()) return session;
+		if (session.seenAt) {
+			if (new Date(session.seenAt).getTime() + 5 * 1e3 > Date.now()) return session;
 		}
-		session.seen_at = (/* @__PURE__ */ new Date()).toISOString();
+		session.seenAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);
 	}
 	async refresh(session) {
 		const now = (/* @__PURE__ */ new Date()).toISOString();
-		session.refreshed_at = now;
-		session.seen_at = now;
-		session.expires_at = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
+		session.refreshedAt = now;
+		session.seenAt = now;
+		session.expiresAt = new Date(Date.now() + this.options.maxAge * 1e3).toISOString();
 		return this.repository.save(session);
 	}
 	async markMfaVerified(session) {
-		session.mfa_at = (/* @__PURE__ */ new Date()).toISOString();
+		session.mfaAt = (/* @__PURE__ */ new Date()).toISOString();
 		return this.repository.save(session);
 	}
 	/**
@@ -62,7 +59,7 @@ var SessionManager = class {
 		await this.repository.removeById(id);
 	}
 	async verify(session) {
-		const ms = new Date(session.expires_at).getTime();
+		const ms = new Date(session.expiresAt).getTime();
 		if (Date.now() > ms) {
 			await this.repository.remove(session);
 			throw JWTError.expired();

package/dist/core/authentication/session/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ip_address","user_agent","expires_at","Date","now","maxAge","toISOString","sub_kind","CLIENT","client_id","sub","ROBOT","robot_id","USER","user_id","save","ping","session","seen_at","seenAt","getTime","threshold","refresh","refreshed_at","markMfaVerified","mfa_at","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ip_address = input.ip_address || '127.0.0.1';\n        input.user_agent = input.user_agent || 'system';\n        input.expires_at = input.expires_at || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.sub_kind) {\n            case IdentityType.CLIENT: {\n                input.client_id = input.sub;\n                break;\n            }\n            case IdentityType.ROBOT: {\n                input.robot_id = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.user_id = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seen_at) {\n            const seenAt = new Date(session.seen_at).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seen_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshed_at = now;\n        session.seen_at = now;\n\n        session.expires_at = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async markMfaVerified(session: Session): Promise<Session> {\n        session.mfa_at = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expires_at).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,aAAaD,MAAMC,cAAc;EACvCD,MAAME,aAAaF,MAAME,cAAc;EACvCF,MAAMG,aAAaH,MAAMG,cAAc,IAAIC,KACvCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,UAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,YAAYV,MAAMW;IACxB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,WAAWb,MAAMW;IACvB;GAEJ,KAAKlB,aAAaqB;IACdd,MAAMe,UAAUf,MAAMW;IACtB;EAER;EAEA,OAAO,KAAKd,WAAWmB,KAAKhB,KAAAA;CAChC;CAIA,MAAMiB,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC;OACO,IAAIf,KAAKc,QAAQC,OAAO,CAAA,CAAEE,QACvBD,IAAU,IAAI,MAEhBhB,KAAKC,IAAG,GACpB,OAAOa;EAAAA;EAIfA,QAAQC,2BAAU,IAAIf,KAAAA,EAAAA,CAAOG,YAAW;EAExC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMK,QAAQL,SAAoC;EAC9C,MAAMb,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCW,QAAQM,eAAenB;EACvBa,QAAQC,UAAUd;EAElBa,QAAQf,aAAa,IAAIC,KACrBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;CAIA,MAAMO,gBAAgBP,SAAoC;EACtDA,QAAQQ,0BAAS,IAAItB,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWmB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMS,YAAYC,IAAqC;EACnD,OAAO,KAAK/B,WAAW8B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK/B,WAAWiC,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOb,SAAiC;EAC1C,MAAMc,KAAK,IAAI5B,KAAKc,QAAQf,UAAU,CAAA,CAAEkB,QAAO;EAC/C,IAAIjB,KAAKC,IAAG,IAAK2B,IAAI;GACjB,MAAM,KAAKnC,WAAWoC,OAAOf,OAAAA;GAG7B,MAAMxB,SAASwC,QAAO;EAC1B;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ipAddress = input.ipAddress || '127.0.0.1';\n        input.userAgent = input.userAgent || 'system';\n        input.expiresAt = input.expiresAt || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.subKind) {\n            case IdentityType.CLIENT: {\n                input.clientId = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.userId = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seenAt) {\n            const seenAt = new Date(session.seenAt).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seenAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshedAt = now;\n        session.seenAt = now;\n\n        session.expiresAt = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async markMfaVerified(session: Session): Promise<Session> {\n        session.mfaAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expiresAt).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB;IACdZ,MAAMa,SAASb,MAAMW;IACrB;EAER;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,IAAI,MAEhBb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/authentication/session/types.d.ts

@@ -1,4 +1,5 @@
 import type { Session } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
 import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
 export type SessionOwner = {
     sub: string;
@@ -9,7 +10,7 @@ export type SessionOwner = {
  * repository's rapiq `filters.allowed` and the service's "is this a targeted
  * bulk revoke?" discriminator, so the two can never drift.
  */
-export declare const SESSION_FILTER_KEYS: readonly ["id", "sub", "sub_kind", "user_id", "client_id", "robot_id", "realm_id"];
+export declare const SESSION_FILTER_KEYS: readonly ["id", "sub", "subKind", "userId", "clientId", "realmId"];
 export type SessionFindManyOptions = {
     /**
      * Force the result to a single subject (self-service). Applied as a
@@ -19,7 +20,7 @@ export type SessionFindManyOptions = {
 };
 export interface ISessionRepository {
     findOneById(id: string): Promise<Session | null> | null;
-    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
+    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
     findAllByOwner(owner: SessionOwner): Promise<Session[]>;
     /**
      * Load EVERY session matching a rapiq query filter — **unbounded** (no
@@ -27,7 +28,7 @@ export interface ISessionRepository {
      * the admin "force-logout" path; per-session authorization is enforced by
      * the caller (`SessionService`).
      */
-    findAllByQuery(query: Record<string, any>): Promise<Session[]>;
+    findAllByQuery(query: IQuery): Promise<Session[]>;
     save(session: Partial<Session>): Promise<Session>;
     removeById(id: string): Promise<void>;
     remove(session: Session): Promise<void>;
@@ -50,19 +51,19 @@ export interface ISessionManager {
      */
     create(session: Partial<Session>): Promise<Session>;
     /**
-     * Updates seen_at with current time.
+     * Updates seenAt with current time.
      *
      * @param session
      */
     ping(session: Session): Promise<Session>;
     /**
-     * Updates refreshed_at, seen_at with current time.
+     * Updates refreshedAt, seenAt with current time.
      *
      * @param session
      */
     refresh(session: Session): Promise<Session>;
     /**
-     * Stamp a successful second-factor challenge (mfa_at) onto the session.
+     * Stamp a successful second-factor challenge (mfaAt) onto the session.
      *
      * @param session
      */

package/dist/core/authentication/session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oFAQtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzH,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5G,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/core/authentication/session/types.mjs

@@ -9,11 +9,10 @@ import.meta.url;
 */ const SESSION_FILTER_KEYS = [
 	"id",
 	"sub",
-	"sub_kind",
-	"user_id",
-	"client_id",
-	"robot_id",
-	"realm_id"
+	"subKind",
+	"userId",
+	"clientId",
+	"realmId"
 ];
 //#endregion
 export { SESSION_FILTER_KEYS };

package/dist/core/authentication/session/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'sub_kind',\n    'user_id',\n    'client_id',\n    'robot_id',\n    'realm_id',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: Record<string, any>, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: Record<string, any>): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seen_at with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshed_at, seen_at with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Stamp a successful second-factor challenge (mfa_at) onto the session.\n     *\n     * @param session\n     */\n    markMfaVerified(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAoBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA"}
+{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'subKind',\n    'userId',\n    'clientId',\n    'realmId',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: IQuery): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seenAt with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshedAt, seenAt with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Stamp a successful second-factor challenge (mfaAt) onto the session.\n     *\n     * @param session\n     */\n    markMfaVerified(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAqBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;AACH"}

