@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/core/oauth2/federated-login/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["OAuth2FederatedLoginRefusal"],"sources":["../../../../src/core/oauth2/federated-login/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    OAuth2AuthorizationCodeRequest,\n    OAuth2IdentityProvider,\n    OpenIDIdentityProvider, \n    User, \n} from '@authup/core-kit';\nimport type { OAuth2ErrorCode } from '@authup/specs';\nimport type { Logger } from '@authup/server-kit';\nimport type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';\nimport type { IOAuth2Authenticator } from '../../identity/provider/authentication/protocols/index.ts';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRequestVerifier,\n} from '../authorization/index.ts';\n\nexport type OAuth2FederatedLoginCompleteInput = {\n    /**\n     * The provider the callback belongs to, already resolved and\n     * protocol-checked by the caller.\n     */\n    provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n    /**\n     * The RP's original authorization request, as `authorize-out` stored\n     * it on the state blob. It is re-verified here rather than trusted.\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n    /**\n     * The provider's single-use authorization code.\n     */\n    code: string,\n    request?: {\n        ipAddress?: string | null,\n        userAgent?: string | null,\n    },\n};\n\n/**\n * Why a completion was refused. Every value is a REFUSAL — a decision the\n * person at the browser has to be told about on the hosted login page —\n * never a server failure, which keeps throwing.\n */\nexport enum OAuth2FederatedLoginRefusal {\n    /**\n     * The stored code request no longer verifies (client deactivated or\n     * unknown, grant allowlist, scopes, redirect_uri mismatch). The hosted\n     * page re-runs the same verifier and renders the same refusal, so\n     * nothing is echoed and the bounce carries no marker.\n     */\n    CODE_REQUEST = 'codeRequest',\n    /**\n     * The provider was disabled while the person was away at it.\n     */\n    PROVIDER_DISABLED = 'providerDisabled',\n    /**\n     * The linked local user is inactive. The local login path refuses one\n     * too, and a federated login must not be the way around that.\n     */\n    USER_INACTIVE = 'userInactive',\n    /**\n     * The client's access policy denied the identity (plan 052).\n     */\n    ACCESS_DENIED = 'accessDenied',\n}\n\nexport type OAuth2FederatedLoginRefusedResult = {\n    kind: 'refused',\n    refusal: OAuth2FederatedLoginRefusal,\n    /**\n     * The marker the hosted authorize page maps onto its own copy, when\n     * the refusal has one. Absent means \"render the request again\", which\n     * re-runs the verifier and states the reason itself.\n     */\n    error?: `${OAuth2ErrorCode}`,\n    /**\n     * The request to re-render. The verified copy when re-verification got\n     * that far, else the stored one.\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n};\n\nexport type OAuth2FederatedLoginIssuedResult = {\n    kind: 'issued',\n    /**\n     * The verified redirect target of the RP. Its scheme passed\n     * `isSafeRedirectURLScheme`, so a caller may navigate it.\n     */\n    redirectUri: string,\n    /**\n     * The authorization code id the RP redeems at `/token`.\n     */\n    code: string,\n    state?: string,\n    /**\n     * The verified request, for a caller that has to re-render the hosted\n     * page alongside the redirect (the custom-scheme interstitial).\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n    client: {\n        id: string,\n        name: string,\n        displayName: string | null,\n    },\n};\n\nexport type OAuth2FederatedLoginCompleteResult =    OAuth2FederatedLoginRefusedResult |\n    OAuth2FederatedLoginIssuedResult;\n\n/**\n * Completes the RP's original authorization request after an external\n * provider sent the browser back (issue #3446). It owns the refusal ladder\n * — realm match, code-request re-verification, redirect-scheme gate,\n * provider and user state, access policy — and mints the authup code.\n *\n * Deliberately transport-free: it decides WHAT the answer is, and returns\n * it as a discriminated result. The adapter decides how that answer\n * reaches the browser (a redirect, or the interstitial page a custom\n * scheme needs), because only the adapter knows the difference.\n */\nexport interface IOAuth2FederatedLoginService {\n    complete(input: OAuth2FederatedLoginCompleteInput) : Promise<OAuth2FederatedLoginCompleteResult>;\n}\n\nexport type OAuth2FederatedLoginServiceOptions = {\n    /**\n     * The public base URL. Reaches the provider authenticator, which\n     * builds the callback URL the external token exchange must repeat.