@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.60

package/dist/core/oauth2/mfa-login/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","userAgent","ipAddress","realmId","sub","id","subKind","USER","mfaAt","authMethod","PASSWORD","Date","toISOString","token","payload","issue","client_id","session_id","user_agent","remote_address","sub_kind","realm_id","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","actorType","actorId","actorName","userName","requestIpAddress","requestUserAgent","data","grantType","sessionId","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: user.realmId,\n            clientId,\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: null,\n            authMethod: SessionAuthMethod.PASSWORD,\n            expiresAt: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realmId,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfaAt was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: session.clientId ?? undefined,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realmId,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: session.clientId ?? null,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realmId,\n            requestIpAddress: session.ipAddress ?? null,\n            requestUserAgent: session.userAgent ?? null,\n            data: {\n                grantType: OAuth2TokenGrant.PASSWORD,\n                sessionId: session.id,\n            },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,WAAWR,QAAQQ;GACnBC,WAAWT,QAAQS;GACnBC,SAAST,KAAKS;GACdR;GACAS,KAAKV,KAAKW;GACVC,SAAS7B,aAAa8B;GACtBC,OAAO;GACPC,YAAY9B,kBAAkB+B;GAC9Bb,4BAAW,IAAIc,KAAKd,YAAY,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAK9B,aAAa+B,MAAM;GACnDC,WAAWrB;GACXsB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBE,KAAKV,KAAKW;GACVe,UAAUhD,cAAcmC;GACxBc,UAAU3B,KAAKS;GACfmB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHgB;GACAe,WAAWd,QAAQa,MACfb,QAAQa,MAAME,KAAKC,MAAMnB,KAAKoB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG,KAEH;OAAA,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/CxB,WAAWjB,QAAQJ,YAAYC,KAAAA;GAC/BqB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBuC,OAAO/D,UAAUgE;GACjBtC,KAAKL,QAAQK;GACbgB,UAAUhD,cAAcmC;GACxBc,UAAUtB,QAAQI;GAClBmB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkB8B,MAAMyB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmB6B,MAAMyB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQM;GACfV,UAAUI,QAAQJ,YAAY;GAC9B0D,WAAW5E,aAAa8B;GACxB+C,SAASvD,QAAQK;GACjBmD,WAAW/D,MAAMgE,YAAY;GAC7BrD,SAASJ,QAAQI;GACjBsD,kBAAkB1D,QAAQG,aAAa;GACvCwD,kBAAkB3D,QAAQE,aAAa;GACvC0D,MAAM;IACFC,WAAWvF,iBAAiBqC;IAC5BmD,WAAW9D,QAAQM;GACvB;EACJ,CAAA;EACA,KAAKhB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2GrantError","OAuth2SubKind","OAuth2TokenGrant","EventName","EventRefType","EventScope","IdentityType","ScopeName","SessionAuthMethod","deriveAmrAcr","buildOAuth2BearerTokenResponse","OAuth2MfaLoginService","sessionManager","ticketIssuer","accessTokenIssuer","refreshTokenIssuer","tokenRepository","eventService","metrics","ctx","issueTicket","input","options","user","clientId","undefined","expiresAt","buildExp","session","create","userAgent","ipAddress","realmId","sub","id","subKind","USER","mfaAt","authMethod","PASSWORD","Date","toISOString","token","payload","issue","client_id","session_id","user_agent","remote_address","sub_kind","realm_id","realm_name","realm","name","confirmation","cnf","exp","expiresIn","Math","floor","now","complete","ticket","refresh","amrAcr","jti","claimed","claimInactive","invalid","issuePayload","scope","GLOBAL","accessToken","accessTokenPayload","refreshToken","refreshTokenPayload","record","OAUTH2","LOGIN","refType","SESSION","refId","sessionId","actorType","actorId","actorName","userName","requestIpAddress","requestUserAgent","data","grantType","recordLogin"],"sources":["../../../../src/core/oauth2/mfa-login/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenGrantResponse, OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2GrantError, OAuth2SubKind, OAuth2TokenGrant } from '@authup/specs';\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    ScopeName,\n    SessionAuthMethod,\n} from '@authup/core-kit';\nimport type { IEventService } from '../../entities/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport { deriveAmrAcr } from '../authorization/helpers.ts';\nimport { buildOAuth2BearerTokenResponse } from '../response/index.ts';\nimport type { IOAuth2TokenIssuer, IOAuth2TokenRepository } from '../token/index.ts';\nimport type {\n    IOAuth2MfaLoginService,\n    OAuth2MfaLoginCompleteInput,\n    OAuth2MfaLoginServiceContext,\n    OAuth2MfaLoginTicket,\n    OAuth2MfaLoginTicketIssueInput,\n    OAuth2MfaLoginTicketIssueOptions,\n} from './types.ts';\n\nexport class OAuth2MfaLoginService implements IOAuth2MfaLoginService {\n    protected sessionManager : ISessionManager;\n\n    protected ticketIssuer : IOAuth2TokenIssuer;\n\n    protected accessTokenIssuer : IOAuth2TokenIssuer;\n\n    protected refreshTokenIssuer : IOAuth2TokenIssuer;\n\n    protected tokenRepository : IOAuth2TokenRepository;\n\n    protected eventService? : IEventService;\n\n    protected metrics? : IAuthFlowMetrics;\n\n    constructor(ctx: OAuth2MfaLoginServiceContext) {\n        this.sessionManager = ctx.sessionManager;\n        this.ticketIssuer = ctx.ticketIssuer;\n        this.accessTokenIssuer = ctx.accessTokenIssuer;\n        this.refreshTokenIssuer = ctx.refreshTokenIssuer;\n        this.tokenRepository = ctx.tokenRepository;\n        this.eventService = ctx.eventService;\n        this.metrics = ctx.metrics;\n    }\n\n    async issueTicket(\n        input: OAuth2MfaLoginTicketIssueInput,\n        options: OAuth2MfaLoginTicketIssueOptions = {},\n    ) : Promise<OAuth2MfaLoginTicket> {\n        const { user } = input;\n        const clientId = input.clientId ?? undefined;\n\n        // One expiration instant for BOTH artifacts — the pending session\n        // lives exactly as long as the ticket (an abandoned login\n        // self-expires and is swept with the regular session sweep;\n        // completion extends it to the full lifetime). Computed once so\n        // the two cannot drift.