package/dist/core/client-certificate/module.d.ts

@@ -1,3 +1,4 @@
+import './reflect.ts';
 import { X509Certificate } from '@peculiar/x509';
 import type { Client } from '@authup/core-kit';
 import type { ClientCertificateEvidence, ClientCertificateValidatorContext, IClientCertificateValidator } from './types.ts';
@@ -10,7 +11,7 @@ export declare class ClientCertificateValidator implements IClientCertificateVal
     protected crypto?: Crypto;
     constructor(ctx: ClientCertificateValidatorContext);
     validateForBinding(evidence: ClientCertificateEvidence): void;
-    validateForAuthentication(client: Pick<Client, 'id' | 'realm_id'>, evidence: ClientCertificateEvidence): Promise<void>;
+    validateForAuthentication(client: Pick<Client, 'id' | 'realmId'>, evidence: ClientCertificateEvidence): Promise<void>;
 }
 export declare function assertClientCertificateEvidenceValidForBinding(evidence: ClientCertificateEvidence): void;
 export declare function parseClientCertificateChain(pem: string): X509Certificate[];

package/dist/core/client-certificate/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/module.ts"],"names":[],"mappings":"AAOA,OAAO,EAUH,eAAe,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EACR,yBAAyB,EACzB,iCAAiC,EACjC,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAuCpB;;;GAGG;AACH,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,uBAAuB,CAAC,CAAC;IAE5F,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,iCAAiC;IAKlD,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI;IAIvD,yBAAyB,CAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,UAAU,CAAC,EACvC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC;CA0CnB;AAED,wBAAgB,8CAA8C,CAC1D,QAAQ,EAAE,yBAAyB,GACpC,IAAI,CAON;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAW1E;AAED,wBAAsB,gCAAgC,CAClD,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAMjB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/module.ts"],"names":[],"mappings":"AAOA,OAAO,cAAc,CAAC;AACtB,OAAO,EAUH,eAAe,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EACR,yBAAyB,EACzB,iCAAiC,EACjC,2BAA2B,EAC9B,MAAM,YAAY,CAAC;AAuCpB;;;GAGG;AACH,qBAAa,0BAA2B,YAAW,2BAA2B;IAC1E,SAAS,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,uBAAuB,CAAC,CAAC;IAE5F,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,iCAAiC;IAKlD,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI;IAIvD,yBAAyB,CAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,SAAS,CAAC,EACtC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC;CA0CnB;AAED,wBAAgB,8CAA8C,CAC1D,QAAQ,EAAE,yBAAyB,GACpC,IAAI,CAON;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAW1E;AAED,wBAAsB,gCAAgC,CAClD,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAMjB"}

package/dist/core/client-certificate/module.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "./reflect.mjs";
 import { base64URLEncode } from "@authup/kit";
 import { CLIENT_CERTIFICATE_URI_PREFIX, buildClientCertificateURI } from "@authup/core-kit";
 import { ValidationError } from "@authup/errors";
@@ -58,7 +59,7 @@ const ANY_EXTENDED_KEY_USAGE_OID = "2.5.29.37.0";
 		assertCertificateExtensionsUnderstood(evidence.certificate);
 		assertStrongSignature(evidence.certificate);
 		const anchors = await this.trustAnchorRepository.findManyBy({
-			realm_id: client.realm_id,
+			realmId: client.realmId,
 			enabled: true
 		});
 		for (const anchor of anchors) {

