@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.55

package/dist/core/identity/registration/service.mjs

@@ -34,7 +34,7 @@ var RegistrationService = class {
 				"email",
 				"name",
 				"password",
-				"realm_id"
+				"realmId"
 			],
 			passwordMinLength: this.options.passwordMinLength
 		}));
@@ -42,20 +42,20 @@ var RegistrationService = class {
 		await this.repository.validateJoinColumns(validated);
 		if (this.options.emailVerificationEnabled) {
 			validated.active = false;
-			validated.activate_hash = randomBytes(32).toString("hex");
+			validated.activateHash = randomBytes(32).toString("hex");
 		} else validated.active = true;
 		const entity = this.repository.create(validated);
 		const credentialsService = new UserCredentialsService();
 		entity.password = entity.password || createNanoID(64);
 		entity.password = await credentialsService.protect(entity.password);
-		entity.realm_id = (await this.realmRepository.resolve(entity.realm_id, true)).id;
+		entity.realmId = (await this.realmRepository.resolve(entity.realmId, true)).id;
 		await this.repository.save(entity);
 		if (this.options.emailVerificationEnabled) try {
-			const activateUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/activate?token=${entity.activate_hash}` : void 0;
+			const activateUrl = this.options.publicUrl ? `${this.options.publicUrl.replace(/\/+$/, "")}/activate?token=${entity.activateHash}` : void 0;
 			const mail = await this.mailTemplateRenderer.render({
 				template: MailTemplateName.REGISTRATION_ACTIVATION,
 				params: {
-					code: entity.activate_hash,
+					code: entity.activateHash,
 					url: activateUrl
 				},
 				locale: context?.locale
@@ -76,16 +76,16 @@ var RegistrationService = class {
 			actorType: IdentityType.USER,
 			actorId: entity.id,
 			actorName: entity.name,
-			realmId: entity.realm_id
+			realmId: entity.realmId
 		});
 		return { active: entity.active };
 	}
 	async activate(data) {
-		const entity = await this.repository.findOneBy({ activate_hash: data.token });
+		const entity = await this.repository.findOneBy({ activateHash: data.token });
 		if (!entity) throw new EntityNotFoundError();
 		const merged = this.repository.merge(entity, {
 			active: true,
-			activate_hash: null
+			activateHash: null
 		});
 		await this.repository.save(merged);
 		await this.eventService?.record({
@@ -96,7 +96,7 @@ var RegistrationService = class {
 			actorType: IdentityType.USER,
 			actorId: merged.id,
 			actorName: merged.name,
-			realmId: merged.realm_id
+			realmId: merged.realmId
 		});
 	}
 };

package/dist/core/identity/registration/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","UserValidator","createNanoID","EntityNotFoundError","ValidationError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","eventService","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activate_hash","toString","entity","create","credentialsService","password","protect","realm","resolve","realm_id","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","record","scope","IDENTITY","name","REGISTER","refType","USER","refId","actorType","actorId","actorName","realmId","activate","findOneBy","token","merged","merge","ACCOUNT_ACTIVATED"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    UserValidator,\n} from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realm_id'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activate_hash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realm_id, true);\n        entity.realm_id = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activate_hash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activate_hash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new ValidationError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.REGISTER,\n            refType: EventRefType.USER,\n            refId: entity.id,\n            actorType: IdentityType.USER,\n            actorId: entity.id,\n            actorName: entity.name,\n            realmId: entity.realm_id,\n        });\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activate_hash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activate_hash: null,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.ACCOUNT_ACTIVATED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realm_id,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,IAAaa,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,uBAAuBI,IAAIJ;EAChC,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKT,QAAQU,qBACd,MAAM,IAAIhB,0BAAAA;EAGd,MAAMiB,YAAY,IAAIf,UAAU,CAAC,CAAA;EACjCe,UAAUC,MAAM,IAAItB,cAAc;GAC9BuB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;;GAC9CC,mBAAmB,KAAKd,QAAQc;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKd,WAAWe,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKf,QAAQmB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,gBAAgB1B,YAAY,EAAA,CAAA,CAAI2B,SAAS,KAAA;EACvD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKpB,WAAWqB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI5B,uBAAAA;EAC/B0B,OAAOG,WAAWH,OAAOG,YAAYnC,aAAa,EAAA;EAClDgC,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,YAAWF,MADE,KAAKxB,gBAAgByB,QAAQN,OAAOO,UAAU,IAAA,EAAA,CAC1CC;EAExB,MAAM,KAAK5B,WAAW6B,KAAKT,MAAAA;EAE3B,IAAI,KAAKvB,QAAQmB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKjC,QAAQkC,YAC7B,GAAG,KAAKlC,QAAQkC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,kBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKnC,qBAAqBoC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAgBsB,KAAKV;IAAY;IACxDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK3C,WAAW4C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKlC,WAAW6C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,MAAM,KAAKY,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUmE;GAChBC,SAASnE,aAAaoE;GACtBC,OAAOjC,OAAOQ;GACd0B,WAAWpE,aAAakE;GACxBG,SAASnC,OAAOQ;GAChB4B,WAAWpC,OAAO6B;GAClBQ,SAASrC,OAAOO;EACpB,CAAA;EAEA,OAAO,EAAEV,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMyC,SAASrD,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKpB,WAAW2D,UAAU,EAAEzC,eAAeb,KAAKuD,MAAM,CAAA;EAE3E,IAAI,CAACxC,QACD,MAAM,IAAI/B,oBAAAA;EAGd,MAAMwE,SAAS,KAAK7D,WAAW8D,MAAM1C,QAAQ;GACzCH,QAAQ;GACRC,eAAe;EACnB,CAAA;EAEA,MAAM,KAAKlB,WAAW6B,KAAKgC,MAAAA;EAE3B,MAAM,KAAK3D,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUgF;GAChBZ,SAASnE,aAAaoE;GACtBC,OAAOQ,OAAOjC;GACd0B,WAAWpE,aAAakE;GACxBG,SAASM,OAAOjC;GAChB4B,WAAWK,OAAOZ;GAClBQ,SAASI,OAAOlC;EACpB,CAAA;CACJ;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","UserValidator","createNanoID","EntityNotFoundError","ValidationError","RegistrationDisabledError","randomBytes","Container","UserCredentialsService","MailTemplateName","RegistrationService","options","mailClient","mailTemplateRenderer","repository","realmRepository","eventService","ctx","register","data","context","registrationEnabled","validator","mount","pathsToInclude","passwordMinLength","validated","run","group","validateJoinColumns","emailVerificationEnabled","active","activateHash","toString","entity","create","credentialsService","password","protect","realm","resolve","realmId","id","save","activateUrl","publicUrl","replace","undefined","mail","render","template","REGISTRATION_ACTIVATION","params","code","url","locale","send","to","email","remove","record","scope","IDENTITY","name","REGISTER","refType","USER","refId","actorType","actorId","actorName","activate","findOneBy","token","merged","merge","ACCOUNT_ACTIVATED"],"sources":["../../../../src/core/identity/registration/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    UserValidator,\n} from '@authup/core-kit';\nimport { createNanoID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { RegistrationDisabledError } from './error.ts';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IRegistrationService,\n    RegistrationResult,\n    RegistrationServiceContext,\n    RegistrationServiceOptions,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\n\nexport class RegistrationService implements IRegistrationService {\n    protected options: RegistrationServiceOptions;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: RegistrationServiceContext) {\n        this.options = ctx.options;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n    }\n\n    async register(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<RegistrationResult> {\n        if (!this.options.registrationEnabled) {\n            throw new RegistrationDisabledError();\n        }\n\n        const validator = new Container({});\n        validator.mount(new UserValidator({\n            pathsToInclude: ['email', 'name', 'password', 'realmId'],\n            passwordMinLength: this.options.passwordMinLength,\n        }));\n        const validated = await validator.run(data, { group: 'create' });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (this.options.emailVerificationEnabled) {\n            validated.active = false;\n            validated.activateHash = randomBytes(32).toString('hex');\n        } else {\n            validated.active = true;\n        }\n\n        const entity = this.repository.create(validated);\n\n        const credentialsService = new UserCredentialsService();\n        entity.password = entity.password || createNanoID(64);\n        entity.password = await credentialsService.protect(entity.password);\n\n        const realm = await this.realmRepository.resolve(entity.realmId, true);\n        entity.realmId = realm.id;\n\n        await this.repository.save(entity);\n\n        if (this.options.emailVerificationEnabled) {\n            try {\n                const activateUrl = this.options.publicUrl ?\n                    `${this.options.publicUrl.replace(/\\/+$/, '')}/activate?token=${entity.activateHash}` :\n                    undefined;\n\n                const mail = await this.mailTemplateRenderer.render({\n                    template: MailTemplateName.REGISTRATION_ACTIVATION,\n                    params: { code: entity.activateHash!, url: activateUrl },\n                    locale: context?.locale,\n                });\n\n                await this.mailClient.send({\n                    to: entity.email,\n                    ...mail,\n                });\n            } catch {\n                await this.repository.remove(entity);\n                throw new ValidationError('Registration failed. Could not send activation email.');\n            }\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.REGISTER,\n            refType: EventRefType.USER,\n            refId: entity.id,\n            actorType: IdentityType.USER,\n            actorId: entity.id,\n            actorName: entity.name,\n            realmId: entity.realmId,\n        });\n\n        return { active: entity.active };\n    }\n\n    async activate(data: { token: string }): Promise<void> {\n        const entity = await this.repository.findOneBy({ activateHash: data.token });\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            active: true,\n            activateHash: null,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.ACCOUNT_ACTIVATED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AA+BA,IAAaa,sBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAiC;EACzC,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,uBAAuBI,IAAIJ;EAChC,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,SAASC,MAA2BC,SAAgE;EACtG,IAAI,CAAC,KAAKT,QAAQU,qBACd,MAAM,IAAIhB,0BAAAA;EAGd,MAAMiB,YAAY,IAAIf,UAAU,CAAC,CAAA;EACjCe,UAAUC,MAAM,IAAItB,cAAc;GAC9BuB,gBAAgB;IAAC;IAAS;IAAQ;IAAY;GAAU;GACxDC,mBAAmB,KAAKd,QAAQc;EACpC,CAAA,CAAA;EACA,MAAMC,YAAY,MAAMJ,UAAUK,IAAIR,MAAM,EAAES,OAAO,SAAS,CAAA;EAE9D,MAAM,KAAKd,WAAWe,oBAAoBH,SAAAA;EAE1C,IAAI,KAAKf,QAAQmB,0BAA0B;GACvCJ,UAAUK,SAAS;GACnBL,UAAUM,eAAe1B,YAAY,EAAA,CAAA,CAAI2B,SAAS,KAAA;EACtD,OACIP,UAAUK,SAAS;EAGvB,MAAMG,SAAS,KAAKpB,WAAWqB,OAAOT,SAAAA;EAEtC,MAAMU,qBAAqB,IAAI5B,uBAAAA;EAC/B0B,OAAOG,WAAWH,OAAOG,YAAYnC,aAAa,EAAA;EAClDgC,OAAOG,WAAW,MAAMD,mBAAmBE,QAAQJ,OAAOG,QAAQ;EAGlEH,OAAOO,WAAUF,MADG,KAAKxB,gBAAgByB,QAAQN,OAAOO,SAAS,IAAA,EAAA,CAC1CC;EAEvB,MAAM,KAAK5B,WAAW6B,KAAKT,MAAAA;EAE3B,IAAI,KAAKvB,QAAQmB,0BACb,IAAI;GACA,MAAMc,cAAc,KAAKjC,QAAQkC,YAC7B,GAAG,KAAKlC,QAAQkC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,kBAAkBZ,OAAOF,iBACvEe,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKnC,qBAAqBoC,OAAO;IAChDC,UAAUzC,iBAAiB0C;IAC3BC,QAAQ;KAAEC,MAAMnB,OAAOF;KAAesB,KAAKV;IAAY;IACvDW,QAAQnC,SAASmC;GACrB,CAAA;GAEA,MAAM,KAAK3C,WAAW4C,KAAK;IACvBC,IAAIvB,OAAOwB;IACX,GAAGV;GACP,CAAA;EACJ,QAAQ;GACJ,MAAM,KAAKlC,WAAW6C,OAAOzB,MAAAA;GAC7B,MAAM,IAAI9B,gBAAgB,uDAAA;EAC9B;EAGJ,MAAM,KAAKY,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAUmE;GAChBC,SAASnE,aAAaoE;GACtBC,OAAOjC,OAAOQ;GACd0B,WAAWpE,aAAakE;GACxBG,SAASnC,OAAOQ;GAChB4B,WAAWpC,OAAO6B;GAClBtB,SAASP,OAAOO;EACpB,CAAA;EAEA,OAAO,EAAEV,QAAQG,OAAOH,OAAO;CACnC;CAEA,MAAMwC,SAASpD,MAAwC;EACnD,MAAMe,SAAS,MAAM,KAAKpB,WAAW0D,UAAU,EAAExC,cAAcb,KAAKsD,MAAM,CAAA;EAE1E,IAAI,CAACvC,QACD,MAAM,IAAI/B,oBAAAA;EAGd,MAAMuE,SAAS,KAAK5D,WAAW6D,MAAMzC,QAAQ;GACzCH,QAAQ;GACRC,cAAc;EAClB,CAAA;EAEA,MAAM,KAAKlB,WAAW6B,KAAK+B,MAAAA;EAE3B,MAAM,KAAK1D,cAAc4C,OAAO;GAC5BC,OAAO9D,WAAW+D;GAClBC,MAAMlE,UAAU+E;GAChBX,SAASnE,aAAaoE;GACtBC,OAAOO,OAAOhC;GACd0B,WAAWpE,aAAakE;GACxBG,SAASK,OAAOhC;GAChB4B,WAAWI,OAAOX;GAClBtB,SAASiC,OAAOjC;EACpB,CAAA;CACJ;AACJ"}