\n        const expiresAt = this.ticketIssuer.buildExp();\n\n        const session = await this.sessionManager.create({\n            userAgent: options.userAgent,\n            ipAddress: options.ipAddress,\n            realmId: user.realmId,\n            // no `clientId`: a USER-subject session, and the column is the\n            // client-SUBJECT foreign key. The application rides the ticket\n            // and lands on the token rows at completion.\n            sub: user.id,\n            subKind: IdentityType.USER,\n            mfaAt: null,\n            authMethod: SessionAuthMethod.PASSWORD,\n            expiresAt: new Date(expiresAt * 1000).toISOString(),\n        });\n\n        // No scope, no role claims — the ticket is not a bearer; it only\n        // unlocks the challenge routes (which opt in by kind).\n        const [token, payload] = await this.ticketIssuer.issue({\n            client_id: clientId,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            sub: user.id,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: user.realmId,\n            realm_name: user.realm?.name,\n            ...(input.confirmation ? { cnf: input.confirmation } : {}),\n            exp: expiresAt,\n        });\n\n        return {\n            token,\n            expiresIn: payload.exp ?\n                payload.exp - Math.floor(Date.now() / 1000) :\n                0,\n        };\n    }\n\n    async complete(input: OAuth2MfaLoginCompleteInput) : Promise<OAuth2TokenGrantResponse> {\n        const { ticket } = input;\n\n        // Extend the ticket-scoped pending session to the regular session\n        // lifetime — the login is complete now.\n        const session = await this.sessionManager.refresh(input.session);\n\n        // mfaAt was stamped inside the verify unit of work, so the claims\n        // advertise the completed factor (amr +otp, acr urn:authup:mfa).\n        const amrAcr = deriveAmrAcr(session);\n\n        // Single use: atomically claim the ticket BEFORE minting so two\n        // concurrent completions (a mixed-kind user presenting two distinct\n        // fresh factors) cannot both issue a token pair — `claimInactive` is a\n        // set-if-absent write, so exactly one racer wins. The trade-off vs.\n        // claiming after minting is that a mint failure burns the ticket — the\n        // safer bias for a single-use login credential (the user re-authenticates).\n        if (ticket.jti) {\n            const claimed = await this.tokenRepository.claimInactive(ticket.jti, ticket.exp);\n            if (!claimed) {\n                throw OAuth2GrantError.invalid('mfa login ticket has already been used');\n            }\n        }\n\n        const issuePayload : Partial<OAuth2TokenPayload> = {\n            client_id: ticket.client_id ?? undefined,\n            session_id: session.id,\n            user_agent: session.userAgent,\n            remote_address: session.ipAddress,\n            scope: ScopeName.GLOBAL,\n            sub: session.sub,\n            sub_kind: OAuth2SubKind.USER,\n            realm_id: session.realmId,\n            realm_name: ticket.realm_name,\n            ...(ticket.cnf ? { cnf: ticket.cnf } : {}),\n            ...amrAcr,\n        };\n\n        const [accessToken, accessTokenPayload] = await this.accessTokenIssuer.issue(issuePayload);\n        const [refreshToken, refreshTokenPayload] = await this.refreshTokenIssuer.issue(issuePayload);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGIN,\n            refType: EventRefType.SESSION,\n            refId: session.id,\n            clientId: ticket.client_id ?? null,\n            sessionId: session.id,\n            actorType: IdentityType.USER,\n            actorId: session.sub,\n            actorName: input.userName ?? null,\n            realmId: session.realmId,\n            requestIpAddress: session.ipAddress ?? null,\n            requestUserAgent: session.userAgent ?? null,\n            data: { grantType: OAuth2TokenGrant.PASSWORD },\n        });\n        this.metrics?.recordLogin('success');\n\n        return buildOAuth2BearerTokenResponse({\n            accessToken,\n            accessTokenPayload,\n            refreshToken,\n            refreshTokenPayload,\n        });\n    }\n}\n"],"mappings":";;;;;;;;AAgCA,IAAaW,wBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAmC;EAC3C,KAAKP,iBAAiBO,IAAIP;EAC1B,KAAKC,eAAeM,IAAIN;EACxB,KAAKC,oBAAoBK,IAAIL;EAC7B,KAAKC,qBAAqBI,IAAIJ;EAC9B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MAAME,YACFC,OACAC,UAA4C,CAAC,GACf;EAC9B,MAAM,EAAEC,SAASF;EACjB,MAAMG,WAAWH,MAAMG,YAAYC,KAAAA;EAOnC,MAAMC,YAAY,KAAKb,aAAac,SAAQ;EAE5C,MAAMC,UAAU,MAAM,KAAKhB,eAAeiB,OAAO;GAC7CC,WAAWR,QAAQQ;GACnBC,WAAWT,QAAQS;GACnBC,SAAST,KAAKS;GAIdC,KAAKV,KAAKW;GACVC,SAAS7B,aAAa8B;GACtBC,OAAO;GACPC,YAAY9B,kBAAkB+B;GAC9Bb,4BAAW,IAAIc,KAAKd,YAAY,GAAA,EAAA,CAAMe,YAAW;EACrD,CAAA;EAIA,MAAM,CAACC,OAAOC,WAAW,MAAM,KAAK9B,aAAa+B,MAAM;GACnDC,WAAWrB;GACXsB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBE,KAAKV,KAAKW;GACVe,UAAUhD,cAAcmC;GACxBc,UAAU3B,KAAKS;GACfmB,YAAY5B,KAAK6B,OAAOC;GACxB,GAAIhC,MAAMiC,eAAe,EAAEC,KAAKlC,MAAMiC,aAAa,IAAI,CAAC;GACxDE,KAAK9B;EACT,CAAA;EAEA,OAAO;GACHgB;GACAe,WAAWd,QAAQa,MACfb,QAAQa,MAAME,KAAKC,MAAMnB,KAAKoB,IAAG,IAAK,GAAA,IACtC;EACR;CACJ;CAEA,MAAMC,SAASxC,OAAwE;EACnF,MAAM,EAAEyC,WAAWzC;EAInB,MAAMO,UAAU,MAAM,KAAKhB,eAAemD,QAAQ1C,MAAMO,OAAO;EAI/D,MAAMoC,SAASvD,aAAamB,OAAAA;EAQ5B,IAAIkC,OAAOG,KAEH;OAAA,CAACC,MADiB,KAAKlD,gBAAgBmD,cAAcL,OAAOG,KAAKH,OAAON,GAAG,GAE3E,MAAMxD,iBAAiBoE,QAAQ,wCAAA;EAAA;EAIvC,MAAMC,eAA6C;GAC/CxB,WAAWiB,OAAOjB,aAAapB,KAAAA;GAC/BqB,YAAYlB,QAAQM;GACpBa,YAAYnB,QAAQE;GACpBkB,gBAAgBpB,QAAQG;GACxBuC,OAAO/D,UAAUgE;GACjBtC,KAAKL,QAAQK;GACbgB,UAAUhD,cAAcmC;GACxBc,UAAUtB,QAAQI;GAClBmB,YAAYW,OAAOX;GACnB,GAAIW,OAAOP,MAAM,EAAEA,KAAKO,OAAOP,IAAI,IAAI,CAAC;GACxC,GAAGS;EACP;EAEA,MAAM,CAACQ,aAAaC,sBAAsB,MAAM,KAAK3D,kBAAkB8B,MAAMyB,YAAAA;EAC7E,MAAM,CAACK,cAAcC,uBAAuB,MAAM,KAAK5D,mBAAmB6B,MAAMyB,YAAAA;EAEhF,MAAM,KAAKpD,cAAc2D,OAAO;GAC5BN,OAAOjE,WAAWwE;GAClBxB,MAAMlD,UAAU2E;GAChBC,SAAS3E,aAAa4E;GACtBC,OAAOrD,QAAQM;GACfV,UAAUsC,OAAOjB,aAAa;GAC9BqC,WAAWtD,QAAQM;GACnBiD,WAAW7E,aAAa8B;GACxBgD,SAASxD,QAAQK;GACjBoD,WAAWhE,MAAMiE,YAAY;GAC7BtD,SAASJ,QAAQI;GACjBuD,kBAAkB3D,QAAQG,aAAa;GACvCyD,kBAAkB5D,QAAQE,aAAa;GACvC2D,MAAM,EAAEC,WAAWxF,iBAAiBqC,SAAS;EACjD,CAAA;EACA,KAAKrB,SAASyE,YAAY,SAAA;EAE1B,OAAOjF,+BAA+B;GAClC8D;GACAC;GACAC;GACAC;EACJ,CAAA;CACJ;AACJ"}