package/dist/core/client-certificate/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["AuthorityKeyIdentifierExtension","BasicConstraintsExtension","ExtendedKeyUsage","ExtendedKeyUsageExtension","URL","GENERAL_NAME_URL","KeyUsageFlags","KeyUsagesExtension","SubjectAlternativeNameExtension","SubjectKeyIdentifierExtension","X509Certificate","CLIENT_CERTIFICATE_URI_PREFIX","buildClientCertificateURI","ValidationError","base64URLEncode","MAX_CHAIN_DEPTH","CERTIFICATE_BLOCK_PATTERN","MAX_PATH_SIGNATURE_VERIFICATIONS","HANDLED_CRITICAL_EXTENSION_OIDS","Set","WEAK_SIGNATURE_HASHES","ANY_EXTENDED_KEY_USAGE_OID","ClientCertificateValidator","trustAnchorRepository","crypto","ctx","validateForBinding","evidence","assertClientCertificateEvidenceValidForBinding","validateForAuthentication","client","assertClientCertificatePurpose","certificate","assertClientCertificateIdentity","id","assertCertificateExtensionsUnderstood","assertStrongSignature","anchors","findManyBy","realm_id","enabled","anchor","anchorCertificate","parseAnchorCertificate","budget","remaining","path","buildPath","chain","assertCertificationPath","assertCertificateCurrent","constraints","getExtension","ca","parseClientCertificateChain","pem","blocks","match","length","map","block","buildClientCertificateThumbprint","digest","getThumbprint","String","fromCharCode","Uint8Array","undefined","leaf","intermediates","continuePath","current","available","sameCertificate","isIssuedBy","index","candidate","next","filter","_item","candidateIndex","issuer","subject","authorityKeyIdentifier","keyId","subjectKeyIdentifier","verify","publicKey","signatureOnly","left","right","leftRaw","rawData","rightRaw","every","value","isAnchor","assertIssuerExtendedKeyUsage","keyUsage","usages","keyCertSign","pathLength","extendedKeyUsage","includes","clientAuth","digitalSignature","clientId","subjectAlternativeName","authupUris","names","items","name","type","startsWith","expected","now","Date","notBefore","getTime","notAfter","extension","extensions","critical","has","hash","signatureAlgorithm","toUpperCase"],"sources":["../../../src/core/client-certificate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AuthorityKeyIdentifierExtension,\n    BasicConstraintsExtension,\n    ExtendedKeyUsage,\n    ExtendedKeyUsageExtension,\n    URL as GENERAL_NAME_URL,\n    KeyUsageFlags,\n    KeyUsagesExtension,\n    SubjectAlternativeNameExtension,\n    SubjectKeyIdentifierExtension,\n    X509Certificate,\n} from '@peculiar/x509';\nimport type { Client, TrustAnchor } from '@authup/core-kit';\nimport {\n    CLIENT_CERTIFICATE_URI_PREFIX,\n    buildClientCertificateURI,\n} from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type {\n    ClientCertificateEvidence,\n    ClientCertificateValidatorContext,\n    IClientCertificateValidator,\n} from './types.ts';\n\nconst MAX_CHAIN_DEPTH = 10;\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n\n/**\n * Hard ceiling on signature verifications performed while building a single\n * certification path. A legitimate chain of the maximum accepted length only\n * needs O(depth²) verifications; the ceiling exists purely to defuse the\n * factorial backtracking blow-up an attacker can induce with certificates\n * that mutually \"issue\" one another (shared key, identical subject/issuer\n * DNs). Reaching the ceiling is treated as \"no path found\" (fail closed).\n */\nconst MAX_PATH_SIGNATURE_VERIFICATIONS = 64;\n\n/**\n * OIDs of the certificate extensions this validator actually processes. A\n * certificate carrying a *critical* extension outside this set is rejected\n * (RFC 5280 §4.2): an unprocessed critical constraint must never be silently\n * ignored. Because RFC 5280 requires the NameConstraints extension to be\n * marked critical, this also fails a name-constrained CA closed rather than\n * trusting a chain whose name constraints we do not evaluate.\n */\nconst HANDLED_CRITICAL_EXTENSION_OIDS = new Set<string>([\n    '2.5.29.19', // basicConstraints\n    '2.5.29.15', // keyUsage\n    '2.5.29.37', // extKeyUsage\n    '2.5.29.17', // subjectAltName\n    '2.5.29.35', // authorityKeyIdentifier\n    '2.5.29.14', // subjectKeyIdentifier\n]);\n\nconst WEAK_SIGNATURE_HASHES = new Set<string>(['SHA-1', 'MD5', 'MD2', 'MD4']);\n\n// anyExtendedKeyUsage (RFC 5280 §4.2.1.12) — a CA carrying it is unconstrained.\nconst ANY_EXTENDED_KEY_USAGE_OID = '2.5.29.37.0';\n\ntype SignatureVerificationBudget = { remaining: number };\n\n/**\n * Validates client certificates without performing network I/O. AIA, CRL,\n * and OCSP retrieval are deliberately outside the external-PKI first slice.\n */\nexport class ClientCertificateValidator implements IClientCertificateValidator {\n    protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];\n\n    protected crypto?: Crypto;\n\n    constructor(ctx: ClientCertificateValidatorContext) {\n        this.trustAnchorRepository = ctx.trustAnchorRepository;\n        this.crypto = ctx.crypto;\n    }\n\n    validateForBinding(evidence: ClientCertificateEvidence): void {\n        assertClientCertificateEvidenceValidForBinding(evidence);\n    }\n\n    async validateForAuthentication(\n        client: Pick<Client, 'id' | 'realm_id'>,\n        evidence: ClientCertificateEvidence,\n    ): Promise<void> {\n        this.validateForBinding(evidence);\n        assertClientCertificatePurpose(evidence.certificate);\n        assertClientCertificateIdentity(evidence.certificate, client.id);\n        assertCertificateExtensionsUnderstood(evidence.certificate);\n        assertStrongSignature(evidence.certificate);\n\n        const anchors = await this.trustAnchorRepository.findManyBy({\n            realm_id: client.realm_id,\n            enabled: true,\n        });\n\n        for (const anchor of anchors) {\n            const anchorCertificate = parseAnchorCertificate(anchor);\n            if (!anchorCertificate) {\n                continue;\n            }\n\n            const budget: SignatureVerificationBudget = { remaining: MAX_PATH_SIGNATURE_VERIFICATIONS };\n            const path = await buildPath(\n                evidence.certificate,\n                evidence.chain,\n                anchorCertificate,\n                budget,\n                this.crypto,\n            );\n            if (!path) {\n                continue;\n            }\n\n            try {\n                assertCertificationPath(path);\n                return;\n            } catch {\n                // A chain reaching this anchor failed its CA constraints;\n                // another enabled anchor may still yield a valid path.\n                continue;\n            }\n        }\n\n        throw new ValidationError('The client certificate is not trusted in this realm.');\n    }\n}\n\nexport function assertClientCertificateEvidenceValidForBinding(\n    evidence: ClientCertificateEvidence,\n): void {\n    assertCertificateCurrent(evidence.certificate);\n\n    const constraints = evidence.certificate.getExtension(BasicConstraintsExtension);\n    if (constraints?.ca) {\n        throw new ValidationError('A CA certificate cannot be used as a client certificate.');\n    }\n}\n\nexport function parseClientCertificateChain(pem: string): X509Certificate[] {\n    const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n    if (!blocks || blocks.length === 0) {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n\n    try {\n        return blocks.map((block) => new X509Certificate(block));\n    } catch {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n}\n\nexport async function buildClientCertificateThumbprint(\n    certificate: X509Certificate,\n    crypto?: Crypto,\n): Promise<string> {\n    const digest = await certificate.getThumbprint('SHA-256', crypto);\n\n    return base64URLEncode(\n        String.fromCharCode(...new Uint8Array(digest)),\n    );\n}\n\nfunction parseAnchorCertificate(anchor: TrustAnchor): X509Certificate | undefined {\n    try {\n        return parseClientCertificateChain(anchor.certificate)[0];\n    } catch {\n        // Rows are validated on create. Treat a corrupt legacy/database row as\n        // unusable trust material instead of turning client authentication into\n        // a 500 or accidentally trusting another certificate in its PEM chain.