package/dist/core/identity/resolver/module.d.ts

@@ -1,11 +1,10 @@
 import type { Identity } from '@authup/core-kit';
 import { IdentityType } from '@authup/core-kit';
 import type { IIdentityResolver, IdentityResolverContext } from './types.ts';
-import type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
+import type { IClientIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
 export declare class IdentityResolver implements IIdentityResolver {
     protected clientRepository: IClientIdentityRepository;
     protected userRepository: IUserIdentityRepository;
-    protected robotRepository: IRobotIdentityRepository;
     constructor(ctx: IdentityResolverContext);
     /**
      * A UUID key is resolved globally by primary key — `realmKey` scopes NAME
@@ -16,7 +15,6 @@ export declare class IdentityResolver implements IIdentityResolver {
      */
     resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;
     private resolveClient;
-    private resolveRobot;
     private resolveUser;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/core/identity/resolver/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAKX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEzH,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC;gBAExC,GAAG,EAAE,uBAAuB;IAMxC;;;;;;OAMG;IACG,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAgBb,aAAa;YAsBb,YAAY;YAsBZ,WAAW;CAqB5B"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,QAAQ,EAGX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,qBAAa,gBAAiB,YAAW,iBAAiB;IACtD,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;IAEtD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;gBAEtC,GAAG,EAAE,uBAAuB;IAKxC;;;;;;OAMG;IACG,OAAO,CACT,IAAI,EAAE,GAAG,YAAY,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAab,aAAa;YAsBb,WAAW;CAqB5B"}

package/dist/core/identity/resolver/module.mjs

@@ -7,11 +7,9 @@ import { IdentityType } from "@authup/core-kit";
 var IdentityResolver = class {
 	clientRepository;
 	userRepository;
-	robotRepository;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
 		this.userRepository = ctx.userRepository;
-		this.robotRepository = ctx.robotRepository;
 	}
 	/**
 	* A UUID key is resolved globally by primary key — `realmKey` scopes NAME
@@ -22,7 +20,6 @@ var IdentityResolver = class {
 	*/ async resolve(type, key, realmKey) {
 		switch (type) {
 			case IdentityType.CLIENT: return this.resolveClient(key, realmKey);
-			case IdentityType.ROBOT: return this.resolveRobot(key, realmKey);
 			case IdentityType.USER: return this.resolveUser(key, realmKey);
 		}
 		return null;
@@ -37,16 +34,6 @@ var IdentityResolver = class {
 		};
 		return null;
 	}
-	async resolveRobot(key, realmKey) {
-		let data;
-		if (isUUID(key)) data = await this.robotRepository.findOneById(key);
-		else data = await this.robotRepository.findOneByName(key, realmKey);
-		if (data) return {
-			type: IdentityType.ROBOT,
-			data
-		};
-		return null;
-	}
 	async resolveUser(key, realmKey) {
 		let data;
 		if (isUUID(key)) data = await this.userRepository.findOneById(key);