package/dist/core/oauth2/session-token/error.d.ts

@@ -0,0 +1,36 @@
+import { ValidationError } from '@authup/errors';
+export declare const SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE: unique symbol;
+/**
+ * A row the token references no longer exists.
+ *
+ * Raised by the repository adapter when the inventory insert is rejected by a
+ * foreign key. Both parents can vanish between the caller resolving them and
+ * the write landing: the session (a concurrent refresh-token replay reaction,
+ * an explicit logout, an admin force-logout, the session sweeper) and the
+ * client the token is attributed to (an admin deleting the application).
+ *
+ * The error deliberately does NOT name which one. Only postgres reports the
+ * failing constraint as a field; mysql buries it in the message text and sqlite
+ * reports nothing but "FOREIGN KEY constraint failed", so a per-relation
+ * classification would be unimplementable on the dialect the test suite runs
+ * on. It also would not buy anything: both parents cascade onto
+ * `auth_session_tokens`, so either one going missing has already deleted the
+ * token rows, and the answer for the caller is the same.
+ *
+ * Transport-agnostic on purpose: the refresh grant re-raises it as
+ * `invalid_grant`, every other issuing path lets it settle as the 400 its code
+ * maps to.
+ */
+export declare class SessionTokenRelationMissingError extends ValidationError {
+    constructor();
+}
+/**
+ * Deliberately marker-only, with no `code` fallback: `ENTITY_RELATION_INVALID`
+ * is the shared code for every invalid relation reference (`sanitizeError`
+ * assigns it to typeorm-extension's join-column lookup failures too), so
+ * matching on it would claim unrelated errors. The error never crosses a wire
+ * boundary before it is caught, so there is nothing for a rehydrated match to
+ * recover.
+ */
+export declare function isSessionTokenRelationMissingError(input: unknown): input is SessionTokenRelationMissingError;
+//# sourceMappingURL=error.d.ts.map

package/dist/core/oauth2/session-token/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAEH,eAAe,EAGlB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,6CAA6C,eAAqE,CAAC;AAEhI;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,gCAAiC,SAAQ,eAAe;;CAQpE;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gCAAgC,CAE5G"}

package/dist/core/oauth2/session-token/error.mjs

@@ -0,0 +1,49 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ErrorCode, ValidationError, markInstanceof, matchesInstanceof } from "@authup/errors";
+//#region src/core/oauth2/session-token/error.ts
+const SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE = Symbol.for("@authup/server-core/SessionTokenRelationMissingError");
+/**
+* A row the token references no longer exists.
+*
+* Raised by the repository adapter when the inventory insert is rejected by a
+* foreign key. Both parents can vanish between the caller resolving them and
+* the write landing: the session (a concurrent refresh-token replay reaction,
+* an explicit logout, an admin force-logout, the session sweeper) and the
+* client the token is attributed to (an admin deleting the application).
+*
+* The error deliberately does NOT name which one. Only postgres reports the
+* failing constraint as a field; mysql buries it in the message text and sqlite
+* reports nothing but "FOREIGN KEY constraint failed", so a per-relation
+* classification would be unimplementable on the dialect the test suite runs
+* on. It also would not buy anything: both parents cascade onto
+* `auth_session_tokens`, so either one going missing has already deleted the
+* token rows, and the answer for the caller is the same.
+*
+* Transport-agnostic on purpose: the refresh grant re-raises it as
+* `invalid_grant`, every other issuing path lets it settle as the 400 its code
+* maps to.
+*/ var SessionTokenRelationMissingError = class extends ValidationError {
+	constructor() {
+		super({
+			code: ErrorCode.ENTITY_RELATION_INVALID,
+			message: "A row the token references no longer exists."
+		});
+		markInstanceof(this, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);
+	}
+};
+/**
+* Deliberately marker-only, with no `code` fallback: `ENTITY_RELATION_INVALID`
+* is the shared code for every invalid relation reference (`sanitizeError`
+* assigns it to typeorm-extension's join-column lookup failures too), so
+* matching on it would claim unrelated errors. The error never crosses a wire
+* boundary before it is caught, so there is nothing for a rehydrated match to
+* recover.
+*/ function isSessionTokenRelationMissingError(input) {
+	return matchesInstanceof(input, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);
+}
+//#endregion
+export { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/oauth2/session-token/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["ErrorCode","ValidationError","markInstanceof","matchesInstanceof","SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE","Symbol","for","SessionTokenRelationMissingError","code","ENTITY_RELATION_INVALID","message","isSessionTokenRelationMissingError","input"],"sources":["../../../../src/core/oauth2/session-token/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    ErrorCode,\n    ValidationError,\n    markInstanceof,\n    matchesInstanceof,\n} from '@authup/errors';\n\nexport const SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE = Symbol.for('@authup/server-core/SessionTokenRelationMissingError');\n\n/**\n * A row the token references no longer exists.\n *\n * Raised by the repository adapter when the inventory insert is rejected by a\n * foreign key. Both parents can vanish between the caller resolving them and\n * the write landing: the session (a concurrent refresh-token replay reaction,\n * an explicit logout, an admin force-logout, the session sweeper) and the\n * client the token is attributed to (an admin deleting the application).\n *\n * The error deliberately does NOT name which one. Only postgres reports the\n * failing constraint as a field; mysql buries it in the message text and sqlite\n * reports nothing but \"FOREIGN KEY constraint failed\", so a per-relation\n * classification would be unimplementable on the dialect the test suite runs\n * on. It also would not buy anything: both parents cascade onto\n * `auth_session_tokens`, so either one going missing has already deleted the\n * token rows, and the answer for the caller is the same.\n *\n * Transport-agnostic on purpose: the refresh grant re-raises it as\n * `invalid_grant`, every other issuing path lets it settle as the 400 its code\n * maps to.\n */\nexport class SessionTokenRelationMissingError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: 'A row the token references no longer exists.',\n        });\n        markInstanceof(this, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);\n    }\n}\n\n/**\n * Deliberately marker-only, with no `code` fallback: `ENTITY_RELATION_INVALID`\n * is the shared code for every invalid relation reference (`sanitizeError`\n * assigns it to typeorm-extension's join-column lookup failures too), so\n * matching on it would claim unrelated errors. The error never crosses a wire\n * boundary before it is caught, so there is nothing for a rehydrated match to\n * recover.\n */\nexport function isSessionTokenRelationMissingError(input: unknown): input is SessionTokenRelationMissingError {\n    return matchesInstanceof(input, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;AAcA,MAAaI,gDAAgDC,OAAOC,IAAI,sDAAA;;;;;;;;;;;;;;;;;;;;;GAuBxE,IAAaC,mCAAb,cAAsDN,gBAAAA;CAClD,cAAc;EACV,MAAM;GACFO,MAAMR,UAAUS;GAChBC,SAAS;EACb,CAAA;EACAR,eAAe,MAAME,6CAAAA;CACzB;AACJ;;;;;;;;GAUA,SAAgBO,mCAAmCC,OAAc;CAC7D,OAAOT,kBAAkBS,OAAOR,6CAAAA;AACpC"}