\n        return undefined;\n    }\n}\n\nasync function buildPath(\n    leaf: X509Certificate,\n    intermediates: X509Certificate[],\n    anchor: X509Certificate,\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n    return continuePath(leaf, intermediates, anchor, [leaf], budget, crypto);\n}\n\nasync function continuePath(\n    current: X509Certificate,\n    available: X509Certificate[],\n    anchor: X509Certificate,\n    path: X509Certificate[],\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n    if (path.length > MAX_CHAIN_DEPTH) {\n        return undefined;\n    }\n\n    if (sameCertificate(current, anchor)) {\n        return path;\n    }\n\n    if (await isIssuedBy(current, anchor, budget, crypto)) {\n        return [...path, anchor];\n    }\n\n    for (let index = 0; index < available.length; index += 1) {\n        const candidate = available[index];\n        if (\n            !candidate ||\n            sameCertificate(current, candidate) ||\n            !await isIssuedBy(current, candidate, budget, crypto)\n        ) {\n            continue;\n        }\n\n        const next = await continuePath(\n            candidate,\n            available.filter((_item, candidateIndex) => candidateIndex !== index),\n            anchor,\n            [...path, candidate],\n            budget,\n            crypto,\n        );\n        if (next) {\n            return next;\n        }\n    }\n\n    return undefined;\n}\n\nasync function isIssuedBy(\n    certificate: X509Certificate,\n    issuer: X509Certificate,\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<boolean> {\n    if (certificate.issuer !== issuer.subject) {\n        return false;\n    }\n\n    const authorityKeyIdentifier = certificate.getExtension(AuthorityKeyIdentifierExtension);\n    if (authorityKeyIdentifier?.keyId) {\n        const subjectKeyIdentifier = issuer.getExtension(SubjectKeyIdentifierExtension);\n        if (subjectKeyIdentifier && subjectKeyIdentifier.keyId !== authorityKeyIdentifier.keyId) {\n            return false;\n        }\n    }\n\n    // Spend from the shared verification budget only for the expensive\n    // cryptographic check (the DN / key-id pre-filters above are cheap). Once\n    // exhausted, treat every further edge as unverified so a maliciously\n    // crafted mutually-issuing certificate set cannot force factorial work.\n    if (budget.remaining <= 0) {\n        return false;\n    }\n    budget.remaining -= 1;\n\n    try {\n        return await certificate.verify({\n            publicKey: issuer,\n            signatureOnly: true,\n        }, crypto);\n    } catch {\n        return false;\n    }\n}\n\nfunction sameCertificate(left: X509Certificate, right: X509Certificate): boolean {\n    const leftRaw = new Uint8Array(left.rawData);\n    const rightRaw = new Uint8Array(right.rawData);\n\n    return leftRaw.length === rightRaw.length &&\n        leftRaw.every((value, index) => value === rightRaw[index]);\n}\n\nfunction assertCertificationPath(path: X509Certificate[]): void {\n    if (path.length < 2) {\n        throw new ValidationError('The client certificate chain is invalid.');\n    }\n\n    for (let index = 1; index < path.length; index += 1) {\n        const certificate = path[index];\n        if (!certificate) {\n            throw new ValidationError('The client certificate chain is invalid.');\n        }\n\n        // The last path element is the configured trust anchor, trusted a\n        // priori — its self-signature algorithm and any critical extensions\n        // it carries are the operator's responsibility, so the RFC 5280\n        // conformance checks below apply only to the issued intermediates.\n        const isAnchor = index === path.length - 1;\n        if (!isAnchor) {\n            assertCertificateExtensionsUnderstood(certificate);\n            assertStrongSignature(certificate);\n            assertIssuerExtendedKeyUsage(certificate);\n        }\n\n        assertCertificateCurrent(certificate);\n        const constraints = certificate.getExtension(BasicConstraintsExtension);\n        if (!constraints?.ca) {\n            throw new ValidationError('The client certificate chain contains a non-CA issuer.');\n        }\n\n        const keyUsage = certificate.getExtension(KeyUsagesExtension);\n        if (keyUsage && (keyUsage.usages & KeyUsageFlags.keyCertSign) === 0) {\n            throw new ValidationError('A client certificate issuer cannot sign certificates.');\n        }\n\n        // `index - 1` is the number of non-leaf CA certificates below this\n        // issuer in the selected path. A pathLenConstraint of zero therefore\n        // permits a directly-issued client leaf and no subordinate CA.\n        if (\n            typeof constraints.pathLength === 'number' &&\n            (index - 1) > constraints.pathLength\n        ) {\n            throw new ValidationError('The client certificate chain exceeds a CA path-length constraint.');\n        }\n    }\n}\n\nfunction assertClientCertificatePurpose(certificate: X509Certificate): void {\n    const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n    if (\n        extendedKeyUsage &&\n        !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth)\n    ) {\n        throw new ValidationError('The certificate is not valid for TLS client authentication.');\n    }\n\n    const keyUsage = certificate.getExtension(KeyUsagesExtension);\n    if (keyUsage && (keyUsage.usages & KeyUsageFlags.digitalSignature) === 0) {\n        throw new ValidationError('The certificate cannot prove possession of its private key.');\n    }\n}\n\n/**\n * EKU chaining (RFC 5280 §4.2.1.12): a CA whose Extended Key Usage is present\n * but omits both `clientAuth` and `anyExtendedKeyUsage` is not permitted to\n * issue TLS-client-authentication certificates, so a leaf beneath it must be\n * rejected. (A CA's EKU may be non-critical, so the critical-extension check\n * does not cover this.) A CA with no EKU extension is unconstrained.\n */\nfunction assertIssuerExtendedKeyUsage(certificate: X509Certificate): void {\n    const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n    if (\n        extendedKeyUsage &&\n        !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth) &&\n        !extendedKeyUsage.usages.includes(ANY_EXTENDED_KEY_USAGE_OID)\n    ) {\n        throw new ValidationError('A client certificate issuer is not permitted to issue TLS client-authentication certificates.');\n    }\n}\n\nfunction assertClientCertificateIdentity(certificate: X509Certificate, clientId: string): void {\n    const subjectAlternativeName = certificate.getExtension(SubjectAlternativeNameExtension);\n    const authupUris = subjectAlternativeName ?\n        subjectAlternativeName.names.items\n            .filter((name) => name.type === GENERAL_NAME_URL)\n            .map((name) => name.value)\n            .filter((value) => value.startsWith(CLIENT_CERTIFICATE_URI_PREFIX)) :\n        [];\n\n    const expected = buildClientCertificateURI(clientId);\n    if (authupUris.length !== 1 || authupUris[0] !== expected) {\n        throw new ValidationError(`The certificate must contain exactly one Authup client URI SAN: ${expected}.`);\n    }\n}\n\nfunction assertCertificateCurrent(certificate: X509Certificate): void {\n    const now = Date.now();\n    if (\n        certificate.notBefore.getTime() > now ||\n        certificate.notAfter.getTime() < now\n    ) {\n        throw new ValidationError('The client certificate is not currently valid.');\n    }\n}\n\nfunction assertCertificateExtensionsUnderstood(certificate: X509Certificate): void {\n    for (const extension of certificate.extensions) {\n        if (extension.critical && !HANDLED_CRITICAL_EXTENSION_OIDS.has(extension.type)) {\n            throw new ValidationError(\n                `The certificate carries an unsupported critical extension (${extension.type}).`,\n            );\n        }\n    }\n}\n\nfunction assertStrongSignature(certificate: X509Certificate): void {\n    const hash = certificate.signatureAlgorithm?.hash?.name;\n    if (typeof hash === 'string' && WEAK_SIGNATURE_HASHES.has(hash.toUpperCase())) {\n        throw new ValidationError(`The certificate is signed with a weak algorithm (${hash}).