package/dist/core/identity/resolver/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","robotRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","ROBOT","resolveRobot","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    Robot, \n    RobotIdentity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected robotRepository: IRobotIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    /**\n     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME\n     * resolution only (UUIDs are globally unique, and the realm hint on the\n     * password grant is always set via the master fallback, so applying it to\n     * UUID keys would break realm-less id-identified logins). See\n     * architecture.md → Password grant realm resolution.\n     */\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.ROBOT: {\n                return this.resolveRobot(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveRobot(\n        key: string,\n        realmKey?: string,\n    ) : Promise<RobotIdentity | null> {\n        let data : Robot | null;\n\n        if (isUUID(key)) {\n            data = await this.robotRepository.findOneById(key);\n        } else {\n            data = await this.robotRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.ROBOT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAqBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;;IASA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKR,aAAaW,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKV,aAAaa,OACd,OAAO,KAAKC,aAAaL,KAAKC,QAAAA;GAElC,KAAKV,aAAae,MACd,OAAO,KAAKC,YAAYP,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKd,iBAAiBe,YAAYT,GAAAA;OAE/CQ,OAAO,MAAM,KAAKd,iBAAiBgB,cAAcV,KAAKC,QAAAA;EAG1D,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaW;GACnBM;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcH,aACVL,KACAC,UAC8B;EAC9B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKZ,gBAAgBa,YAAYT,GAAAA;OAE9CQ,OAAO,MAAM,KAAKZ,gBAAgBc,cAAcV,KAAKC,QAAAA;EAGzD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAaa;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVP,KACAC,UAC6B;EAC7B,IAAIO;EAEJ,IAAIhB,OAAOQ,GAAAA,GACPQ,OAAO,MAAM,KAAKb,eAAec,YAAYT,GAAAA;OAE7CQ,OAAO,MAAM,KAAKb,eAAee,cAAcV,KAAKC,QAAAA;EAGxD,IAAIO,MACA,OAAO;GACHT,MAAMR,aAAae;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","isUUID","IdentityResolver","clientRepository","userRepository","ctx","resolve","type","key","realmKey","CLIENT","resolveClient","USER","resolveUser","data","findOneById","findOneByName"],"sources":["../../../../src/core/identity/resolver/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    ClientIdentity, \n    Identity, \n    User, \n    UserIdentity,\n} from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { isUUID } from '@authup/kit';\nimport type { IIdentityResolver, IdentityResolverContext } from './types.ts';\nimport type { IClientIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';\n\nexport class IdentityResolver implements IIdentityResolver {\n    protected clientRepository: IClientIdentityRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    constructor(ctx: IdentityResolverContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n    }\n\n    /**\n     * A UUID key is resolved globally by primary key — `realmKey` scopes NAME\n     * resolution only (UUIDs are globally unique, and the realm hint on the\n     * password grant is always set via the master fallback, so applying it to\n     * UUID keys would break realm-less id-identified logins). See\n     * architecture.md → Password grant realm resolution.\n     */\n    async resolve(\n        type: `${IdentityType}`,\n        key: string,\n        realmKey?: string,\n    ): Promise<Identity | null> {\n        switch (type) {\n            case IdentityType.CLIENT: {\n                return this.resolveClient(key, realmKey);\n            }\n            case IdentityType.USER: {\n                return this.resolveUser(key, realmKey);\n            }\n        }\n\n        return null;\n    }\n\n    private async resolveClient(\n        key: string,\n        realmKey?: string,\n    ) : Promise<ClientIdentity | null> {\n        let data : Client | null;\n\n        if (isUUID(key)) {\n            data = await this.clientRepository.findOneById(key);\n        } else {\n            data = await this.clientRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.CLIENT,\n                data, \n            };\n        }\n\n        return null;\n    }\n\n    private async resolveUser(\n        key: string,\n        realmKey?: string,\n    ) : Promise<UserIdentity | null> {\n        let data : User | null;\n\n        if (isUUID(key)) {\n            data = await this.userRepository.findOneById(key);\n        } else {\n            data = await this.userRepository.findOneByName(key, realmKey);\n        }\n\n        if (data) {\n            return {\n                type: IdentityType.USER,\n                data, \n            };\n        }\n\n        return null;\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaE,mBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,iBAAiBC,IAAID;CAC9B;;;;;;;IASA,MAAME,QACFC,MACAC,KACAC,UACwB;EACxB,QAAQF,MAAR;GACI,KAAKP,aAAaU,QACd,OAAO,KAAKC,cAAcH,KAAKC,QAAAA;GAEnC,KAAKT,aAAaY,MACd,OAAO,KAAKC,YAAYL,KAAKC,QAAAA;EAErC;EAEA,OAAO;CACX;CAEA,MAAcE,cACVH,KACAC,UAC+B;EAC/B,IAAIK;EAEJ,IAAIb,OAAOO,GAAAA,GACPM,OAAO,MAAM,KAAKX,iBAAiBY,YAAYP,GAAAA;OAE/CM,OAAO,MAAM,KAAKX,iBAAiBa,cAAcR,KAAKC,QAAAA;EAG1D,IAAIK,MACA,OAAO;GACHP,MAAMP,aAAaU;GACnBI;EACJ;EAGJ,OAAO;CACX;CAEA,MAAcD,YACVL,KACAC,UAC6B;EAC7B,IAAIK;EAEJ,IAAIb,OAAOO,GAAAA,GACPM,OAAO,MAAM,KAAKV,eAAeW,YAAYP,GAAAA;OAE7CM,OAAO,MAAM,KAAKV,eAAeY,cAAcR,KAAKC,QAAAA;EAGxD,IAAIK,MACA,OAAO;GACHP,MAAMP,aAAaY;GACnBE;EACJ;EAGJ,OAAO;CACX;AACJ"}

package/dist/core/identity/resolver/types.d.ts

@@ -1,9 +1,8 @@
 import type { Identity, IdentityType } from '@authup/core-kit';
-import type { IClientIdentityRepository, IRobotIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
+import type { IClientIdentityRepository, IUserIdentityRepository } from '../entities/index.ts';
 export type IdentityResolverContext = {
     clientRepository: IClientIdentityRepository;
     userRepository: IUserIdentityRepository;
-    robotRepository: IRobotIdentityRepository;
 };
 export interface IIdentityResolver {
     resolve(type: `${IdentityType}`, key: string, realmKey?: string): Promise<Identity | null>;

package/dist/core/identity/resolver/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACR,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,uBAAuB,GAAG;IAClC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,cAAc,EAAE,uBAAuB,CAAC;IACxC,eAAe,EAAE,wBAAwB,CAAA;CAC5C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAC9B,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;CAC9F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/resolver/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACR,yBAAyB,EACzB,uBAAuB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,uBAAuB,GAAG;IAClC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,cAAc,EAAE,uBAAuB,CAAA;CAC1C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAC9B,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;CAC9F"}

package/dist/core/identity/role/module.d.ts

@@ -1,13 +1,11 @@
 import type { Role } from '@authup/core-kit';
 import type { IdentityPolicyData } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 import type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';
 export declare class IdentityRoleProvider implements IIdentityRoleProvider {
     protected clientRepository: IClientRepository;
     protected userRepository: IUserRepository;
-    protected robotRepository: IRobotRepository;
     constructor(ctx: IdentityRoleProviderContext);
     getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
     private reduceByIdentityClient;

package/dist/core/identity/role/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAEhC,GAAG,EAAE,2BAA2B;IAMtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAkBjE,OAAO,CAAC,sBAAsB;CAiBjC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAErF,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;gBAE9B,GAAG,EAAE,2BAA2B;IAKtC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAcjE,OAAO,CAAC,sBAAsB;CAiBjC"}

package/dist/core/identity/role/module.mjs

@@ -5,23 +5,20 @@ import.meta.url;
 var IdentityRoleProvider = class {
 	clientRepository;
 	userRepository;
-	robotRepository;
 	constructor(ctx) {
 		this.clientRepository = ctx.clientRepository;
 		this.userRepository = ctx.userRepository;
-		this.robotRepository = ctx.robotRepository;
 	}
 	async getRolesFor(identity) {
 		switch (identity.type) {
 			case "client": return this.clientRepository.getBoundRoles(identity.id);
 			case "user": return this.userRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
-			case "robot": return this.robotRepository.getBoundRoles(identity.id).then((data) => this.reduceByIdentityClient(data, identity));
 		}
 		return [];
 	}
 	reduceByIdentityClient(entities, identity) {
 		if (!identity.clientId) return entities;
-		return entities.filter((entity) => !entity.client_id || entity.client_id === identity.clientId);
+		return entities.filter((entity) => !entity.clientId || entity.clientId === identity.clientId);
 	}
 };
 //#endregion