package/dist/core/oauth2/session-token/index.d.ts

@@ -1,2 +1,3 @@
+export * from './error.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/session-token/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/session-token/index.mjs

@@ -1,4 +1,5 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./error.mjs";
+export { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };

package/dist/core/oauth2/session-token/types.d.ts

@@ -1,7 +1,14 @@
 import type { SessionToken, SessionTokenKind } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
 export type SessionTokenCreateInput = {
     id: string;
     sessionId: string;
+    /**
+     * The client the token is issued for. Optional: a mint site that knows no
+     * client (an MFA-login completion) persists null rather than guessing.
+     */
+    clientId?: string | null;
     kind: SessionTokenKind;
     parentId?: string | null;
     refreshTokenId?: string | null;
@@ -14,8 +21,41 @@ export type SessionTokenRef = {
     expiresAt: string;
 };
 export interface ISessionTokenRepository {
+    /**
+     * Paginated inventory read.
+     *
+     * The `session` relation is joined unconditionally, because the caller's
+     * authorization resolves through it: the rows carry no realm or subject of
+     * their own. A `fields` projection must not be able to strip what the gate
+     * reads (the plan-039 discipline, through a relation instead of a column).
+     */
+    findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>>;
+    /**
+     * Load EVERY row matching a query, unbounded. A bulk revoke must reach
+     * every match, so the schema's pagination cap is deliberately not applied
+     * (same reasoning as `ISessionRepository.findAllByQuery`).
+     */
+    findAllByQuery(query: IQuery): Promise<SessionToken[]>;
+    /**
+     * Load one row by jti WITH its session joined.
+     *
+     * Separate from `findOneById` because authorization resolves through the
+     * session: ownership and realm both live there, and a row without it fails
+     * closed. Deliberately not expressed as a query, so the lookup cannot be
+     * weakened by a decode that silently drops the predicate.
+     */
+    findOneWithSessionById(id: string): Promise<SessionToken | null>;
     /**
      * Persist a newly issued session-token row.
+     *
+     * Throws `SessionTokenRelationMissingError` when a row the token references
+     * is gone: `sessionId`, or the `clientId` it is attributed to. Both are
+     * resolved before the write, so a concurrent delete (a replay reaction, a
+     * logout, the sweeper, an application being removed) can land in between
+     * and the write is then rejected. Which of the two it was is deliberately
+     * not reported, since both cascade onto this table and so leave the token
+     * equally unusable. Callers that own an OAuth2 error vocabulary translate
+     * it; the rest let it settle as a plain validation failure.
      */
     create(input: SessionTokenCreateInput): Promise<SessionToken>;
     /**

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAE/E;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEvD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}

package/dist/core/oauth2/token/issuer/access/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB,EAC5C,sBAAsB,CAAC,EAAE,uBAAuB;IAU9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;cAgChE,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EACR,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,qBAAa,uBAAwB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC5F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,oBAAoB,CAAC,EAAE,qBAAqB,EAC5C,sBAAsB,CAAC,EAAE,uBAAuB;IAU9C,KAAK,CACP,KAAK,GAAE,kBAAuB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;cAwCtB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAI,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;CA6BrI"}

package/dist/core/oauth2/token/issuer/access/module.mjs

@@ -31,6 +31,7 @@ var OAuth2AccessTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
 			sessionId: data.session_id,
+			clientId: data.client_id ?? null,
 			kind: "access",
 			refreshTokenId: input.refresh_token_id ?? null,
 			ipAddress: data.remote_address ?? "",