`);\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,MAAMe,kBAAkB;AACxB,MAAMC,4BAA4B;;;;;;;;GAUlC,MAAMC,mCAAmC;;;;;;;;GAUzC,MAAMC,kDAAkC,IAAIC,IAAY;CACpD;CACA;CACA;CACA;CACA;CACA;CACH;AAED,MAAMC,wCAAwB,IAAID,IAAY;CAAC;CAAS;CAAO;CAAO;CAAM;AAG5E,MAAME,6BAA6B;;;;GAQnC,IAAaC,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKF,wBAAwBE,IAAIF;EACjC,KAAKC,SAASC,IAAID;CACtB;CAEAE,mBAAmBC,UAA2C;EAC1DC,+CAA+CD,QAAAA;CACnD;CAEA,MAAME,0BACFC,QACAH,UACa;EACb,KAAKD,mBAAmBC,QAAAA;EACxBI,+BAA+BJ,SAASK,WAAW;EACnDC,gCAAgCN,SAASK,aAAaF,OAAOI,EAAE;EAC/DC,sCAAsCR,SAASK,WAAW;EAC1DI,sBAAsBT,SAASK,WAAW;EAE1C,MAAMK,UAAU,MAAM,KAAKd,sBAAsBe,WAAW;GACxDC,UAAUT,OAAOS;GACjBC,SAAS;EACb,CAAA;EAEA,KAAK,MAAMC,UAAUJ,SAAS;GAC1B,MAAMK,oBAAoBC,uBAAuBF,MAAAA;GACjD,IAAI,CAACC,mBACD;GAGJ,MAAME,SAAsC,EAAEC,WAAW5B,iCAAiC;GAC1F,MAAM6B,OAAO,MAAMC,UACfpB,SAASK,aACTL,SAASqB,OACTN,mBACAE,QACA,KAAKpB,MAAM;GAEf,IAAI,CAACsB,MACD;GAGJ,IAAI;IACAG,wBAAwBH,IAAAA;IACxB;GACJ,QAAQ;IAGJ;GACJ;EACJ;EAEA,MAAM,IAAIjC,gBAAgB,sDAAA;CAC9B;AACJ;AAEA,SAAgBe,+CACZD,UAAmC;CAEnCuB,yBAAyBvB,SAASK,WAAW;CAG7C,IADoBL,SAASK,YAAYoB,aAAanD,yBAClDkD,CAAAA,EAAaE,IACb,MAAM,IAAIxC,gBAAgB,0DAAA;AAElC;AAEA,SAAgByC,4BAA4BC,KAAW;CACnD,MAAMC,SAASD,IAAIE,MAAMzC,yBAAAA;CACzB,IAAI,CAACwC,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAI7C,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAO2C,OAAOG,KAAKC,UAAU,IAAIlD,gBAAgBkD,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAI/C,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,eAAsBgD,iCAClB7B,aACAR,QAAe;CAEf,MAAMsC,SAAS,MAAM9B,YAAY+B,cAAc,WAAWvC,MAAAA;CAE1D,OAAOV,gBACHkD,OAAOC,aAAY,GAAI,IAAIC,WAAWJ,MAAAA,CAAAA,CAAAA;AAE9C;AAEA,SAASnB,uBAAuBF,QAAmB;CAC/C,IAAI;EACA,OAAOa,4BAA4Bb,OAAOT,WAAW,CAAC,CAAC;CAC3D,QAAQ;EAIJ;CACJ;AACJ;AAEA,eAAee,UACXqB,MACAC,eACA5B,QACAG,QACApB,QAAe;CAEf,OAAO8C,aAAaF,MAAMC,eAAe5B,QAAQ,CAAC2B,IAAAA,GAAOxB,QAAQpB,MAAAA;AACrE;AAEA,eAAe8C,aACXC,SACAC,WACA/B,QACAK,MACAF,QACApB,QAAe;CAEf,IAAIsB,KAAKY,SAAS3C,iBACd;CAGJ,IAAI0D,gBAAgBF,SAAS9B,MAAAA,GACzB,OAAOK;CAGX,IAAI,MAAM4B,WAAWH,SAAS9B,QAAQG,QAAQpB,MAAAA,GAC1C,OAAO,CAAA,GAAIsB,MAAML,MAAAA;CAGrB,KAAK,IAAIkC,QAAQ,GAAGA,QAAQH,UAAUd,QAAQiB,SAAS,GAAG;EACtD,MAAMC,YAAYJ,UAAUG;EAC5B,IACI,CAACC,aACDH,gBAAgBF,SAASK,SAAAA,KACzB,CAAC,MAAMF,WAAWH,SAASK,WAAWhC,QAAQpB,MAAAA,GAE9C;EAGJ,MAAMqD,OAAO,MAAMP,aACfM,WACAJ,UAAUM,QAAQC,OAAOC,mBAAmBA,mBAAmBL,KAAAA,GAC/DlC,QACA,CAAA,GAAIK,MAAM8B,SAAAA,GACVhC,QACApB,MAAAA;EAEJ,IAAIqD,MACA,OAAOA;CAEf;AAGJ;AAEA,eAAeH,WACX1C,aACAiD,QACArC,QACApB,QAAe;CAEf,IAAIQ,YAAYiD,WAAWA,OAAOC,SAC9B,OAAO;CAGX,MAAMC,yBAAyBnD,YAAYoB,aAAapD,+BAAAA;CACxD,IAAImF,wBAAwBC,OAAO;EAC/B,MAAMC,uBAAuBJ,OAAO7B,aAAa3C,6BAAAA;EACjD,IAAI4E,wBAAwBA,qBAAqBD,UAAUD,uBAAuBC,OAC9E,OAAO;CAEf;CAMA,IAAIxC,OAAOC,aAAa,GACpB,OAAO;CAEXD,OAAOC,aAAa;CAEpB,IAAI;EACA,OAAO,MAAMb,YAAYsD,OAAO;GAC5BC,WAAWN;GACXO,eAAe;EACnB,GAAGhE,MAAAA;CACP,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAASiD,gBAAgBgB,MAAuBC,OAAsB;CAClE,MAAMC,UAAU,IAAIzB,WAAWuB,KAAKG,OAAO;CAC3C,MAAMC,WAAW,IAAI3B,WAAWwB,MAAME,OAAO;CAE7C,OAAOD,QAAQjC,WAAWmC,SAASnC,UAC/BiC,QAAQG,OAAOC,OAAOpB,UAAUoB,UAAUF,SAASlB,MAAM;AACjE;AAEA,SAAS1B,wBAAwBH,MAAuB;CACpD,IAAIA,KAAKY,SAAS,GACd,MAAM,IAAI7C,gBAAgB,0CAAA;CAG9B,KAAK,IAAI8D,QAAQ,GAAGA,QAAQ7B,KAAKY,QAAQiB,SAAS,GAAG;EACjD,MAAM3C,cAAcc,KAAK6B;EACzB,IAAI,CAAC3C,aACD,MAAM,IAAInB,gBAAgB,0CAAA;EAQ9B,IAAI,EADa8D,UAAU7B,KAAKY,SAAS,IAC1B;GACXvB,sCAAsCH,WAAAA;GACtCI,sBAAsBJ,WAAAA;GACtBiE,6BAA6BjE,WAAAA;EACjC;EAEAkB,yBAAyBlB,WAAAA;EACzB,MAAMmB,cAAcnB,YAAYoB,aAAanD,yBAAAA;EAC7C,IAAI,CAACkD,aAAaE,IACd,MAAM,IAAIxC,gBAAgB,wDAAA;EAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;EAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAc8F,iBAAiB,GAC9D,MAAM,IAAIvF,gBAAgB,uDAAA;EAM9B,IACI,OAAOsC,YAAYkD,eAAe,YAClC,QAAS,IAAKlD,YAAYkD,YAE1B,MAAM,IAAIxF,gBAAgB,mEAAA;CAElC;AACJ;AAEA,SAASkB,+BAA+BC,aAA4B;CAChE,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,GAE7D,MAAM,IAAI3F,gBAAgB,6DAAA;CAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;CAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAcmG,sBAAsB,GACnE,MAAM,IAAI5F,gBAAgB,6DAAA;AAElC;;;;;;;GASA,SAASoF,6BAA6BjE,aAA4B;CAC9D,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,KAC7D,CAACF,iBAAiBH,OAAOI,SAASlF,0BAAAA,GAElC,MAAM,IAAIR,gBAAgB,+FAAA;AAElC;AAEA,SAASoB,gCAAgCD,aAA8B0E,UAAgB;CACnF,MAAMC,yBAAyB3E,YAAYoB,aAAa5C,+BAAAA;CACxD,MAAMoG,aAAaD,yBACfA,uBAAuBE,MAAMC,MACxBhC,QAAQiC,SAASA,KAAKC,SAAS3G,GAAAA,CAAAA,CAC/BsD,KAAKoD,SAASA,KAAKhB,KAAK,CAAA,CACxBjB,QAAQiB,UAAUA,MAAMkB,WAAWtG,6BAAAA,CAAAA,IACxC,CAAA;CAEJ,MAAMuG,WAAWtG,0BAA0B8F,QAAAA;CAC3C,IAAIE,WAAWlD,WAAW,KAAKkD,WAAW,OAAOM,UAC7C,MAAM,IAAIrG,gBAAgB,mEAAmEqG,SAAS,EAAE;AAEhH;AAEA,SAAShE,yBAAyBlB,aAA4B;CAC1D,MAAMmF,MAAMC,KAAKD,IAAG;CACpB,IACInF,YAAYqF,UAAUC,QAAO,IAAKH,OAClCnF,YAAYuF,SAASD,QAAO,IAAKH,KAEjC,MAAM,IAAItG,gBAAgB,gDAAA;AAElC;AAEA,SAASsB,sCAAsCH,aAA4B;CACvE,KAAK,MAAMwF,aAAaxF,YAAYyF,YAChC,IAAID,UAAUE,YAAY,CAACxG,gCAAgCyG,IAAIH,UAAUR,IAAI,GACzE,MAAM,IAAInG,gBACN,8DAA8D2G,UAAUR,KAAK,GAAG;AAIhG;AAEA,SAAS5E,sBAAsBJ,aAA4B;CACvD,MAAM4F,OAAO5F,YAAY6F,oBAAoBD,MAAMb;CACnD,IAAI,OAAOa,SAAS,YAAYxG,sBAAsBuG,IAAIC,KAAKE,YAAW,CAAA,GACtE,MAAM,IAAIjH,gBAAgB,oDAAoD+G,KAAK,GAAG;AAE9F"}
+{"version":3,"file":"module.mjs","names":["AuthorityKeyIdentifierExtension","BasicConstraintsExtension","ExtendedKeyUsage","ExtendedKeyUsageExtension","URL","GENERAL_NAME_URL","KeyUsageFlags","KeyUsagesExtension","SubjectAlternativeNameExtension","SubjectKeyIdentifierExtension","X509Certificate","CLIENT_CERTIFICATE_URI_PREFIX","buildClientCertificateURI","ValidationError","base64URLEncode","MAX_CHAIN_DEPTH","CERTIFICATE_BLOCK_PATTERN","MAX_PATH_SIGNATURE_VERIFICATIONS","HANDLED_CRITICAL_EXTENSION_OIDS","Set","WEAK_SIGNATURE_HASHES","ANY_EXTENDED_KEY_USAGE_OID","ClientCertificateValidator","trustAnchorRepository","crypto","ctx","validateForBinding","evidence","assertClientCertificateEvidenceValidForBinding","validateForAuthentication","client","assertClientCertificatePurpose","certificate","assertClientCertificateIdentity","id","assertCertificateExtensionsUnderstood","assertStrongSignature","anchors","findManyBy","realmId","enabled","anchor","anchorCertificate","parseAnchorCertificate","budget","remaining","path","buildPath","chain","assertCertificationPath","assertCertificateCurrent","constraints","getExtension","ca","parseClientCertificateChain","pem","blocks","match","length","map","block","buildClientCertificateThumbprint","digest","getThumbprint","String","fromCharCode","Uint8Array","undefined","leaf","intermediates","continuePath","current","available","sameCertificate","isIssuedBy","index","candidate","next","filter","_item","candidateIndex","issuer","subject","authorityKeyIdentifier","keyId","subjectKeyIdentifier","verify","publicKey","signatureOnly","left","right","leftRaw","rawData","rightRaw","every","value","isAnchor","assertIssuerExtendedKeyUsage","keyUsage","usages","keyCertSign","pathLength","extendedKeyUsage","includes","clientAuth","digitalSignature","clientId","subjectAlternativeName","authupUris","names","items","name","type","startsWith","expected","now","Date","notBefore","getTime","notAfter","extension","extensions","critical","has","hash","signatureAlgorithm","toUpperCase"],"sources":["../../../src/core/client-certificate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport './reflect.ts';\nimport {\n    AuthorityKeyIdentifierExtension,\n    BasicConstraintsExtension,\n    ExtendedKeyUsage,\n    ExtendedKeyUsageExtension,\n    URL as GENERAL_NAME_URL,\n    KeyUsageFlags,\n    KeyUsagesExtension,\n    SubjectAlternativeNameExtension,\n    SubjectKeyIdentifierExtension,\n    X509Certificate,\n} from '@peculiar/x509';\nimport type { Client, TrustAnchor } from '@authup/core-kit';\nimport {\n    CLIENT_CERTIFICATE_URI_PREFIX,\n    buildClientCertificateURI,\n} from '@authup/core-kit';\nimport { ValidationError } from '@authup/errors';\nimport { base64URLEncode } from '@authup/kit';\nimport type {\n    ClientCertificateEvidence,\n    ClientCertificateValidatorContext,\n    IClientCertificateValidator,\n} from './types.ts';\n\nconst MAX_CHAIN_DEPTH = 10;\nconst CERTIFICATE_BLOCK_PATTERN = /-----BEGIN CERTIFICATE-----[\\s\\S]*?-----END CERTIFICATE-----/g;\n\n/**\n * Hard ceiling on signature verifications performed while building a single\n * certification path. A legitimate chain of the maximum accepted length only\n * needs O(depth²) verifications; the ceiling exists purely to defuse the\n * factorial backtracking blow-up an attacker can induce with certificates\n * that mutually \"issue\" one another (shared key, identical subject/issuer\n * DNs). Reaching the ceiling is treated as \"no path found\" (fail closed).\n */\nconst MAX_PATH_SIGNATURE_VERIFICATIONS = 64;\n\n/**\n * OIDs of the certificate extensions this validator actually processes. A\n * certificate carrying a *critical* extension outside this set is rejected\n * (RFC 5280 §4.2): an unprocessed critical constraint must never be silently\n * ignored. Because RFC 5280 requires the NameConstraints extension to be\n * marked critical, this also fails a name-constrained CA closed rather than\n * trusting a chain whose name constraints we do not evaluate.\n */\nconst HANDLED_CRITICAL_EXTENSION_OIDS = new Set<string>([\n    '2.5.29.19', // basicConstraints\n    '2.5.29.15', // keyUsage\n    '2.5.29.37', // extKeyUsage\n    '2.5.29.17', // subjectAltName\n    '2.5.29.35', // authorityKeyIdentifier\n    '2.5.29.14', // subjectKeyIdentifier\n]);\n\nconst WEAK_SIGNATURE_HASHES = new Set<string>(['SHA-1', 'MD5', 'MD2', 'MD4']);\n\n// anyExtendedKeyUsage (RFC 5280 §4.2.1.12) — a CA carrying it is unconstrained.