package/dist/core/identity/role/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","robotRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity","client_id"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IRobotRepository } from '../../entities/robot/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    protected robotRepository: IRobotRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n        this.robotRepository = ctx.robotRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n            case 'robot': {\n                return this.robotRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { client_id?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        // Keep client-agnostic (global / realm) roles — client_id null — in\n        // addition to roles scoped to the authenticating client. Dropping the\n        // null case stripped every global/realm role from a token issued via\n        // a real client (e.g. the per-realm `web` client used by the\n        // realm-selection login), leaving permissions/roles empty.\n        return entities.filter(\n            (entity) => !entity.client_id || entity.client_id === identity.clientId,\n        );\n    }\n}\n"],"mappings":";;;;AAcA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKH,mBAAmBG,IAAIH;EAC5B,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKN,iBAAiBO,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKP,eAAeM,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;GAE1D,KAAK,SACD,OAAO,KAAKH,gBAAgBK,cAAcF,SAASG,EAAE,CAAA,CAChDC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAQX,OAAOA,SAASE,QACXC,WAAW,CAACA,OAAOC,aAAaD,OAAOC,cAAcX,SAASQ,QAAQ;CAE/E;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityRoleProvider","clientRepository","userRepository","ctx","getRolesFor","identity","type","getBoundRoles","id","then","data","reduceByIdentityClient","entities","clientId","filter","entity"],"sources":["../../../../src/core/identity/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Role } from '@authup/core-kit';\nimport type { IdentityPolicyData } from '@authup/access';\nimport type { IClientRepository } from '../../entities/client/types.ts';\nimport type { IUserRepository } from '../../entities/user/types.ts';\nimport type { IIdentityRoleProvider, IdentityRoleProviderContext } from './types.ts';\n\nexport class IdentityRoleProvider implements IIdentityRoleProvider {\n    protected clientRepository: IClientRepository;\n\n    protected userRepository: IUserRepository;\n\n    constructor(ctx: IdentityRoleProviderContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.userRepository = ctx.userRepository;\n    }\n\n    async getRolesFor(identity: IdentityPolicyData) : Promise<Role[]> {\n        switch (identity.type) {\n            case 'client': {\n                return this.clientRepository.getBoundRoles(identity.id);\n            }\n            case 'user': {\n                return this.userRepository.getBoundRoles(identity.id)\n                    .then((data) => this.reduceByIdentityClient(data, identity));\n            }\n        }\n\n        return [];\n    }\n\n    private reduceByIdentityClient<T extends { clientId?: string | null }>(\n        entities: T[],\n        identity: IdentityPolicyData,\n    ): T[] {\n        if (!identity.clientId) {\n            return entities;\n        }\n\n        // Keep client-agnostic (global / realm) roles — clientId null — in\n        // addition to roles scoped to the authenticating client. Dropping the\n        // null case stripped every global/realm role from a token issued via\n        // a real client (e.g. the per-realm `web` client used by the\n        // realm-selection login), leaving permissions/roles empty.\n        return entities.filter(\n            (entity) => !entity.clientId || entity.clientId === identity.clientId,\n        );\n    }\n}\n"],"mappings":";;;;AAaA,IAAaA,uBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,iBAAiBC,IAAID;CAC9B;CAEA,MAAME,YAAYC,UAAgD;EAC9D,QAAQA,SAASC,MAAjB;GACI,KAAK,UACD,OAAO,KAAKL,iBAAiBM,cAAcF,SAASG,EAAE;GAE1D,KAAK,QACD,OAAO,KAAKN,eAAeK,cAAcF,SAASG,EAAE,CAAA,CAC/CC,MAAMC,SAAS,KAAKC,uBAAuBD,MAAML,QAAAA,CAAAA;EAE9D;EAEA,OAAO,CAAA;CACX;CAEQM,uBACJC,UACAP,UACG;EACH,IAAI,CAACA,SAASQ,UACV,OAAOD;EAQX,OAAOA,SAASE,QACXC,WAAW,CAACA,OAAOF,YAAYE,OAAOF,aAAaR,SAASQ,QAAQ;CAE7E;AACJ"}

package/dist/core/identity/role/types.d.ts

@@ -1,7 +1,6 @@
 import type { Role } from '@authup/core-kit';
 import type { IdentityPolicyData } from '@authup/access';
 import type { IClientRepository } from '../../entities/client/types.ts';
-import type { IRobotRepository } from '../../entities/robot/types.ts';
 import type { IUserRepository } from '../../entities/user/types.ts';
 export interface IIdentityRoleProvider {
     getRolesFor(identity: IdentityPolicyData): Promise<Role[]>;
@@ -9,6 +8,5 @@ export interface IIdentityRoleProvider {
 export type IdentityRoleProviderContext = {
     clientRepository: IClientRepository;
     userRepository: IUserRepository;
-    robotRepository: IRobotRepository;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/identity/role/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IAClC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC9D;AAED,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/identity/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IAClC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC9D;AAED,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,cAAc,EAAE,eAAe,CAAC;CACnC,CAAC"}

package/dist/core/index.d.ts

@@ -8,5 +8,6 @@ export * from './oauth2/index.ts';
 export * from './identity/index.ts';
 export * from './ldap/index.ts';
 export * from './provisioning/index.ts';
+export * from './query/index.ts';
 export * from './security/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAOA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/core/index.mjs