package/dist/core/oauth2/token/issuer/access/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","refreshTokenId","refresh_token_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","clientId","client_id","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'access',\n                refreshTokenId: input.refresh_token_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realmId) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realmId === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAgBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKd,0BAA0BQ,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,gBAAgBnB,MAAMoB,oBAAoB;GAC1CC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAK;CACxB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAM4B,OAAO,CAAC5B,MAAM6B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKlC,qBAAqBmC,YAAY;GACtDC,MAAMhC,MAAM6B;GACZZ,IAAIjB,MAAM4B;GACVK,UAAUjC,MAAMkC;GAChBC,SAASnC,MAAMoC;GACfC,WAAWrC,MAAMsC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQX,OACf,IAAI,CAACW,KAAKN,SACNK,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI3C,MAAMoC,YAAYK,KAAKN,YAAYnC,MAAMoC,UAChDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEd,OAAOS,WAAW;GAClCM,eAAe,EAAEf,OAAOU,YAAY;EACxC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2AccessTokenIssuer","repository","signer","identityRoleProvider","sessionTokenRepository","options","issue","input","iss","buildIss","accessClaims","buildAccessClaims","data","insert","kind","ACCESS","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","clientId","client_id","refreshTokenId","refresh_token_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString","sub","sub_kind","roles","getRolesFor","type","realmId","realm_id","realmName","realm_name","realmRoles","globalRoles","role","push","name","realm_access","global_access"],"sources":["../../../../../../src/core/oauth2/token/issuer/access/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type {\n    IOAuth2TokenIssuer,\n    OAuth2TokenIssuerOptions,\n    OAuth2TokenIssuerResponse,\n} from '../types.ts';\nimport type { IIdentityRoleProvider } from '../../../../identity/index.ts';\n\nexport class OAuth2AccessTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected identityRoleProvider?: IIdentityRoleProvider;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        identityRoleProvider?: IIdentityRoleProvider,\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.identityRoleProvider = identityRoleProvider;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(\n        input: OAuth2TokenPayload = {},\n    ) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const accessClaims = await this.buildAccessClaims(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.ACCESS,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n            ...accessClaims,\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (\n            this.sessionTokenRepository &&\n            data.session_id &&\n            data.jti &&\n            typeof data.exp === 'number'\n        ) {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                // Per-application attribution (plan 086). The same client the\n                // payload was minted for, so the row needs no extra lookup.\n                clientId: data.client_id ?? null,\n                kind: 'access',\n                refreshTokenId: input.refresh_token_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n\n    protected async buildAccessClaims(input: OAuth2TokenPayload) : Promise<Pick<OAuth2TokenPayload, 'realm_access' | 'global_access'>> {\n        if (!this.identityRoleProvider || !input.sub || !input.sub_kind) {\n            return {};\n        }\n\n        const roles = await this.identityRoleProvider.getRolesFor({\n            type: input.sub_kind,\n            id: input.sub,\n            clientId: input.client_id,\n            realmId: input.realm_id,\n            realmName: input.realm_name,\n        });\n\n        const realmRoles: string[] = [];\n        const globalRoles: string[] = [];\n\n        for (const role of roles) {\n            if (!role.realmId) {\n                globalRoles.push(role.name);\n            } else if (input.realm_id && role.realmId === input.realm_id) {\n                realmRoles.push(role.name);\n            }\n        }\n\n        return {\n            realm_access: { roles: realmRoles },\n            global_access: { roles: globalRoles },\n        };\n    }\n}\n"],"mappings":";;;;;;AAoBA,IAAaE,0BAAb,cAA6CD,sBAAAA;CAC/BE;CAEAC;CAEAC;CAEAC;CAEV,YACIH,YACAC,QACAG,UAAoC,CAAC,GACrCF,sBACAC,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKJ,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,uBAAuBA;EAC5B,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MACFC,QAA4B,CAAC,GACM;EACnC,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,eAAe,MAAM,KAAKC,kBAAkBJ,KAAAA;EAElD,MAAMK,OAAO,MAAM,KAAKX,WAAWY,OAAO;GACtC,GAAGN;GACHO,MAAMhB,gBAAgBiB;GACtBC,KAAK,KAAKC,SAASV,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;GACrB,GAAGE;EACP,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKhB,OAAOiB,KAAKP,IAAAA;EAErC,MAAM,KAAKX,WAAWmB,kBAAkBR,MAAMM,KAAAA;EAE9C,IACI,KAAKd,0BACLQ,KAAKS,cACLT,KAAKU,OACL,OAAOV,KAAKI,QAAQ,UAEpB,MAAM,KAAKZ,uBAAuBmB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAGhBK,UAAUd,KAAKe,aAAa;GAC5Bb,MAAM;GACNc,gBAAgBrB,MAAMsB,oBAAoB;GAC1CC,WAAWlB,KAAKmB,kBAAkB;GAClCC,WAAWpB,KAAKqB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKvB,KAAKI,MAAM,GAAA,EAAA,CAAMoB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAClB,OAAON,IAAK;CACxB;CAEA,MAAgBD,kBAAkBJ,OAAiG;EAC/H,IAAI,CAAC,KAAKJ,wBAAwB,CAACI,MAAM8B,OAAO,CAAC9B,MAAM+B,UACnD,OAAO,CAAC;EAGZ,MAAMC,QAAQ,MAAM,KAAKpC,qBAAqBqC,YAAY;GACtDC,MAAMlC,MAAM+B;GACZd,IAAIjB,MAAM8B;GACVX,UAAUnB,MAAMoB;GAChBe,SAASnC,MAAMoC;GACfC,WAAWrC,MAAMsC;EACrB,CAAA;EAEA,MAAMC,aAAuB,CAAA;EAC7B,MAAMC,cAAwB,CAAA;EAE9B,KAAK,MAAMC,QAAQT,OACf,IAAI,CAACS,KAAKN,SACNK,YAAYE,KAAKD,KAAKE,IAAI;OACvB,IAAI3C,MAAMoC,YAAYK,KAAKN,YAAYnC,MAAMoC,UAChDG,WAAWG,KAAKD,KAAKE,IAAI;EAIjC,OAAO;GACHC,cAAc,EAAEZ,OAAOO,WAAW;GAClCM,eAAe,EAAEb,OAAOQ,YAAY;EACxC;CACJ;AACJ"}

package/dist/core/oauth2/token/issuer/base.d.ts

@@ -3,7 +3,7 @@ import type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerRes
 export declare abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {
     protected options: OAuth2TokenIssuerOptions;
     protected constructor(options?: OAuth2TokenIssuerOptions);
-    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;
+    abstract issue(input: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;
     buildIss(input?: OAuth2TokenPayload): string | undefined;
     /**
      * Build utc expire time (in seconds).

package/dist/core/oauth2/token/issuer/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE1G,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAiB7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EACR,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EAC5B,MAAM,YAAY,CAAC;AAEpB,8BAAsB,qBAAsB,YAAW,kBAAkB;IACrE,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAI5C,SAAS,aAAa,OAAO,CAAC,EAAE,wBAAwB;IAMxD,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAI7E,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM,GAAG,SAAS;IAiB7D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,GAAE,kBAAuB,GAAI,MAAM;CAYpD"}