\nconst ANY_EXTENDED_KEY_USAGE_OID = '2.5.29.37.0';\n\ntype SignatureVerificationBudget = { remaining: number };\n\n/**\n * Validates client certificates without performing network I/O. AIA, CRL,\n * and OCSP retrieval are deliberately outside the external-PKI first slice.\n */\nexport class ClientCertificateValidator implements IClientCertificateValidator {\n    protected trustAnchorRepository: ClientCertificateValidatorContext['trustAnchorRepository'];\n\n    protected crypto?: Crypto;\n\n    constructor(ctx: ClientCertificateValidatorContext) {\n        this.trustAnchorRepository = ctx.trustAnchorRepository;\n        this.crypto = ctx.crypto;\n    }\n\n    validateForBinding(evidence: ClientCertificateEvidence): void {\n        assertClientCertificateEvidenceValidForBinding(evidence);\n    }\n\n    async validateForAuthentication(\n        client: Pick<Client, 'id' | 'realmId'>,\n        evidence: ClientCertificateEvidence,\n    ): Promise<void> {\n        this.validateForBinding(evidence);\n        assertClientCertificatePurpose(evidence.certificate);\n        assertClientCertificateIdentity(evidence.certificate, client.id);\n        assertCertificateExtensionsUnderstood(evidence.certificate);\n        assertStrongSignature(evidence.certificate);\n\n        const anchors = await this.trustAnchorRepository.findManyBy({\n            realmId: client.realmId,\n            enabled: true,\n        });\n\n        for (const anchor of anchors) {\n            const anchorCertificate = parseAnchorCertificate(anchor);\n            if (!anchorCertificate) {\n                continue;\n            }\n\n            const budget: SignatureVerificationBudget = { remaining: MAX_PATH_SIGNATURE_VERIFICATIONS };\n            const path = await buildPath(\n                evidence.certificate,\n                evidence.chain,\n                anchorCertificate,\n                budget,\n                this.crypto,\n            );\n            if (!path) {\n                continue;\n            }\n\n            try {\n                assertCertificationPath(path);\n                return;\n            } catch {\n                // A chain reaching this anchor failed its CA constraints;\n                // another enabled anchor may still yield a valid path.\n                continue;\n            }\n        }\n\n        throw new ValidationError('The client certificate is not trusted in this realm.');\n    }\n}\n\nexport function assertClientCertificateEvidenceValidForBinding(\n    evidence: ClientCertificateEvidence,\n): void {\n    assertCertificateCurrent(evidence.certificate);\n\n    const constraints = evidence.certificate.getExtension(BasicConstraintsExtension);\n    if (constraints?.ca) {\n        throw new ValidationError('A CA certificate cannot be used as a client certificate.');\n    }\n}\n\nexport function parseClientCertificateChain(pem: string): X509Certificate[] {\n    const blocks = pem.match(CERTIFICATE_BLOCK_PATTERN);\n    if (!blocks || blocks.length === 0) {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n\n    try {\n        return blocks.map((block) => new X509Certificate(block));\n    } catch {\n        throw new ValidationError('The certificate chain could not be parsed.');\n    }\n}\n\nexport async function buildClientCertificateThumbprint(\n    certificate: X509Certificate,\n    crypto?: Crypto,\n): Promise<string> {\n    const digest = await certificate.getThumbprint('SHA-256', crypto);\n\n    return base64URLEncode(\n        String.fromCharCode(...new Uint8Array(digest)),\n    );\n}\n\nfunction parseAnchorCertificate(anchor: TrustAnchor): X509Certificate | undefined {\n    try {\n        return parseClientCertificateChain(anchor.certificate)[0];\n    } catch {\n        // Rows are validated on create. Treat a corrupt legacy/database row as\n        // unusable trust material instead of turning client authentication into\n        // a 500 or accidentally trusting another certificate in its PEM chain.\n        return undefined;\n    }\n}\n\nasync function buildPath(\n    leaf: X509Certificate,\n    intermediates: X509Certificate[],\n    anchor: X509Certificate,\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n    return continuePath(leaf, intermediates, anchor, [leaf], budget, crypto);\n}\n\nasync function continuePath(\n    current: X509Certificate,\n    available: X509Certificate[],\n    anchor: X509Certificate,\n    path: X509Certificate[],\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<X509Certificate[] | undefined> {\n    if (path.length > MAX_CHAIN_DEPTH) {\n        return undefined;\n    }\n\n    if (sameCertificate(current, anchor)) {\n        return path;\n    }\n\n    if (await isIssuedBy(current, anchor, budget, crypto)) {\n        return [...path, anchor];\n    }\n\n    for (let index = 0; index < available.length; index += 1) {\n        const candidate = available[index];\n        if (\n            !candidate ||\n            sameCertificate(current, candidate) ||\n            !await isIssuedBy(current, candidate, budget, crypto)\n        ) {\n            continue;\n        }\n\n        const next = await continuePath(\n            candidate,\n            available.filter((_item, candidateIndex) => candidateIndex !== index),\n            anchor,\n            [...path, candidate],\n            budget,\n            crypto,\n        );\n        if (next) {\n            return next;\n        }\n    }\n\n    return undefined;\n}\n\nasync function isIssuedBy(\n    certificate: X509Certificate,\n    issuer: X509Certificate,\n    budget: SignatureVerificationBudget,\n    crypto?: Crypto,\n): Promise<boolean> {\n    if (certificate.issuer !== issuer.subject) {\n        return false;\n    }\n\n    const authorityKeyIdentifier = certificate.getExtension(AuthorityKeyIdentifierExtension);\n    if (authorityKeyIdentifier?.keyId) {\n        const subjectKeyIdentifier = issuer.getExtension(SubjectKeyIdentifierExtension);\n        if (subjectKeyIdentifier && subjectKeyIdentifier.keyId !== authorityKeyIdentifier.keyId) {\n            return false;\n        }\n    }\n\n    // Spend from the shared verification budget only for the expensive\n    // cryptographic check (the DN / key-id pre-filters above are cheap). Once\n    // exhausted, treat every further edge as unverified so a maliciously\n    // crafted mutually-issuing certificate set cannot force factorial work.\n    if (budget.remaining <= 0) {\n        return false;\n    }\n    budget.remaining -= 1;\n\n    try {\n        return await certificate.verify({\n            publicKey: issuer,\n            signatureOnly: true,\n        }, crypto);\n    } catch {\n        return false;\n    }\n}\n\nfunction sameCertificate(left: X509Certificate, right: X509Certificate): boolean {\n    const leftRaw = new Uint8Array(left.rawData);\n    const rightRaw = new Uint8Array(right.rawData);\n\n    return leftRaw.length === rightRaw.length &&\n        leftRaw.every((value, index) => value === rightRaw[index]);\n}\n\nfunction assertCertificationPath(path: X509Certificate[]): void {\n    if (path.length < 2) {\n        throw new ValidationError('The client certificate chain is invalid.');\n    }\n\n    for (let index = 1; index < path.length; index += 1) {\n        const certificate = path[index];\n        if (!certificate) {\n            throw new ValidationError('The client certificate chain is invalid.');\n        }\n\n        // The last path element is the configured trust anchor, trusted a\n        // priori — its self-signature algorithm and any critical extensions\n        // it carries are the operator's responsibility, so the RFC 5280\n        // conformance checks below apply only to the issued intermediates.\n        const isAnchor = index === path.length - 1;\n        if (!isAnchor) {\n            assertCertificateExtensionsUnderstood(certificate);\n            assertStrongSignature(certificate);\n            assertIssuerExtendedKeyUsage(certificate);\n        }\n\n        assertCertificateCurrent(certificate);\n        const constraints = certificate.getExtension(BasicConstraintsExtension);\n        if (!constraints?.ca) {\n            throw new ValidationError('The client certificate chain contains a non-CA issuer.');\n        }\n\n        const keyUsage = certificate.getExtension(KeyUsagesExtension);\n        if (keyUsage && (keyUsage.usages & KeyUsageFlags.keyCertSign) === 0) {\n            throw new ValidationError('A client certificate issuer cannot sign certificates.');\n        }\n\n        // `index - 1` is the number of non-leaf CA certificates below this\n        // issuer in the selected path. A pathLenConstraint of zero therefore\n        // permits a directly-issued client leaf and no subordinate CA.