@@ -3,11 +3,9 @@ import "node:url";
 import.meta.url;
 import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./entities/consent/types.mjs";
 import { ClientCredentialsService } from "./authentication/credential/entities/client/module.mjs";
-import { RobotCredentialsService } from "./authentication/credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "./authentication/credential/entities/user/module.mjs";
 import { BaseCredentialsAuthenticator } from "./authentication/base.mjs";
 import { ClientAuthenticator } from "./authentication/entities/client/module.mjs";
-import { RobotAuthenticator } from "./authentication/entities/robot/module.mjs";
 import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
 import { LoginThrottleService } from "./authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
@@ -16,6 +14,33 @@ import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
 import { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain } from "./client-certificate/module.mjs";
 import "./client-certificate/index.mjs";
+import { createRelationsReadGate } from "./query/relations.mjs";
+import { clientSchema } from "./entities/client/schema.mjs";
+import { clientPermissionSchema } from "./entities/client-permission/schema.mjs";
+import { clientRoleSchema } from "./entities/client-role/schema.mjs";
+import { clientScopeSchema } from "./entities/client-scope/schema.mjs";
+import { consentSchema } from "./entities/consent/schema.mjs";
+import { eventSchema } from "./entities/event/schema.mjs";
+import { identityProviderSchema } from "./entities/identity-provider/schema.mjs";
+import { identityProviderRoleMappingSchema } from "./entities/identity-provider-role-mapping/schema.mjs";
+import { keySchema } from "./entities/key/schema.mjs";
+import { permissionSchema } from "./entities/permission/schema.mjs";
+import { permissionPolicySchema } from "./entities/permission-policy/schema.mjs";
+import { policySchema } from "./entities/policy/schema.mjs";
+import { realmSchema } from "./entities/realm/schema.mjs";
+import { roleSchema } from "./entities/role/schema.mjs";
+import { roleAttributeSchema } from "./entities/role-attribute/schema.mjs";
+import { rolePermissionSchema } from "./entities/role-permission/schema.mjs";
+import { scopeSchema } from "./entities/scope/schema.mjs";
+import { sessionSchema } from "./entities/session/schema.mjs";
+import { trustAnchorSchema } from "./entities/trust-anchor/schema.mjs";
+import { userSchema } from "./entities/user/schema.mjs";
+import { userAttributeSchema } from "./entities/user-attribute/schema.mjs";
+import { userAuthenticatorSchema } from "./entities/user-authenticator/schema.mjs";
+import { userPermissionSchema } from "./entities/user-permission/schema.mjs";
+import { userRoleSchema } from "./entities/user-role/schema.mjs";
+import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./query/module.mjs";
+import "./query/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
 import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./identity/permission/junction-grant.mjs";
@@ -42,9 +67,6 @@ import { PermissionService } from "./entities/permission/service.mjs";
 import { PermissionPolicyService } from "./entities/permission-policy/service.mjs";
 import { PolicyService } from "./entities/policy/service.mjs";
 import { RealmService } from "./entities/realm/service.mjs";
-import { RobotService } from "./entities/robot/service.mjs";
-import { RobotPermissionService } from "./entities/robot-permission/service.mjs";
-import { RobotRoleService } from "./entities/robot-role/service.mjs";
 import { RoleService } from "./entities/role/service.mjs";
 import { RoleAttributeService } from "./entities/role-attribute/service.mjs";
 import { RolePermissionService } from "./entities/role-permission/service.mjs";
@@ -89,7 +111,6 @@ import { ClientCredentialsGrant } from "./oauth2/grant-types/client-credentials.
 import { IdentityGrantType } from "./oauth2/grant-types/identity.mjs";
 import { PasswordGrantType } from "./oauth2/grant-types/password.mjs";
 import { OAuth2RefreshTokenGrant } from "./oauth2/grant-types/refresh-token.mjs";
-import { RobotCredentialsGrant } from "./oauth2/grant-types/robot-credentials.mjs";
 import { OAuth2MfaLoginService } from "./oauth2/mfa-login/module.mjs";
 import { OAuth2OpenIDClaimsBuilder } from "./oauth2/openid/claims.mjs";
 import { OAuth2ScopeAttributesResolver } from "./oauth2/scope/resolver.mjs";
@@ -136,7 +157,6 @@ import { RoleProvisioningValidator } from "./provisioning/entities/role/validato
 import { createProvisioningEntitiesValidator } from "./provisioning/entities/utils.mjs";
 import { ClientProvisioningValidator } from "./provisioning/entities/client/validator.mjs";
 import { PolicyProvisioningValidator } from "./provisioning/entities/policy/validator.mjs";
-import { RobotProvisioningValidator } from "./provisioning/entities/robot/validator.mjs";
 import { ScopeProvisioningValidator } from "./provisioning/entities/scope/validator.mjs";
 import { UserProvisioningValidator } from "./provisioning/entities/user/validator.mjs";
 import { RealmProvisioningValidator } from "./provisioning/entities/realm/validator.mjs";
@@ -149,9 +169,8 @@ import { PolicyProvisioningSynchronizer } from "./provisioning/synchronizer/poli
 import { RealmProvisioningSynchronizer } from "./provisioning/synchronizer/realm/module.mjs";
 import { RoleProvisioningSynchronizer } from "./provisioning/synchronizer/role/module.mjs";
 import { GraphProvisioningSynchronizer } from "./provisioning/synchronizer/root/module.mjs";
-import { RobotProvisioningSynchronizer } from "./provisioning/synchronizer/robot/module.mjs";
 import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RobotAuthenticator, RobotCredentialsGrant, RobotCredentialsService, RobotPermissionService, RobotProvisioningSynchronizer, RobotProvisioningValidator, RobotRoleService, RobotService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, defineMailTemplate, deriveAmrAcr, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, isRealmCipherBlobError, isWrappedKeyMaterial, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, sanitizeEventData, toIdentityPolicyData, unwrapKeyMaterial, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, eventSchema, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/key/provisioner.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner.mjs","names":["JWKUse","KeyProvisioner","keyStore","logger","ctx","ensureForRealm","realm","uses","SIGNATURE","ENCRYPTION","use","resolveOrCreate","id","e","warn","Error","message","String"],"sources":["../../../src/core/key/provisioner.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport type { IKeyProvisioner, IKeyStore } from './types.ts';\n\nexport type KeyProvisionerContext = {\n    keyStore: IKeyStore,\n    logger?: Logger,\n};\n\n/**\n * Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at\n * realm creation and as a startup backfill, so keys are visible in the\n * management API from the moment a realm exists instead of appearing on\n * first use. resolveOrCreate stays as the zero-rows self-healing backstop.\n */\nexport class KeyProvisioner implements IKeyProvisioner {\n    protected keyStore: IKeyStore;\n\n    protected logger?: Logger;\n\n    constructor(ctx: KeyProvisionerContext) {\n        this.keyStore = ctx.keyStore;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const uses : `${JWKUse}`[] = [JWKUse.SIGNATURE, JWKUse.ENCRYPTION];\n\n        for (const use of uses) {\n            try {\n                await this.keyStore.resolveOrCreate(realm.id, use);\n            } catch (e) {\n                // rows-exist-but-none-active throws by design (a deliberate\n                // admin kill switch) — the provisioning guarantee is only\n                // \"at least one row exists\", so log and continue.\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision ${use} key for realm ${realm.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAuBA,IAAaC,iBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA4B;EACpC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,SAASC,IAAID;CACtB;CAEA,MAAME,eAAeC,OAA8C;EAC/D,MAAMC,OAAuB,CAACP,OAAOQ,WAAWR,OAAOS,UAAAA;EAEvD,KAAK,MAAMC,OAAOH,MACd,IAAI;GACA,MAAM,KAAKL,SAASS,gBAAgBL,MAAMM,IAAIF,GAAAA;EAClD,SAASG,GAAG;GAIR,IAAI,KAAKV,QACL,KAAKA,OAAOW,KACR,uBAAuBJ,IAAI,iBAAiBJ,MAAMM,GAAG,IAAIC,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGjH;CAER;AACJ"}
+{"version":3,"file":"provisioner.mjs","names":["JWKUse","KeyProvisioner","keyStore","logger","ctx","ensureForRealm","realm","uses","SIGNATURE","ENCRYPTION","use","resolveOrCreate","id","e","warn","Error","message","String"],"sources":["../../../src/core/key/provisioner.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport type { IKeyProvisioner, IKeyStore } from './types.ts';\n\nexport type KeyProvisionerContext = {\n    keyStore: IKeyStore,\n    logger?: Logger,\n};\n\n/**\n * Eagerly mints a realm's sig + enc keys (plan 071 hybrid model): run at\n * realm creation and as a startup backfill, so keys are visible in the\n * management API from the moment a realm exists instead of appearing on\n * first use. resolveOrCreate stays as the zero-rows self-healing backstop.\n */\nexport class KeyProvisioner implements IKeyProvisioner {\n    protected keyStore: IKeyStore;\n\n    protected logger?: Logger;\n\n    constructor(ctx: KeyProvisionerContext) {\n        this.keyStore = ctx.keyStore;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const uses : `${JWKUse}`[] = [JWKUse.SIGNATURE, JWKUse.ENCRYPTION];\n\n        for (const use of uses) {\n            try {\n                await this.keyStore.resolveOrCreate(realm.id, use);\n            } catch (e) {\n                // rows-exist-but-none-active throws by design (a deliberate\n                // admin kill switch) — the provisioning guarantee is only\n                // \"at least one row exists\", so log and continue.\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision ${use} key for realm ${realm.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAuBA,IAAaC,iBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA4B;EACpC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,SAASC,IAAID;CACtB;CAEA,MAAME,eAAeC,OAA8C;EAC/D,MAAMC,OAAuB,CAACP,OAAOQ,WAAWR,OAAOS,UAAW;EAElE,KAAK,MAAMC,OAAOH,MACd,IAAI;GACA,MAAM,KAAKL,SAASS,gBAAgBL,MAAMM,IAAIF,GAAAA;EAClD,SAASG,GAAG;GAIR,IAAI,KAAKV,QACL,KAAKA,OAAOW,KACR,uBAAuBJ,IAAI,iBAAiBJ,MAAMM,GAAG,IAAIC,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGjH;CAER;AACJ"}

package/dist/core/key/realm-cipher.mjs

@@ -22,8 +22,8 @@ var RealmCipher = class {
 	}
 	async encrypt(plain, realmId) {
 		const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);
-		if (!key.decryption_key) throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);
-		const cipher = this.resolveCipher(key.id, key.decryption_key);
+		if (!key.decryptionKey) throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);
+		const cipher = this.resolveCipher(key.id, key.decryptionKey);
 		return [
 			"v1",
 			key.id,
@@ -35,10 +35,10 @@ var RealmCipher = class {
 		if (parts.length !== 3 || parts[0] !== "v1") throw new RealmCipherBlobError("The cipher blob is malformed.");
 		const [, keyId, payload] = parts;
 		const key = await this.keyStore.resolveById(keyId);
-		if (!key || key.use !== JWKUse.ENCRYPTION || !key.decryption_key) throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);
+		if (!key || key.use !== JWKUse.ENCRYPTION || !key.decryptionKey) throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);
 		if (key.status === KeyStatus.DISABLED) throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);
-		if (key.realm_id !== realmId) throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);
-		const cipher = this.resolveCipher(key.id, key.decryption_key);
+		if (key.realmId !== realmId) throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);
+		const cipher = this.resolveCipher(key.id, key.decryptionKey);
 		try {
 			return await cipher.decrypt(payload);
 		} catch {