package/dist/core/oauth2/token/issuer/base.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","base","replace","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload, options?: OAuth2TokenIssuerOptions): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        // Strip a trailing slash so a configured issuer like\n        // `https://auth.example.com/` doesn't produce a malformed\n        // `https://auth.example.com//realms/master`.\n        const base = this.options.issuer.replace(/\\/+$/, '');\n\n        if (input.realm_name) {\n            return `${base}/realms/${input.realm_name}`;\n        }\n\n        return base;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";;;;AAUA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;EACtD,KAAKA,UAAUA,WAAW,CAAC;CAC/B;CAQAC,SAASC,QAA4B,CAAC,GAAwB;EAC1D,IAAI,CAAC,KAAKF,QAAQG,QACd;EAMJ,MAAME,OAAO,KAAKL,QAAQG,OAAOG,QAAQ,QAAQ,EAAA;EAEjD,IAAIJ,MAAMK,YACN,OAAO,GAAGF,KAAK,UAAUH,MAAMK;EAGnC,OAAOF;CACX;;;;;IAOAG,SAASN,QAA4B,CAAC,GAAY;EAC9C,IAAIA,MAAMO,KACN,OAAOP,MAAMO;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAC9C,IAAI,KAAKd,QAAQe,QACb,OAAOL,MAAM,KAAKV,QAAQe;EAG9B,OAAOL,MAAM;CACjB;AACJ"}
+{"version":3,"file":"base.mjs","names":["OAuth2BaseTokenIssuer","options","buildIss","input","issuer","undefined","base","replace","realm_name","buildExp","exp","utc","Math","floor","Date","getTime","maxAge"],"sources":["../../../../../src/core/oauth2/token/issuer/base.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport type {\n    IOAuth2TokenIssuer,\n    OAuth2TokenIssuerOptions,\n    OAuth2TokenIssuerResponse,\n} from './types.ts';\n\nexport abstract class OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected options: OAuth2TokenIssuerOptions;\n\n    // ------------------------------------------------------------------\n\n    protected constructor(options?: OAuth2TokenIssuerOptions) {\n        this.options = options || {};\n    }\n\n    // ------------------------------------------------------------------\n\n    abstract issue(input: OAuth2TokenPayload): Promise<OAuth2TokenIssuerResponse>;\n\n    // ------------------------------------------------------------------\n\n    buildIss(input: OAuth2TokenPayload = {}) : string | undefined {\n        if (!this.options.issuer) {\n            return undefined;\n        }\n\n        // Strip a trailing slash so a configured issuer like\n        // `https://auth.example.com/` doesn't produce a malformed\n        // `https://auth.example.com//realms/master`.\n        const base = this.options.issuer.replace(/\\/+$/, '');\n\n        if (input.realm_name) {\n            return `${base}/realms/${input.realm_name}`;\n        }\n\n        return base;\n    }\n\n    /**\n     * Build utc expire time (in seconds).\n     *\n     * @param input\n     */\n    buildExp(input: OAuth2TokenPayload = {}) : number {\n        if (input.exp) {\n            return input.exp;\n        }\n\n        const utc = Math.floor(new Date().getTime() / 1000);\n        if (this.options.maxAge) {\n            return utc + this.options.maxAge;\n        }\n\n        return utc + 3_600;\n    }\n}\n"],"mappings":";;;;AAcA,IAAsBA,wBAAtB,MAAsBA;CACRC;CAIV,YAAsBA,SAAoC;EACtD,KAAKA,UAAUA,WAAW,CAAC;CAC/B;CAQAC,SAASC,QAA4B,CAAC,GAAwB;EAC1D,IAAI,CAAC,KAAKF,QAAQG,QACd;EAMJ,MAAME,OAAO,KAAKL,QAAQG,OAAOG,QAAQ,QAAQ,EAAA;EAEjD,IAAIJ,MAAMK,YACN,OAAO,GAAGF,KAAK,UAAUH,MAAMK;EAGnC,OAAOF;CACX;;;;;IAOAG,SAASN,QAA4B,CAAC,GAAY;EAC9C,IAAIA,MAAMO,KACN,OAAOP,MAAMO;EAGjB,MAAMC,MAAMC,KAAKC,uBAAM,IAAIC,KAAAA,EAAAA,CAAOC,QAAO,IAAK,GAAA;EAC9C,IAAI,KAAKd,QAAQe,QACb,OAAOL,MAAM,KAAKV,QAAQe;EAG9B,OAAOL,MAAM;CACjB;AACJ"}

package/dist/core/oauth2/token/issuer/refresh/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3G,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,sBAAsB,CAAC,EAAE,uBAAuB;IAS9C,KAAK,CAAC,KAAK,GAAE,kBAAuB,GAAI,OAAO,CAAC,yBAAyB,CAAC;CA4BnF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EACR,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EAC5B,MAAM,aAAa,CAAC;AAErB,qBAAa,wBAAyB,SAAQ,qBAAsB,YAAW,kBAAkB;IAC7F,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAE7C,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;IAEtC,SAAS,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAGvD,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,wBAA6B,EACtC,sBAAsB,CAAC,EAAE,uBAAuB;IAS9C,KAAK,CACP,KAAK,GAAE,kBAAuB,GAC9B,OAAO,CAAC,yBAAyB,CAAC;CAmCzC"}

package/dist/core/oauth2/token/issuer/refresh/module.mjs

@@ -27,6 +27,7 @@ var OAuth2RefreshTokenIssuer = class extends OAuth2BaseTokenIssuer {
 		if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === "number") await this.sessionTokenRepository.create({
 			id: data.jti,
 			sessionId: data.session_id,
+			clientId: data.client_id ?? null,
 			kind: "refresh",
 			parentId: input.parent_id ?? null,
 			ipAddress: data.remote_address ?? "",

package/dist/core/oauth2/token/issuer/refresh/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","parentId","parent_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type { IOAuth2TokenIssuer, OAuth2TokenIssuerOptions, OAuth2TokenIssuerResponse } from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(input: OAuth2TokenPayload = {}) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (this.sessionTokenRepository && data.session_id && data.jti && typeof data.exp === 'number') {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                kind: 'refresh',\n                parentId: input.parent_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAeA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MAAMC,QAA4B,CAAC,GAAwC;EAC7E,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IAAI,KAAKZ,0BAA0BM,KAAKS,cAAcT,KAAKU,OAAO,OAAOV,KAAKI,QAAQ,UAClF,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAChBP,MAAM;GACNY,UAAUjB,MAAMkB,aAAa;GAC7BC,WAAWhB,KAAKiB,kBAAkB;GAClCC,WAAWlB,KAAKmB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKrB,KAAKI,MAAM,GAAA,EAAA,CAAMkB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAChB,OAAON,IAAK;CACxB;AACJ"}
+{"version":3,"file":"module.mjs","names":["OAuth2TokenKind","OAuth2BaseTokenIssuer","OAuth2RefreshTokenIssuer","repository","signer","sessionTokenRepository","options","issue","input","iss","buildIss","data","insert","kind","REFRESH","exp","buildExp","token","sign","saveWithSignature","session_id","jti","create","id","sessionId","clientId","client_id","parentId","parent_id","ipAddress","remote_address","userAgent","user_agent","expiresAt","Date","toISOString"],"sources":["../../../../../../src/core/oauth2/token/issuer/refresh/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IOAuth2TokenSigner } from '../../signer/index.ts';\nimport type { IOAuth2TokenRepository } from '../../repository/index.ts';\nimport type { ISessionTokenRepository } from '../../../session-token/index.ts';\nimport { OAuth2BaseTokenIssuer } from '../base.ts';\nimport type {\n    IOAuth2TokenIssuer,\n    OAuth2TokenIssuerOptions,\n    OAuth2TokenIssuerResponse,\n} from '../types.ts';\n\nexport class OAuth2RefreshTokenIssuer extends OAuth2BaseTokenIssuer implements IOAuth2TokenIssuer {\n    protected repository: IOAuth2TokenRepository;\n\n    protected signer : IOAuth2TokenSigner;\n\n    protected sessionTokenRepository?: ISessionTokenRepository;\n\n    constructor(\n        repository: IOAuth2TokenRepository,\n        signer: IOAuth2TokenSigner,\n        options: OAuth2TokenIssuerOptions = {},\n        sessionTokenRepository?: ISessionTokenRepository,\n    ) {\n        super(options);\n\n        this.repository = repository;\n        this.signer = signer;\n        this.sessionTokenRepository = sessionTokenRepository;\n    }\n\n    async issue(\n        input: OAuth2TokenPayload = {},\n    ) : Promise<OAuth2TokenIssuerResponse> {\n        const iss = this.buildIss(input);\n\n        const data = await this.repository.insert({\n            ...input,\n            kind: OAuth2TokenKind.REFRESH,\n            exp: this.buildExp(input),\n            ...(iss ? { iss } : {}),\n        });\n\n        const token = await this.signer.sign(data);\n\n        await this.repository.saveWithSignature(data, token);\n\n        if (\n            this.sessionTokenRepository &&\n            data.session_id && data.jti &&\n            typeof data.exp === 'number'\n        ) {\n            await this.sessionTokenRepository.create({\n                id: data.jti,\n                sessionId: data.session_id,\n                // Per-application attribution (plan 086). The same client the\n                // payload was minted for, so the row needs no extra lookup.\n                clientId: data.client_id ?? null,\n                kind: 'refresh',\n                parentId: input.parent_id ?? null,\n                ipAddress: data.remote_address ?? '',\n                userAgent: data.user_agent ?? '',\n                expiresAt: new Date(data.exp * 1000).toISOString(),\n            });\n        }\n\n        return [token, data];\n    }\n}\n"],"mappings":";;;;;;AAmBA,IAAaE,2BAAb,cAA8CD,sBAAAA;CAChCE;CAEAC;CAEAC;CAEV,YACIF,YACAC,QACAE,UAAoC,CAAC,GACrCD,wBACF;EACE,MAAMC,OAAAA;EAEN,KAAKH,aAAaA;EAClB,KAAKC,SAASA;EACd,KAAKC,yBAAyBA;CAClC;CAEA,MAAME,MACFC,QAA4B,CAAC,GACM;EACnC,MAAMC,MAAM,KAAKC,SAASF,KAAAA;EAE1B,MAAMG,OAAO,MAAM,KAAKR,WAAWS,OAAO;GACtC,GAAGJ;GACHK,MAAMb,gBAAgBc;GACtBC,KAAK,KAAKC,SAASR,KAAAA;GACnB,GAAIC,MAAM,EAAEA,IAAI,IAAI,CAAC;EACzB,CAAA;EAEA,MAAMQ,QAAQ,MAAM,KAAKb,OAAOc,KAAKP,IAAAA;EAErC,MAAM,KAAKR,WAAWgB,kBAAkBR,MAAMM,KAAAA;EAE9C,IACI,KAAKZ,0BACLM,KAAKS,cAAcT,KAAKU,OACxB,OAAOV,KAAKI,QAAQ,UAEpB,MAAM,KAAKV,uBAAuBiB,OAAO;GACrCC,IAAIZ,KAAKU;GACTG,WAAWb,KAAKS;GAGhBK,UAAUd,KAAKe,aAAa;GAC5Bb,MAAM;GACNc,UAAUnB,MAAMoB,aAAa;GAC7BC,WAAWlB,KAAKmB,kBAAkB;GAClCC,WAAWpB,KAAKqB,cAAc;GAC9BC,4BAAW,IAAIC,KAAKvB,KAAKI,MAAM,GAAA,EAAA,CAAMoB,YAAW;EACpD,CAAA;EAGJ,OAAO,CAAClB,OAAON,IAAK;CACxB;AACJ"}