\n        if (\n            typeof constraints.pathLength === 'number' &&\n            (index - 1) > constraints.pathLength\n        ) {\n            throw new ValidationError('The client certificate chain exceeds a CA path-length constraint.');\n        }\n    }\n}\n\nfunction assertClientCertificatePurpose(certificate: X509Certificate): void {\n    const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n    if (\n        extendedKeyUsage &&\n        !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth)\n    ) {\n        throw new ValidationError('The certificate is not valid for TLS client authentication.');\n    }\n\n    const keyUsage = certificate.getExtension(KeyUsagesExtension);\n    if (keyUsage && (keyUsage.usages & KeyUsageFlags.digitalSignature) === 0) {\n        throw new ValidationError('The certificate cannot prove possession of its private key.');\n    }\n}\n\n/**\n * EKU chaining (RFC 5280 §4.2.1.12): a CA whose Extended Key Usage is present\n * but omits both `clientAuth` and `anyExtendedKeyUsage` is not permitted to\n * issue TLS-client-authentication certificates, so a leaf beneath it must be\n * rejected. (A CA's EKU may be non-critical, so the critical-extension check\n * does not cover this.) A CA with no EKU extension is unconstrained.\n */\nfunction assertIssuerExtendedKeyUsage(certificate: X509Certificate): void {\n    const extendedKeyUsage = certificate.getExtension(ExtendedKeyUsageExtension);\n    if (\n        extendedKeyUsage &&\n        !extendedKeyUsage.usages.includes(ExtendedKeyUsage.clientAuth) &&\n        !extendedKeyUsage.usages.includes(ANY_EXTENDED_KEY_USAGE_OID)\n    ) {\n        throw new ValidationError('A client certificate issuer is not permitted to issue TLS client-authentication certificates.');\n    }\n}\n\nfunction assertClientCertificateIdentity(certificate: X509Certificate, clientId: string): void {\n    const subjectAlternativeName = certificate.getExtension(SubjectAlternativeNameExtension);\n    const authupUris = subjectAlternativeName ?\n        subjectAlternativeName.names.items\n            .filter((name) => name.type === GENERAL_NAME_URL)\n            .map((name) => name.value)\n            .filter((value) => value.startsWith(CLIENT_CERTIFICATE_URI_PREFIX)) :\n        [];\n\n    const expected = buildClientCertificateURI(clientId);\n    if (authupUris.length !== 1 || authupUris[0] !== expected) {\n        throw new ValidationError(`The certificate must contain exactly one Authup client URI SAN: ${expected}.`);\n    }\n}\n\nfunction assertCertificateCurrent(certificate: X509Certificate): void {\n    const now = Date.now();\n    if (\n        certificate.notBefore.getTime() > now ||\n        certificate.notAfter.getTime() < now\n    ) {\n        throw new ValidationError('The client certificate is not currently valid.');\n    }\n}\n\nfunction assertCertificateExtensionsUnderstood(certificate: X509Certificate): void {\n    for (const extension of certificate.extensions) {\n        if (extension.critical && !HANDLED_CRITICAL_EXTENSION_OIDS.has(extension.type)) {\n            throw new ValidationError(\n                `The certificate carries an unsupported critical extension (${extension.type}).`,\n            );\n        }\n    }\n}\n\nfunction assertStrongSignature(certificate: X509Certificate): void {\n    const hash = certificate.signatureAlgorithm?.hash?.name;\n    if (typeof hash === 'string' && WEAK_SIGNATURE_HASHES.has(hash.toUpperCase())) {\n        throw new ValidationError(`The certificate is signed with a weak algorithm (${hash}).`);\n    }\n}\n"],"mappings":";;;;;;;;;AAiCA,MAAMe,kBAAkB;AACxB,MAAMC,4BAA4B;;;;;;;;GAUlC,MAAMC,mCAAmC;;;;;;;;GAUzC,MAAMC,kDAAkC,IAAIC,IAAY;CACpD;CACA;CACA;CACA;CACA;CACA;AACH,CAAA;AAED,MAAMC,wCAAwB,IAAID,IAAY;CAAC;CAAS;CAAO;CAAO;AAAM,CAAA;AAG5E,MAAME,6BAA6B;;;;GAQnC,IAAaC,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAwC;EAChD,KAAKF,wBAAwBE,IAAIF;EACjC,KAAKC,SAASC,IAAID;CACtB;CAEAE,mBAAmBC,UAA2C;EAC1DC,+CAA+CD,QAAAA;CACnD;CAEA,MAAME,0BACFC,QACAH,UACa;EACb,KAAKD,mBAAmBC,QAAAA;EACxBI,+BAA+BJ,SAASK,WAAW;EACnDC,gCAAgCN,SAASK,aAAaF,OAAOI,EAAE;EAC/DC,sCAAsCR,SAASK,WAAW;EAC1DI,sBAAsBT,SAASK,WAAW;EAE1C,MAAMK,UAAU,MAAM,KAAKd,sBAAsBe,WAAW;GACxDC,SAAST,OAAOS;GAChBC,SAAS;EACb,CAAA;EAEA,KAAK,MAAMC,UAAUJ,SAAS;GAC1B,MAAMK,oBAAoBC,uBAAuBF,MAAAA;GACjD,IAAI,CAACC,mBACD;GAGJ,MAAME,SAAsC,EAAEC,WAAW5B,iCAAiC;GAC1F,MAAM6B,OAAO,MAAMC,UACfpB,SAASK,aACTL,SAASqB,OACTN,mBACAE,QACA,KAAKpB,MAAM;GAEf,IAAI,CAACsB,MACD;GAGJ,IAAI;IACAG,wBAAwBH,IAAAA;IACxB;GACJ,QAAQ;IAGJ;GACJ;EACJ;EAEA,MAAM,IAAIjC,gBAAgB,sDAAA;CAC9B;AACJ;AAEA,SAAgBe,+CACZD,UAAmC;CAEnCuB,yBAAyBvB,SAASK,WAAW;CAG7C,IADoBL,SAASK,YAAYoB,aAAanD,yBAClDkD,CAAAA,EAAaE,IACb,MAAM,IAAIxC,gBAAgB,0DAAA;AAElC;AAEA,SAAgByC,4BAA4BC,KAAW;CACnD,MAAMC,SAASD,IAAIE,MAAMzC,yBAAAA;CACzB,IAAI,CAACwC,UAAUA,OAAOE,WAAW,GAC7B,MAAM,IAAI7C,gBAAgB,4CAAA;CAG9B,IAAI;EACA,OAAO2C,OAAOG,KAAKC,UAAU,IAAIlD,gBAAgBkD,KAAAA,CAAAA;CACrD,QAAQ;EACJ,MAAM,IAAI/C,gBAAgB,4CAAA;CAC9B;AACJ;AAEA,eAAsBgD,iCAClB7B,aACAR,QAAe;CAEf,MAAMsC,SAAS,MAAM9B,YAAY+B,cAAc,WAAWvC,MAAAA;CAE1D,OAAOV,gBACHkD,OAAOC,aAAY,GAAI,IAAIC,WAAWJ,MAAAA,CAAAA,CAAAA;AAE9C;AAEA,SAASnB,uBAAuBF,QAAmB;CAC/C,IAAI;EACA,OAAOa,4BAA4Bb,OAAOT,WAAW,CAAC,CAAC;CAC3D,QAAQ;EAIJ;CACJ;AACJ;AAEA,eAAee,UACXqB,MACAC,eACA5B,QACAG,QACApB,QAAe;CAEf,OAAO8C,aAAaF,MAAMC,eAAe5B,QAAQ,CAAC2B,IAAK,GAAExB,QAAQpB,MAAAA;AACrE;AAEA,eAAe8C,aACXC,SACAC,WACA/B,QACAK,MACAF,QACApB,QAAe;CAEf,IAAIsB,KAAKY,SAAS3C,iBACd;CAGJ,IAAI0D,gBAAgBF,SAAS9B,MAAAA,GACzB,OAAOK;CAGX,IAAI,MAAM4B,WAAWH,SAAS9B,QAAQG,QAAQpB,MAAAA,GAC1C,OAAO,CAAIsB,GAAAA,MAAML,MAAO;CAG5B,KAAK,IAAIkC,QAAQ,GAAGA,QAAQH,UAAUd,QAAQiB,SAAS,GAAG;EACtD,MAAMC,YAAYJ,UAAUG;EAC5B,IACI,CAACC,aACDH,gBAAgBF,SAASK,SAAAA,KACzB,CAAC,MAAMF,WAAWH,SAASK,WAAWhC,QAAQpB,MAAAA,GAE9C;EAGJ,MAAMqD,OAAO,MAAMP,aACfM,WACAJ,UAAUM,QAAQC,OAAOC,mBAAmBA,mBAAmBL,KAAAA,GAC/DlC,QACA,CAAIK,GAAAA,MAAM8B,SAAU,GACpBhC,QACApB,MAAAA;EAEJ,IAAIqD,MACA,OAAOA;CAEf;AAGJ;AAEA,eAAeH,WACX1C,aACAiD,QACArC,QACApB,QAAe;CAEf,IAAIQ,YAAYiD,WAAWA,OAAOC,SAC9B,OAAO;CAGX,MAAMC,yBAAyBnD,YAAYoB,aAAapD,+BAAAA;CACxD,IAAImF,wBAAwBC,OAAO;EAC/B,MAAMC,uBAAuBJ,OAAO7B,aAAa3C,6BAAAA;EACjD,IAAI4E,wBAAwBA,qBAAqBD,UAAUD,uBAAuBC,OAC9E,OAAO;CAEf;CAMA,IAAIxC,OAAOC,aAAa,GACpB,OAAO;CAEXD,OAAOC,aAAa;CAEpB,IAAI;EACA,OAAO,MAAMb,YAAYsD,OAAO;GAC5BC,WAAWN;GACXO,eAAe;EACnB,GAAGhE,MAAAA;CACP,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAASiD,gBAAgBgB,MAAuBC,OAAsB;CAClE,MAAMC,UAAU,IAAIzB,WAAWuB,KAAKG,OAAO;CAC3C,MAAMC,WAAW,IAAI3B,WAAWwB,MAAME,OAAO;CAE7C,OAAOD,QAAQjC,WAAWmC,SAASnC,UAC/BiC,QAAQG,OAAOC,OAAOpB,UAAUoB,UAAUF,SAASlB,MAAM;AACjE;AAEA,SAAS1B,wBAAwBH,MAAuB;CACpD,IAAIA,KAAKY,SAAS,GACd,MAAM,IAAI7C,gBAAgB,0CAAA;CAG9B,KAAK,IAAI8D,QAAQ,GAAGA,QAAQ7B,KAAKY,QAAQiB,SAAS,GAAG;EACjD,MAAM3C,cAAcc,KAAK6B;EACzB,IAAI,CAAC3C,aACD,MAAM,IAAInB,gBAAgB,0CAAA;EAQ9B,IAAI,EADa8D,UAAU7B,KAAKY,SAAS,IAC1B;GACXvB,sCAAsCH,WAAAA;GACtCI,sBAAsBJ,WAAAA;GACtBiE,6BAA6BjE,WAAAA;EACjC;EAEAkB,yBAAyBlB,WAAAA;EACzB,MAAMmB,cAAcnB,YAAYoB,aAAanD,yBAAAA;EAC7C,IAAI,CAACkD,aAAaE,IACd,MAAM,IAAIxC,gBAAgB,wDAAA;EAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;EAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAc8F,iBAAiB,GAC9D,MAAM,IAAIvF,gBAAgB,uDAAA;EAM9B,IACI,OAAOsC,YAAYkD,eAAe,YAClC,QAAS,IAAKlD,YAAYkD,YAE1B,MAAM,IAAIxF,gBAAgB,mEAAA;CAElC;AACJ;AAEA,SAASkB,+BAA+BC,aAA4B;CAChE,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,GAE7D,MAAM,IAAI3F,gBAAgB,6DAAA;CAG9B,MAAMqF,WAAWlE,YAAYoB,aAAa7C,kBAAAA;CAC1C,IAAI2F,aAAaA,SAASC,SAAS7F,cAAcmG,sBAAsB,GACnE,MAAM,IAAI5F,gBAAgB,6DAAA;AAElC;;;;;;;GASA,SAASoF,6BAA6BjE,aAA4B;CAC9D,MAAMsE,mBAAmBtE,YAAYoB,aAAajD,yBAAAA;CAClD,IACImG,oBACA,CAACA,iBAAiBH,OAAOI,SAASrG,iBAAiBsG,UAAU,KAC7D,CAACF,iBAAiBH,OAAOI,SAASlF,0BAAAA,GAElC,MAAM,IAAIR,gBAAgB,+FAAA;AAElC;AAEA,SAASoB,gCAAgCD,aAA8B0E,UAAgB;CACnF,MAAMC,yBAAyB3E,YAAYoB,aAAa5C,+BAAAA;CACxD,MAAMoG,aAAaD,yBACfA,uBAAuBE,MAAMC,MACxBhC,QAAQiC,SAASA,KAAKC,SAAS3G,GAAAA,CAAAA,CAC/BsD,KAAKoD,SAASA,KAAKhB,KAAK,CAAA,CACxBjB,QAAQiB,UAAUA,MAAMkB,WAAWtG,6BAAAA,CAAAA,IACxC,CAAA;CAEJ,MAAMuG,WAAWtG,0BAA0B8F,QAAAA;CAC3C,IAAIE,WAAWlD,WAAW,KAAKkD,WAAW,OAAOM,UAC7C,MAAM,IAAIrG,gBAAgB,mEAAmEqG,SAAS,EAAE;AAEhH;AAEA,SAAShE,yBAAyBlB,aAA4B;CAC1D,MAAMmF,MAAMC,KAAKD,IAAG;CACpB,IACInF,YAAYqF,UAAUC,QAAO,IAAKH,OAClCnF,YAAYuF,SAASD,QAAO,IAAKH,KAEjC,MAAM,IAAItG,gBAAgB,gDAAA;AAElC;AAEA,SAASsB,sCAAsCH,aAA4B;CACvE,KAAK,MAAMwF,aAAaxF,YAAYyF,YAChC,IAAID,UAAUE,YAAY,CAACxG,gCAAgCyG,IAAIH,UAAUR,IAAI,GACzE,MAAM,IAAInG,gBACN,8DAA8D2G,UAAUR,KAAK,GAAG;AAIhG;AAEA,SAAS5E,sBAAsBJ,aAA4B;CACvD,MAAM4F,OAAO5F,YAAY6F,oBAAoBD,MAAMb;CACnD,IAAI,OAAOa,SAAS,YAAYxG,sBAAsBuG,IAAIC,KAAKE,YAAW,CAAA,GACtE,MAAM,IAAIjH,gBAAgB,oDAAoD+G,KAAK,GAAG;AAE9F"}