package/dist/core/key/realm-cipher.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"realm-cipher.mjs","names":["AuthupError","KeyStatus","SymmetricCipher","JWKUse","REALM_CIPHER_BLOB_VERSION","RealmCipherBlobError","RealmCipher","keyStore","ciphers","ctx","Map","encrypt","plain","realmId","key","resolveOrCreate","ENCRYPTION","decryption_key","cipher","resolveCipher","id","join","decrypt","blob","parts","split","length","keyId","payload","resolveById","use","status","DISABLED","realm_id","material","get","set"],"sources":["../../../src/core/key/realm-cipher.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport { REALM_CIPHER_BLOB_VERSION } from './constants.ts';\nimport { RealmCipherBlobError } from './error.ts';\nimport type { IKeyStore, IRealmCipher } from './types.ts';\n\nexport type RealmCipherContext = {\n    keyStore: IKeyStore,\n};\n\nexport class RealmCipher implements IRealmCipher {\n    protected keyStore : IKeyStore;\n\n    /**\n     * Imported ciphers by key id — key MATERIAL is immutable, so entries\n     * never invalidate. Status and realm binding are deliberately NOT\n     * cached: decrypt re-resolves the key row every call so disabling a\n     * key acts as an immediate, reversible kill switch.\n     */\n    protected ciphers : Map<string, ISymmetricCipher>;\n\n    constructor(ctx: RealmCipherContext) {\n        this.keyStore = ctx.keyStore;\n        this.ciphers = new Map();\n    }\n\n    async encrypt(plain: string, realmId: string) : Promise<string> {\n        const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);\n        if (!key.decryption_key) {\n            throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryption_key);\n\n        return [\n            REALM_CIPHER_BLOB_VERSION,\n            key.id,\n            await cipher.encrypt(plain),\n        ].join('.');\n    }\n\n    async decrypt(blob: string, realmId: string) : Promise<string> {\n        const parts = blob.split('.');\n        if (parts.length !== 3 || parts[0] !== REALM_CIPHER_BLOB_VERSION) {\n            throw new RealmCipherBlobError('The cipher blob is malformed.');\n        }\n\n        const [, keyId, payload] = parts;\n\n        const key = await this.keyStore.resolveById(keyId);\n        if (\n            !key ||\n            key.use !== JWKUse.ENCRYPTION ||\n            !key.decryption_key\n        ) {\n            throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);\n        }\n\n        if (key.status === KeyStatus.DISABLED) {\n            throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);\n        }\n\n        if (key.realm_id !== realmId) {\n            throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryption_key);\n\n        try {\n            return await cipher.decrypt(payload);\n        } catch {\n            // failed GCM authentication / corrupt payload — blob semantics,\n            // not infrastructure.\n            throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);\n        }\n    }\n\n    protected resolveCipher(\n        keyId: string,\n        material: string,\n    ) : ISymmetricCipher {\n        let cipher = this.ciphers.get(keyId);\n        if (!cipher) {\n            cipher = new SymmetricCipher(material);\n            this.ciphers.set(keyId, cipher);\n        }\n\n        return cipher;\n    }\n}\n"],"mappings":";;;;;;;;;;AAoBA,IAAaM,cAAb,MAAaA;CACCC;;;;;;IAQV;CAEA,YAAYE,KAAyB;EACjC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,0BAAU,IAAIE,IAAAA;CACvB;CAEA,MAAMC,QAAQC,OAAeC,SAAmC;EAC5D,MAAMC,MAAM,MAAM,KAAKP,SAASQ,gBAAgBF,SAASV,OAAOa,UAAU;EAC1E,IAAI,CAACF,IAAIG,gBACL,MAAM,IAAIjB,YAAY,qDAAqDa,QAAQ,EAAE;EAGzF,MAAMK,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,cAAc;EAE5D,OAAO;;GAEHH,IAAIM;GACJ,MAAMF,OAAOP,QAAQC,KAAAA;GACxB,CAACS,KAAK,GAAA;CACX;CAEA,MAAMC,QAAQC,MAAcV,SAAmC;EAC3D,MAAMW,QAAQD,KAAKE,MAAM,GAAA;EACzB,IAAID,MAAME,WAAW,KAAKF,MAAM,OAAA,MAC5B,MAAM,IAAInB,qBAAqB,+BAAA;EAGnC,MAAM,GAAGsB,OAAOC,WAAWJ;EAE3B,MAAMV,MAAM,MAAM,KAAKP,SAASsB,YAAYF,KAAAA;EAC5C,IACI,CAACb,OACDA,IAAIgB,QAAQ3B,OAAOa,cACnB,CAACF,IAAIG,gBAEL,MAAM,IAAIZ,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAIiB,WAAW9B,UAAU+B,UACzB,MAAM,IAAI3B,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAImB,aAAapB,SACjB,MAAM,IAAIR,qBAAqB,gEAAgEsB,MAAM,GAAG;EAG5G,MAAMT,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,cAAc;EAE5D,IAAI;GACA,OAAO,MAAMC,OAAOI,QAAQM,OAAAA;EAChC,QAAQ;GAGJ,MAAM,IAAIvB,qBAAqB,2CAA2CsB,MAAM,GAAG;EACvF;CACJ;CAEUR,cACNQ,OACAO,UACiB;EACjB,IAAIhB,SAAS,KAAKV,QAAQ2B,IAAIR,KAAAA;EAC9B,IAAI,CAACT,QAAQ;GACTA,SAAS,IAAIhB,gBAAgBgC,QAAAA;GAC7B,KAAK1B,QAAQ4B,IAAIT,OAAOT,MAAAA;EAC5B;EAEA,OAAOA;CACX;AACJ"}
+{"version":3,"file":"realm-cipher.mjs","names":["AuthupError","KeyStatus","SymmetricCipher","JWKUse","REALM_CIPHER_BLOB_VERSION","RealmCipherBlobError","RealmCipher","keyStore","ciphers","ctx","Map","encrypt","plain","realmId","key","resolveOrCreate","ENCRYPTION","decryptionKey","cipher","resolveCipher","id","join","decrypt","blob","parts","split","length","keyId","payload","resolveById","use","status","DISABLED","material","get","set"],"sources":["../../../src/core/key/realm-cipher.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport { KeyStatus } from '@authup/core-kit';\nimport type { ISymmetricCipher } from '@authup/server-kit';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { JWKUse } from '@authup/specs';\nimport { REALM_CIPHER_BLOB_VERSION } from './constants.ts';\nimport { RealmCipherBlobError } from './error.ts';\nimport type { IKeyStore, IRealmCipher } from './types.ts';\n\nexport type RealmCipherContext = {\n    keyStore: IKeyStore,\n};\n\nexport class RealmCipher implements IRealmCipher {\n    protected keyStore : IKeyStore;\n\n    /**\n     * Imported ciphers by key id — key MATERIAL is immutable, so entries\n     * never invalidate. Status and realm binding are deliberately NOT\n     * cached: decrypt re-resolves the key row every call so disabling a\n     * key acts as an immediate, reversible kill switch.\n     */\n    protected ciphers : Map<string, ISymmetricCipher>;\n\n    constructor(ctx: RealmCipherContext) {\n        this.keyStore = ctx.keyStore;\n        this.ciphers = new Map();\n    }\n\n    async encrypt(plain: string, realmId: string) : Promise<string> {\n        const key = await this.keyStore.resolveOrCreate(realmId, JWKUse.ENCRYPTION);\n        if (!key.decryptionKey) {\n            throw new AuthupError(`An encryption key could not be resolved for realm ${realmId}.`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryptionKey);\n\n        return [\n            REALM_CIPHER_BLOB_VERSION,\n            key.id,\n            await cipher.encrypt(plain),\n        ].join('.');\n    }\n\n    async decrypt(blob: string, realmId: string) : Promise<string> {\n        const parts = blob.split('.');\n        if (parts.length !== 3 || parts[0] !== REALM_CIPHER_BLOB_VERSION) {\n            throw new RealmCipherBlobError('The cipher blob is malformed.');\n        }\n\n        const [, keyId, payload] = parts;\n\n        const key = await this.keyStore.resolveById(keyId);\n        if (\n            !key ||\n            key.use !== JWKUse.ENCRYPTION ||\n            !key.decryptionKey\n        ) {\n            throw new RealmCipherBlobError(`The cipher blob references an unknown encryption key (${keyId}).`);\n        }\n\n        if (key.status === KeyStatus.DISABLED) {\n            throw new RealmCipherBlobError(`The cipher blob references a disabled encryption key (${keyId}).`);\n        }\n\n        if (key.realmId !== realmId) {\n            throw new RealmCipherBlobError(`The cipher blob references a foreign realm's encryption key (${keyId}).`);\n        }\n\n        const cipher = this.resolveCipher(key.id, key.decryptionKey);\n\n        try {\n            return await cipher.decrypt(payload);\n        } catch {\n            // failed GCM authentication / corrupt payload — blob semantics,\n            // not infrastructure.\n            throw new RealmCipherBlobError(`The cipher blob could not be decrypted (${keyId}).`);\n        }\n    }\n\n    protected resolveCipher(\n        keyId: string,\n        material: string,\n    ) : ISymmetricCipher {\n        let cipher = this.ciphers.get(keyId);\n        if (!cipher) {\n            cipher = new SymmetricCipher(material);\n            this.ciphers.set(keyId, cipher);\n        }\n\n        return cipher;\n    }\n}\n"],"mappings":";;;;;;;;;;AAoBA,IAAaM,cAAb,MAAaA;CACCC;;;;;;IAQV;CAEA,YAAYE,KAAyB;EACjC,KAAKF,WAAWE,IAAIF;EACpB,KAAKC,0BAAU,IAAIE,IAAAA;CACvB;CAEA,MAAMC,QAAQC,OAAeC,SAAmC;EAC5D,MAAMC,MAAM,MAAM,KAAKP,SAASQ,gBAAgBF,SAASV,OAAOa,UAAU;EAC1E,IAAI,CAACF,IAAIG,eACL,MAAM,IAAIjB,YAAY,qDAAqDa,QAAQ,EAAE;EAGzF,MAAMK,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,aAAa;EAE3D,OAAO;;GAEHH,IAAIM;GACJ,MAAMF,OAAOP,QAAQC,KAAAA;EACxB,CAAA,CAACS,KAAK,GAAA;CACX;CAEA,MAAMC,QAAQC,MAAcV,SAAmC;EAC3D,MAAMW,QAAQD,KAAKE,MAAM,GAAA;EACzB,IAAID,MAAME,WAAW,KAAKF,MAAM,OAAA,MAC5B,MAAM,IAAInB,qBAAqB,+BAAA;EAGnC,MAAM,GAAGsB,OAAOC,WAAWJ;EAE3B,MAAMV,MAAM,MAAM,KAAKP,SAASsB,YAAYF,KAAAA;EAC5C,IACI,CAACb,OACDA,IAAIgB,QAAQ3B,OAAOa,cACnB,CAACF,IAAIG,eAEL,MAAM,IAAIZ,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAIiB,WAAW9B,UAAU+B,UACzB,MAAM,IAAI3B,qBAAqB,yDAAyDsB,MAAM,GAAG;EAGrG,IAAIb,IAAID,YAAYA,SAChB,MAAM,IAAIR,qBAAqB,gEAAgEsB,MAAM,GAAG;EAG5G,MAAMT,SAAS,KAAKC,cAAcL,IAAIM,IAAIN,IAAIG,aAAa;EAE3D,IAAI;GACA,OAAO,MAAMC,OAAOI,QAAQM,OAAAA;EAChC,QAAQ;GAGJ,MAAM,IAAIvB,qBAAqB,2CAA2CsB,MAAM,GAAG;EACvF;CACJ;CAEUR,cACNQ,OACAM,UACiB;EACjB,IAAIf,SAAS,KAAKV,QAAQ0B,IAAIP,KAAAA;EAC9B,IAAI,CAACT,QAAQ;GACTA,SAAS,IAAIhB,gBAAgB+B,QAAAA;GAC7B,KAAKzB,QAAQ2B,IAAIR,OAAOT,MAAAA;EAC5B;EAEA,OAAOA;CACX;AACJ"}