\n     */\n    baseURL: string,\n};\n\n/**\n * Builds the authenticator that exchanges the provider's code. Injected\n * rather than constructed inline so the refusal ladder can be exercised\n * without an external provider; it defaults to the real preset/protocol\n * factory.\n */\nexport type OAuth2FederatedLoginAuthenticatorFactory = (\n    provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n    options: {\n        baseURL: string, \n        clientId?: string, \n        logger?: Logger \n    },\n) => IOAuth2Authenticator<User>;\n\nexport type OAuth2FederatedLoginServiceContext = {\n    options: OAuth2FederatedLoginServiceOptions,\n\n    accountManager: IIdentityProviderAccountManager,\n    realmRepository: IRealmRepository,\n    codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier,\n    codeIssuer: IOAuth2AuthorizationCodeIssuer,\n\n    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator,\n    eventService?: IEventService,\n    logger?: Logger,\n    authenticatorFactory?: OAuth2FederatedLoginAuthenticatorFactory,\n};\n"],"mappings":";;;;;;;;GAkDA,IAAO,8BAAKA,uBAAAA,6BAAAA;;;;;;IAMP,4BAAA,kBAAA;;;IAIA,4BAAA,uBAAA;;;;IAKA,4BAAA,mBAAA;;;IAIA,4BAAA,mBAAA;CAnBOA,OAAAA;AAqBX,EAAA,CAAA,CAAA"}
+{"version":3,"file":"types.mjs","names":["OAuth2FederatedLoginRefusal"],"sources":["../../../../src/core/oauth2/federated-login/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    OAuth2AuthorizationCodeRequest,\n    OAuth2IdentityProvider,\n    OpenIDIdentityProvider, \n    User, \n} from '@authup/core-kit';\nimport type { OAuth2ErrorCode, OAuth2TokenGrantResponse } from '@authup/specs';\nimport type { Logger } from '@authup/server-kit';\nimport type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';\nimport type { IOAuth2Authenticator } from '../../identity/provider/authentication/protocols/index.ts';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IAuthFlowMetrics } from '../../metrics/index.ts';\nimport type { IOAuth2TokenIssuer } from '../token/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';\n\nexport type OAuth2FederatedLoginCompleteInput = {\n    /**\n     * The provider the callback belongs to, already resolved and\n     * protocol-checked by the caller.\n     */\n    provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n    /**\n     * The RP's original authorization request, as `authorize-out` stored\n     * it on the state blob. It is re-verified here rather than trusted.\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n    /**\n     * The provider's single-use authorization code.\n     */\n    code: string,\n    request?: {\n        ipAddress?: string | null,\n        userAgent?: string | null,\n    },\n};\n\n/**\n * Why a completion was refused. Every value is a REFUSAL — a decision the\n * person at the browser has to be told about on the hosted login page —\n * never a server failure, which keeps throwing.\n */\nexport enum OAuth2FederatedLoginRefusal {\n    /**\n     * The stored code request no longer verifies (client deactivated or\n     * unknown, grant allowlist, scopes, redirect_uri mismatch). The hosted\n     * page re-runs the same verifier and renders the same refusal, so\n     * nothing is echoed and the bounce carries no marker.\n     */\n    CODE_REQUEST = 'codeRequest',\n    /**\n     * The provider was disabled while the person was away at it.\n     */\n    PROVIDER_DISABLED = 'providerDisabled',\n    /**\n     * The linked local user is inactive. The local login path refuses one\n     * too, and a federated login must not be the way around that.\n     */\n    USER_INACTIVE = 'userInactive',\n    /**\n     * The client's access policy denied the identity (plan 052).\n     */\n    ACCESS_DENIED = 'accessDenied',\n    /**\n     * The upstream did not meet the provider's `requiredAmr` / `requiredAcr`\n     * allow-list (issue #3477). Opt-in: a provider declaring neither cannot\n     * reach this.\n     */\n    ASSURANCE_INSUFFICIENT = 'assuranceInsufficient',\n}\n\nexport type OAuth2FederatedLoginRefusedResult = {\n    kind: 'refused',\n    refusal: OAuth2FederatedLoginRefusal,\n    /**\n     * The marker the hosted authorize page maps onto its own copy, when\n     * the refusal has one. Absent means \"render the request again\", which\n     * re-runs the verifier and states the reason itself.\n     */\n    error?: `${OAuth2ErrorCode}`,\n    /**\n     * The request to re-render. The verified copy when re-verification got\n     * that far, else the stored one.\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n};\n\nexport type OAuth2FederatedLoginIssuedResult = {\n    kind: 'issued',\n    /**\n     * Identifies the pending login the hosted authorize page completes. The\n     * caller puts it in a cookie; it is never a URL parameter. No token and no\n     * authorization code: the application's code is issued at the end of the\n     * hosted ladder, once the prompt gates and consent have run.