package/dist/core/query/index.mjs

@@ -3,5 +3,5 @@ import "node:url";
 import.meta.url;
 import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "./describe.mjs";
 import { createRelationsReadGate } from "./relations.mjs";
-import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./module.mjs";
-export { RECORD_QUERY_PARAMETERS, appendQueryConditions, createRelationsReadGate, decodeQuery, describeQuerySchema, queryCodec, schemaRegistry };
+import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry, schemas } from "./module.mjs";
+export { RECORD_QUERY_PARAMETERS, appendQueryConditions, createRelationsReadGate, decodeQuery, describeQuerySchema, queryCodec, schemaRegistry, schemas };

package/dist/core/query/module.d.ts

@@ -1,4 +1,4 @@
-import type { ICondition, IQuery, ObjectLiteral } from '@rapiq/core';
+import type { ICondition, IQuery, ObjectLiteral, Schema } from '@rapiq/core';
 import { Query, SchemaRegistry } from '@rapiq/core';
 import type { DecodeQueryOptions } from './types.ts';
 /**
@@ -17,6 +17,12 @@ import type { DecodeQueryOptions } from './types.ts';
  * never auto-derived from entity metadata.
  */
 export declare const schemaRegistry: SchemaRegistry<any>;
+/**
+ * Every registered entity schema. Exported so the invariant guard can
+ * enumerate them: `SchemaRegistry` keeps its map protected and exposes
+ * no iterator (tada5hi/rapiq#904).
+ */
+export declare const schemas: Schema<any>[];
 /**
  * URL transport codec bound to the schema registry: decodes both the
  * v2 expression dialect (stamped or detected) and legacy v1 bracket
@@ -41,20 +47,24 @@ export declare const queryCodec: import("@rapiq/codec-url").URLCodec;
 export declare function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(input: unknown, options: DecodeQueryOptions<RECORD>): Promise<Query>;
 /**
  * Append server-derived conditions (a route realm, an owner scope, ...)
- * onto a decoded query by AND-wrapping its filter tree. The wrap makes
- * the appended scope non-displaceable: unlike a filters merge (per-field
- * replace, flat-root-AND restriction), a client-sent condition on the
- * same field intersects with the scope instead of replacing it, and
- * compound client trees (`or(...)`) are preserved as-is. Same guarantee
- * class as a mandatory `andWhere` at the repository — expressed once in
- * the IR. Appended conditions do not pass through `decodeQuery`, so the
- * schema allow-lists do not constrain them (server-derived context).
+ * onto a decoded query by AND-wrapping its filter tree. A client-sent
+ * condition on the same field intersects with the scope instead of
+ * replacing it, and compound client trees (`or(...)`) are preserved
+ * as-is. Same guarantee class as a mandatory `andWhere` at the
+ * repository — expressed once in the IR. Appended conditions do not
+ * pass through `decodeQuery`, so the schema allow-lists do not
+ * constrain them (server-derived context).
  *
  * Immutable: returns a new `Query` whose filters node is the
  * AND-wrapped successor (`IFilters.and`); every other parameter node is
  * carried over **by reference**, so the input query stays untouched and
  * nothing is copied. The node enumeration mirrors rapiq's
  * `QueryContext` — keep it in sync when the IR gains a parameter.
+ *
+ * Non-displaceability is structural since rapiq beta.19
+ * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so
+ * no later composition step can drop a conjunct and the appended scope
+ * needs no marker to survive.
  */
 export declare function appendQueryConditions(query: IQuery, ...conditions: ICondition[]): Query;
 //# sourceMappingURL=module.d.ts.map

package/dist/core/query/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/query/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,aAAa,EAEhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAY,MAAM,aAAa,CAAC;AAyB9D,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,qBAAuB,CAAC;AAiCnD;;;;GAIG;AACH,eAAO,MAAM,UAAU,qCAAiC,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,EAC1E,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,GACnC,OAAO,CAAC,KAAK,CAAC,CAYjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAI,KAAK,CAQxF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/query/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,aAAa,EACb,MAAM,EACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAY,MAAM,aAAa,CAAC;AA2B9D,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,qBAAuB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAG,MAAM,CAAC,GAAG,CAAC,EA2BjC,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,UAAU,qCAAiC,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,EAC1E,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,GACnC,OAAO,CAAC,KAAK,CAAC,CAYjB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAI,KAAK,CAQxF"}