package/dist/core/mail/template/templates/mfa-email-otp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-email-otp.mjs","names":["TranslatorTranslationMailKey","code","note","paragraph","defineMailTemplate","MailTemplateName","mfaEmailOtpMailTemplate","name","MFA_EMAIL_OTP","build","params","t","subject","intro","codeLabel","hint","Promise","all","MFA_EMAIL_OTP_SUBJECT","MFA_EMAIL_OTP_INTRO","CODE","MFA_EMAIL_OTP_HINT","expiry","expiresInMinutes","MFA_EMAIL_OTP_EXPIRY","minutes","undefined","preview","blocks"],"sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { code, note, paragraph } from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const mfaEmailOtpMailTemplate = defineMailTemplate({\n    name: MailTemplateName.MFA_EMAIL_OTP,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT),\n        ]);\n\n        const expiry = params.expiresInMinutes ?\n            await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) :\n            undefined;\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(expiry ? [note(expiry)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAYA,MAAaM,0BAA0BF,mBAAmB;CACtDG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,QAAQ,MAAMC,QAAQC,IAAI;GACxDN,EAAEX,6BAA6BkB,qBAAqB;GACpDP,EAAEX,6BAA6BmB,mBAAmB;GAClDR,EAAEX,6BAA6BoB,IAAI;GACnCT,EAAEX,6BAA6BqB,kBAAkB;GACpD;EAED,MAAMC,SAASZ,OAAOa,mBAClB,MAAMZ,EAAEX,6BAA6BwB,sBAAsB,EAAEC,SAASf,OAAOa,iBAAiB,CAAA,IAC9FG,KAAAA;EAEJ,OAAO;GACHd;GACAe,SAASd;GACTe,QAAQ;IACJzB,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;OACvBqB,SAAS,CAACpB,KAAKoB,MAAAA,CAAAA,IAAW,CAAA;IAC9BpB,KAAKa,IAAAA;;EAEb;CACJ;AACJ,CAAA"}
+{"version":3,"file":"mfa-email-otp.mjs","names":["TranslatorTranslationMailKey","code","note","paragraph","defineMailTemplate","MailTemplateName","mfaEmailOtpMailTemplate","name","MFA_EMAIL_OTP","build","params","t","subject","intro","codeLabel","hint","Promise","all","MFA_EMAIL_OTP_SUBJECT","MFA_EMAIL_OTP_INTRO","CODE","MFA_EMAIL_OTP_HINT","expiry","expiresInMinutes","MFA_EMAIL_OTP_EXPIRY","minutes","undefined","preview","blocks"],"sources":["../../../../../src/core/mail/template/templates/mfa-email-otp.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { code, note, paragraph } from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const mfaEmailOtpMailTemplate = defineMailTemplate({\n    name: MailTemplateName.MFA_EMAIL_OTP,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_SUBJECT),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_HINT),\n        ]);\n\n        const expiry = params.expiresInMinutes ?\n            await t(TranslatorTranslationMailKey.MFA_EMAIL_OTP_EXPIRY, { minutes: params.expiresInMinutes }) :\n            undefined;\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(expiry ? [note(expiry)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAYA,MAAaM,0BAA0BF,mBAAmB;CACtDG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,QAAQ,MAAMC,QAAQC,IAAI;GACxDN,EAAEX,6BAA6BkB,qBAAqB;GACpDP,EAAEX,6BAA6BmB,mBAAmB;GAClDR,EAAEX,6BAA6BoB,IAAI;GACnCT,EAAEX,6BAA6BqB,kBAAkB;EACpD,CAAA;EAED,MAAMC,SAASZ,OAAOa,mBAClB,MAAMZ,EAAEX,6BAA6BwB,sBAAsB,EAAEC,SAASf,OAAOa,iBAAiB,CAAA,IAC9FG,KAAAA;EAEJ,OAAO;GACHd;GACAe,SAASd;GACTe,QAAQ;IACJzB,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;IACvBqB,GAAAA,SAAS,CAACpB,KAAKoB,MAAAA,CAAQ,IAAG,CAAA;IAC9BpB,KAAKa,IAAAA;GACR;EACL;CACJ;AACJ,CAAA"}

package/dist/core/mail/template/templates/password-reset.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.mjs","names":["TranslatorTranslationMailKey","action","code","note","paragraph","defineMailTemplate","MailTemplateName","passwordResetMailTemplate","name","PASSWORD_RESET","build","params","t","subject","intro","codeLabel","actionLabel","hint","Promise","all","PASSWORD_RESET_SUBJECT","PASSWORD_RESET_INTRO","CODE","PASSWORD_RESET_ACTION","PASSWORD_RESET_HINT","expiry","expiresInMinutes","PASSWORD_RESET_EXPIRY","minutes","undefined","preview","blocks","url"],"sources":["../../../../../src/core/mail/template/templates/password-reset.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { \n    action, \n    code, \n    note, \n    paragraph, \n} from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const passwordResetMailTemplate = defineMailTemplate({\n    name: MailTemplateName.PASSWORD_RESET,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, actionLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_SUBJECT),\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_ACTION),\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_HINT),\n        ]);\n\n        const expiry = params.expiresInMinutes ?\n            await t(TranslatorTranslationMailKey.PASSWORD_RESET_EXPIRY, { minutes: params.expiresInMinutes }) :\n            undefined;\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(params.url ? [action(actionLabel, params.url)] : []),\n                ...(expiry ? [note(expiry)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAiBA,MAAaO,4BAA4BF,mBAAmB;CACxDG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,aAAaC,QAAQ,MAAMC,QAAQC,IAAI;GACrEP,EAAEZ,6BAA6BoB,sBAAsB;GACrDR,EAAEZ,6BAA6BqB,oBAAoB;GACnDT,EAAEZ,6BAA6BsB,IAAI;GACnCV,EAAEZ,6BAA6BuB,qBAAqB;GACpDX,EAAEZ,6BAA6BwB,mBAAmB;GACrD;EAED,MAAMC,SAASd,OAAOe,mBAClB,MAAMd,EAAEZ,6BAA6B2B,uBAAuB,EAAEC,SAASjB,OAAOe,iBAAiB,CAAA,IAC/FG,KAAAA;EAEJ,OAAO;GACHhB;GACAiB,SAAShB;GACTiB,QAAQ;IACJ3B,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;OACvBS,OAAOqB,MAAM,CAAC/B,OAAOe,aAAaL,OAAOqB,GAAG,CAAA,IAAK,CAAA;OACjDP,SAAS,CAACtB,KAAKsB,MAAAA,CAAAA,IAAW,CAAA;IAC9BtB,KAAKc,IAAAA;;EAEb;CACJ;AACJ,CAAA"}
+{"version":3,"file":"password-reset.mjs","names":["TranslatorTranslationMailKey","action","code","note","paragraph","defineMailTemplate","MailTemplateName","passwordResetMailTemplate","name","PASSWORD_RESET","build","params","t","subject","intro","codeLabel","actionLabel","hint","Promise","all","PASSWORD_RESET_SUBJECT","PASSWORD_RESET_INTRO","CODE","PASSWORD_RESET_ACTION","PASSWORD_RESET_HINT","expiry","expiresInMinutes","PASSWORD_RESET_EXPIRY","minutes","undefined","preview","blocks","url"],"sources":["../../../../../src/core/mail/template/templates/password-reset.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { \n    action, \n    code, \n    note, \n    paragraph, \n} from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const passwordResetMailTemplate = defineMailTemplate({\n    name: MailTemplateName.PASSWORD_RESET,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, actionLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_SUBJECT),\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_ACTION),\n            t(TranslatorTranslationMailKey.PASSWORD_RESET_HINT),\n        ]);\n\n        const expiry = params.expiresInMinutes ?\n            await t(TranslatorTranslationMailKey.PASSWORD_RESET_EXPIRY, { minutes: params.expiresInMinutes }) :\n            undefined;\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(params.url ? [action(actionLabel, params.url)] : []),\n                ...(expiry ? [note(expiry)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAiBA,MAAaO,4BAA4BF,mBAAmB;CACxDG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,aAAaC,QAAQ,MAAMC,QAAQC,IAAI;GACrEP,EAAEZ,6BAA6BoB,sBAAsB;GACrDR,EAAEZ,6BAA6BqB,oBAAoB;GACnDT,EAAEZ,6BAA6BsB,IAAI;GACnCV,EAAEZ,6BAA6BuB,qBAAqB;GACpDX,EAAEZ,6BAA6BwB,mBAAmB;EACrD,CAAA;EAED,MAAMC,SAASd,OAAOe,mBAClB,MAAMd,EAAEZ,6BAA6B2B,uBAAuB,EAAEC,SAASjB,OAAOe,iBAAiB,CAAA,IAC/FG,KAAAA;EAEJ,OAAO;GACHhB;GACAiB,SAAShB;GACTiB,QAAQ;IACJ3B,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;IACvBS,GAAAA,OAAOqB,MAAM,CAAC/B,OAAOe,aAAaL,OAAOqB,GAAG,CAAE,IAAG,CAAA;IACjDP,GAAAA,SAAS,CAACtB,KAAKsB,MAAAA,CAAQ,IAAG,CAAA;IAC9BtB,KAAKc,IAAAA;GACR;EACL;CACJ;AACJ,CAAA"}