\n     */\n    pendingLoginId: string,\n    /**\n     * The verified request, which the caller re-renders on the hosted\n     * page alongside it.\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n};\n\n/**\n * What a pending login holds. Three scalars, never the identity object (which\n * carries the provider entity incl. its EA-loaded clientSecret and the raw\n * external token payload) and never a token.\n */\nexport type OAuth2FederatedLoginPending = {\n    sessionId: string,\n    /**\n     * The provider the login was started at. The completion endpoint is\n     * provider-scoped, so a pending login cannot be completed at another.\n     */\n    providerId: string,\n    /**\n     * Actor name for the LOGIN security event.\n     */\n    userName?: string | null,\n};\n\nexport interface IOAuth2FederatedLoginStore {\n    /**\n     * @returns the id of the pending login\n     */\n    save(data: OAuth2FederatedLoginPending) : Promise<string>;\n\n    /**\n     * Reads and DROPS it. Single use: one pending login completes once.\n     */\n    consume(id: string) : Promise<OAuth2FederatedLoginPending | null>;\n}\n\nexport type OAuth2FederatedLoginCompleteHandoffInput = {\n    /**\n     * From the cookie the callback set on this browser.\n     */\n    pendingLoginId: string,\n    /**\n     * The provider the completion endpoint was addressed at.\n     */\n    providerId: string,\n};\n\nexport type OAuth2FederatedLoginCompleteResult =    OAuth2FederatedLoginRefusedResult |\n    OAuth2FederatedLoginIssuedResult;\n\n/**\n * Completes the external leg of a federated login after a provider sent\n * the browser back (issue #3446). It owns the refusal ladder: realm match,\n * code-request re-verification, redirect-scheme gate, provider and user\n * state, access policy.\n *\n * It does NOT mint the RP's authorization code. It establishes the authup\n * session and hands the browser a cookie naming it; the hosted authorize\n * page completes it and runs the same ladder a password login runs before\n * any code is issued (plan 094).\n *\n * Deliberately transport-free: it decides WHAT the answer is, and returns\n * it as a discriminated result. The adapter decides how that answer\n * reaches the browser.\n */\nexport interface IOAuth2FederatedLoginService {\n    complete(input: OAuth2FederatedLoginCompleteInput) : Promise<OAuth2FederatedLoginCompleteResult>;\n\n    /**\n     * Exchange the pending login for the grant of the session the callback\n     * established. Refuses without detail: the caller is anonymous.\n     *\n     * The local second factor is deliberately NOT gated here: an external\n     * provider authenticated this login and is where MFA is enforced for it.\n     * An application that asks for one explicitly (`acr_values`) still steps\n     * up at `POST /authorize`.\n     *\n     * @throws BadRequestError\n     */\n    completeHandoff(input: OAuth2FederatedLoginCompleteHandoffInput) : Promise<OAuth2TokenGrantResponse>;\n}\n\nexport type OAuth2FederatedLoginServiceOptions = {\n    /**\n     * The public base URL. Reaches the provider authenticator, which\n     * builds the callback URL the external token exchange must repeat.\n     */\n    baseURL: string,\n};\n\n/**\n * Builds the authenticator that exchanges the provider's code. Injected\n * rather than constructed inline so the refusal ladder can be exercised\n * without an external provider; it defaults to the real preset/protocol\n * factory.\n */\nexport type OAuth2FederatedLoginAuthenticatorFactory = (\n    provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n    options: {\n        baseURL: string, \n        clientId?: string, \n        logger?: Logger \n    },\n) => IOAuth2Authenticator<User>;\n\nexport type OAuth2FederatedLoginServiceContext = {\n    options: OAuth2FederatedLoginServiceOptions,\n\n    accountManager: IIdentityProviderAccountManager,\n    realmRepository: IRealmRepository,\n    codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier,\n\n    sessionManager: ISessionManager,\n    pendingLoginStore: IOAuth2FederatedLoginStore,\n    accessTokenIssuer: IOAuth2TokenIssuer,\n    refreshTokenIssuer: IOAuth2TokenIssuer,\n\n    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator,\n    eventService?: IEventService,\n    metrics?: IAuthFlowMetrics,\n    logger?: Logger,\n    authenticatorFactory?: OAuth2FederatedLoginAuthenticatorFactory,\n};\n"],"mappings":";;;;;;;;GAkDA,IAAO,8BAAKA,uBAAAA,6BAAAA;;;;;;IAMP,4BAAA,kBAAA;;;IAIA,4BAAA,uBAAA;;;;IAKA,4BAAA,mBAAA;;;IAIA,4BAAA,mBAAA;;;;;IAMA,4BAAA,4BAAA;CAzBOA,OAAAA;AA2BX,EAAA,CAAA,CAAA"}