package/dist/core/query/module.mjs

@@ -8,6 +8,7 @@ import { clientScopeSchema } from "../entities/client-scope/schema.mjs";
 import { consentSchema } from "../entities/consent/schema.mjs";
 import { eventSchema } from "../entities/event/schema.mjs";
 import { identityProviderSchema } from "../entities/identity-provider/schema.mjs";
+import { identityProviderAccountSchema } from "../entities/identity-provider-account/schema.mjs";
 import { identityProviderRoleMappingSchema } from "../entities/identity-provider-role-mapping/schema.mjs";
 import { keySchema } from "../entities/key/schema.mjs";
 import { permissionSchema } from "../entities/permission/schema.mjs";
@@ -19,6 +20,7 @@ import { roleAttributeSchema } from "../entities/role-attribute/schema.mjs";
 import { rolePermissionSchema } from "../entities/role-permission/schema.mjs";
 import { scopeSchema } from "../entities/scope/schema.mjs";
 import { sessionSchema } from "../entities/session/schema.mjs";
+import { sessionTokenSchema } from "../entities/session-token/schema.mjs";
 import { trustAnchorSchema } from "../entities/trust-anchor/schema.mjs";
 import { userSchema } from "../entities/user/schema.mjs";
 import { userAttributeSchema } from "../entities/user-attribute/schema.mjs";
@@ -43,7 +45,11 @@ import { createURLCodec } from "@rapiq/codec-url";
 * precedence), but the allow-lists themselves stay explicit and are
 * never auto-derived from entity metadata.
 */ const schemaRegistry = new SchemaRegistry();
-const schemas = [
+/**
+* Every registered entity schema. Exported so the invariant guard can
+* enumerate them: `SchemaRegistry` keeps its map protected and exposes
+* no iterator (tada5hi/rapiq#904).
+*/ const schemas = [
 	clientSchema,
 	clientPermissionSchema,
 	clientRoleSchema,
@@ -51,6 +57,7 @@ const schemas = [
 	consentSchema,
 	eventSchema,
 	identityProviderSchema,
+	identityProviderAccountSchema,
 	identityProviderRoleMappingSchema,
 	keySchema,
 	permissionSchema,
@@ -62,6 +69,7 @@ const schemas = [
 	rolePermissionSchema,
 	scopeSchema,
 	sessionSchema,
+	sessionTokenSchema,
 	trustAnchorSchema,
 	userSchema,
 	userAttributeSchema,
@@ -99,20 +107,24 @@ for (const schema of schemas) schemaRegistry.add(schema);
 }
 /**
 * Append server-derived conditions (a route realm, an owner scope, ...)
-* onto a decoded query by AND-wrapping its filter tree. The wrap makes
-* the appended scope non-displaceable: unlike a filters merge (per-field
-* replace, flat-root-AND restriction), a client-sent condition on the
-* same field intersects with the scope instead of replacing it, and
-* compound client trees (`or(...)`) are preserved as-is. Same guarantee
-* class as a mandatory `andWhere` at the repository — expressed once in
-* the IR. Appended conditions do not pass through `decodeQuery`, so the
-* schema allow-lists do not constrain them (server-derived context).
+* onto a decoded query by AND-wrapping its filter tree. A client-sent
+* condition on the same field intersects with the scope instead of
+* replacing it, and compound client trees (`or(...)`) are preserved
+* as-is. Same guarantee class as a mandatory `andWhere` at the
+* repository — expressed once in the IR. Appended conditions do not
+* pass through `decodeQuery`, so the schema allow-lists do not
+* constrain them (server-derived context).
 *
 * Immutable: returns a new `Query` whose filters node is the
 * AND-wrapped successor (`IFilters.and`); every other parameter node is
 * carried over **by reference**, so the input query stays untouched and
 * nothing is copied. The node enumeration mirrors rapiq's
 * `QueryContext` — keep it in sync when the IR gains a parameter.
+*
+* Non-displaceability is structural since rapiq beta.19
+* (tada5hi/rapiq#890): filter composition is conjunctive throughout, so
+* no later composition step can drop a conjunct and the appended scope
+* needs no marker to survive.
 */ function appendQueryConditions(query, ...conditions) {
 	return new Query({
 		fields: query.fields,
@@ -123,6 +135,6 @@ for (const schema of schemas) schemaRegistry.add(schema);
 	});
 }
 //#endregion
-export { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry };
+export { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry, schemas };
 
 //# sourceMappingURL=module.mjs.map

package/dist/core/query/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition, \n    IQuery, \n    ObjectLiteral, \n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\nconst schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. The wrap makes\n * the appended scope non-displaceable: unlike a filters merge (per-field\n * replace, flat-root-AND restriction), a client-sent condition on the\n * same field intersects with the scope instead of replacing it, and\n * compound client trees (`or(...)`) are preserved as-is. Same guarantee\n * class as a mandatory `andWhere` at the repository — expressed once in\n * the IR. Appended conditions do not pass through `decodeQuery`, so the\n * schema allow-lists do not constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDA,MAAa4B,iBAAiB,IAAI1B,eAAAA;AAElC,MAAM2B,UAA0B;CAC5BzB;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAahC,eAAe4B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAajC,SAAS+B,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAIxC,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;GAmBA,SAAgByC,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI3C,MAAM;EACb4C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}
+{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderAccountSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","sessionTokenSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition,\n    IQuery,\n    ObjectLiteral,\n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderAccountSchema } from '../entities/identity-provider-account/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { sessionTokenSchema } from '../entities/session-token/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\n/**\n * Every registered entity schema. Exported so the invariant guard can\n * enumerate them: `SchemaRegistry` keeps its map protected and exposes\n * no iterator (tada5hi/rapiq#904).\n */\nexport const schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderAccountSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    sessionTokenSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. A client-sent\n * condition on the same field intersects with the scope instead of\n * replacing it, and compound client trees (`or(...)`) are preserved\n * as-is. Same guarantee class as a mandatory `andWhere` at the\n * repository — expressed once in the IR. Appended conditions do not\n * pass through `decodeQuery`, so the schema allow-lists do not\n * constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n *\n * Non-displaceability is structural since rapiq beta.19\n * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so\n * no later composition step can drop a conjunct and the appended scope\n * needs no marker to survive.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,MAAa8B,iBAAiB,IAAI5B,eAAAA;;;;;GAOlC,MAAa6B,UAA0B;CACnC3B;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAalC,eAAe8B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAanC,SAASiC,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAI1C,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;;;;;GAuBA,SAAgB2C,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI7C,MAAM;EACb8C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}