package/dist/core/mail/template/templates/registration-activation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registration-activation.mjs","names":["TranslatorTranslationMailKey","action","code","note","paragraph","defineMailTemplate","MailTemplateName","registrationActivationMailTemplate","name","REGISTRATION_ACTIVATION","build","params","t","subject","intro","codeLabel","actionLabel","hint","Promise","all","REGISTRATION_ACTIVATION_SUBJECT","REGISTRATION_ACTIVATION_INTRO","CODE","REGISTRATION_ACTIVATION_ACTION","REGISTRATION_ACTIVATION_HINT","preview","blocks","url"],"sources":["../../../../../src/core/mail/template/templates/registration-activation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { \n    action, \n    code, \n    note, \n    paragraph, \n} from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const registrationActivationMailTemplate = defineMailTemplate({\n    name: MailTemplateName.REGISTRATION_ACTIVATION,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, actionLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_SUBJECT),\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_ACTION),\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_HINT),\n        ]);\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(params.url ? [action(actionLabel, params.url)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAiBA,MAAaO,qCAAqCF,mBAAmB;CACjEG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,aAAaC,QAAQ,MAAMC,QAAQC,IAAI;GACrEP,EAAEZ,6BAA6BoB,+BAA+B;GAC9DR,EAAEZ,6BAA6BqB,6BAA6B;GAC5DT,EAAEZ,6BAA6BsB,IAAI;GACnCV,EAAEZ,6BAA6BuB,8BAA8B;GAC7DX,EAAEZ,6BAA6BwB,4BAA4B;GAC9D;EAED,OAAO;GACHX;GACAY,SAASX;GACTY,QAAQ;IACJtB,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;OACvBS,OAAOgB,MAAM,CAAC1B,OAAOe,aAAaL,OAAOgB,GAAG,CAAA,IAAK,CAAA;IACrDxB,KAAKc,IAAAA;;EAEb;CACJ;AACJ,CAAA"}
+{"version":3,"file":"registration-activation.mjs","names":["TranslatorTranslationMailKey","action","code","note","paragraph","defineMailTemplate","MailTemplateName","registrationActivationMailTemplate","name","REGISTRATION_ACTIVATION","build","params","t","subject","intro","codeLabel","actionLabel","hint","Promise","all","REGISTRATION_ACTIVATION_SUBJECT","REGISTRATION_ACTIVATION_INTRO","CODE","REGISTRATION_ACTIVATION_ACTION","REGISTRATION_ACTIVATION_HINT","preview","blocks","url"],"sources":["../../../../../src/core/mail/template/templates/registration-activation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TranslatorTranslationMailKey } from '@authup/i18n';\nimport { \n    action, \n    code, \n    note, \n    paragraph, \n} from '../../format/blocks.ts';\nimport { defineMailTemplate } from '../define.ts';\nimport { MailTemplateName } from '../types.ts';\n\nexport const registrationActivationMailTemplate = defineMailTemplate({\n    name: MailTemplateName.REGISTRATION_ACTIVATION,\n    build: async (params, t) => {\n        const [subject, intro, codeLabel, actionLabel, hint] = await Promise.all([\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_SUBJECT),\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_INTRO),\n            t(TranslatorTranslationMailKey.CODE),\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_ACTION),\n            t(TranslatorTranslationMailKey.REGISTRATION_ACTIVATION_HINT),\n        ]);\n\n        return {\n            subject,\n            preview: intro,\n            blocks: [\n                paragraph(intro),\n                code(codeLabel, params.code),\n                ...(params.url ? [action(actionLabel, params.url)] : []),\n                note(hint),\n            ],\n        };\n    },\n});\n"],"mappings":";;;;;;;;AAiBA,MAAaO,qCAAqCF,mBAAmB;CACjEG,MAAMF,iBAAiBG;CACvBC,OAAO,OAAOC,QAAQC,MAAAA;EAClB,MAAM,CAACC,SAASC,OAAOC,WAAWC,aAAaC,QAAQ,MAAMC,QAAQC,IAAI;GACrEP,EAAEZ,6BAA6BoB,+BAA+B;GAC9DR,EAAEZ,6BAA6BqB,6BAA6B;GAC5DT,EAAEZ,6BAA6BsB,IAAI;GACnCV,EAAEZ,6BAA6BuB,8BAA8B;GAC7DX,EAAEZ,6BAA6BwB,4BAA4B;EAC9D,CAAA;EAED,OAAO;GACHX;GACAY,SAASX;GACTY,QAAQ;IACJtB,UAAUU,KAAAA;IACVZ,KAAKa,WAAWJ,OAAOT,IAAI;IACvBS,GAAAA,OAAOgB,MAAM,CAAC1B,OAAOe,aAAaL,OAAOgB,GAAG,CAAE,IAAG,CAAA;IACrDxB,KAAKc,IAAAA;GACR;EACL;CACJ;AACJ,CAAA"}

package/dist/core/mail/template/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n    MFA_EMAIL_OTP = 'mfa-email-otp',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n    [MailTemplateName.MFA_EMAIL_OTP]: {\n        code: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;;QAAAA"}
+{"version":3,"file":"types.mjs","names":["MailTemplateName"],"sources":["../../../../src/core/mail/template/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { TranslatorTranslationMailKey } from '@authup/i18n';\nimport type { MailBlock } from '../format/types.ts';\n\nexport enum MailTemplateName {\n    REGISTRATION_ACTIVATION = 'registration-activation',\n    PASSWORD_RESET = 'password-reset',\n    MFA_EMAIL_OTP = 'mfa-email-otp',\n}\n\nexport type MailTemplateParamsMap = {\n    [MailTemplateName.REGISTRATION_ACTIVATION]: {\n        code: string,\n        url?: string,\n    },\n    [MailTemplateName.PASSWORD_RESET]: {\n        code: string,\n        url?: string,\n        expiresInMinutes?: number,\n    },\n    [MailTemplateName.MFA_EMAIL_OTP]: {\n        code: string,\n        expiresInMinutes?: number,\n    },\n};\n\n/**\n * Locale-bound translator handed to a template's `build`. Resolves a key\n * of the `authupMail` namespace (`@authup/i18n`) through ilingo — `data`\n * feeds `{{var}}` interpolation. Async so file- or remote-backed override\n * stores can slot in behind the same contract.\n */\nexport type MailTemplateTranslator = (\n    key: `${TranslatorTranslationMailKey}`,\n    data?: Record<string, any>,\n) => Promise<string>;\n\nexport type MailTemplateBuildOutput = {\n    subject: string,\n    // Hidden preheader shown by mail clients as the preview line.\n    preview?: string,\n    blocks: MailBlock[],\n};\n\n/**\n * A mail template composes its body from blocks; subject, html and text\n * all derive from the same build output. Copy is not embedded — it is\n * resolved per locale through the supplied translator.\n */\nexport type MailTemplate<N extends MailTemplateName = MailTemplateName> = {\n    name: N,\n    build(\n        params: MailTemplateParamsMap[N],\n        t: MailTemplateTranslator,\n    ): Promise<MailTemplateBuildOutput>,\n};\n"],"mappings":";;;;AAUA,IAAO,mBAAKA,uBAAAA,kBAAAA;;;;CAAAA,OAAAA;AAIX,EAAA,CAAA,CAAA"}