package/dist/core/client-certificate/reflect.d.ts

@@ -0,0 +1,2 @@
+import 'reflect-metadata';
+//# sourceMappingURL=reflect.d.ts.map

package/dist/core/client-certificate/reflect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reflect.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/reflect.ts"],"names":[],"mappings":"AAeA,OAAO,kBAAkB,CAAC"}

package/dist/core/{identity/entities/robot/index.mjs → client-certificate/reflect.mjs}

@@ -1,4 +1,5 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "reflect-metadata";
 export {};

package/dist/core/client-certificate/types.d.ts

@@ -17,6 +17,6 @@ export type ClientCertificateValidatorContext = {
 };
 export interface IClientCertificateValidator {
     validateForBinding(evidence: ClientCertificateEvidence): void;
-    validateForAuthentication(client: Pick<Client, 'id' | 'realm_id'>, evidence: ClientCertificateEvidence): Promise<void>;
+    validateForAuthentication(client: Pick<Client, 'id' | 'realmId'>, evidence: ClientCertificateEvidence): Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/core/client-certificate/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,eAAe,CAAC;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,qBAAqB,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC9D,yBAAyB,CACrB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,UAAU,CAAC,EACvC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/client-certificate/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,eAAe,CAAC;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC5C,qBAAqB,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,2BAA2B;IACxC,kBAAkB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC9D,yBAAyB,CACrB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,SAAS,CAAC,EACtC,QAAQ,EAAE,yBAAyB,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB"}

package/dist/core/entities/client/index.d.ts

@@ -1,4 +1,5 @@
 export * from './service.ts';
 export * from './types.ts';
 export * from './web-client.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/core/entities/client/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { clientSchema } from "./schema.mjs";
 import { ClientService } from "./service.mjs";
 import { WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
-export { ClientService, WebClientProvisioner, buildWebClientAttributes };
+export { ClientService, WebClientProvisioner, buildWebClientAttributes, clientSchema };

package/dist/core/entities/client/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Client } from '@authup/core-kit';
+export declare const clientSchema: import("@rapiq/core").Schema<Client, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/client/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,eAAO,MAAM,YAAY,2CAgCvB,CAAC"}