package/dist/core/oauth2/grant-types/authorize.mjs

@@ -2,8 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { buildOAuth2TokenHash, deriveAmrAcr } from "../authorization/helpers.mjs";
-import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { OAuth2BaseGrant } from "./base.mjs";
 import { ScopeName } from "@authup/core-kit";
 import { JWKUse, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/grant-types/authorize.ts

package/dist/core/oauth2/grant-types/client-credentials.mjs

@@ -1,8 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { OAuth2BaseGrant } from "./base.mjs";
 import { IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
 import { OAuth2SubKind } from "@authup/specs";
 //#region src/core/oauth2/grant-types/client-credentials.ts

package/dist/core/oauth2/grant-types/identity.mjs

@@ -2,8 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { deriveAmrAcr } from "../authorization/helpers.mjs";
-import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { OAuth2BaseGrant } from "./base.mjs";
 import { ScopeName, SessionAuthMethod } from "@authup/core-kit";
 //#region src/core/oauth2/grant-types/identity.ts
 var IdentityGrantType = class extends OAuth2BaseGrant {

package/dist/core/oauth2/grant-types/password.mjs

@@ -2,8 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { deriveAmrAcr } from "../authorization/helpers.mjs";
-import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { OAuth2BaseGrant } from "./base.mjs";
 import { EventName, EventRefType, EventScope, IdentityType, ScopeName, SessionAuthMethod } from "@authup/core-kit";
 import { OAuth2SubKind, OAuth2TokenGrant } from "@authup/specs";
 //#region src/core/oauth2/grant-types/password.ts

package/dist/core/oauth2/grant-types/refresh-token.mjs

@@ -1,8 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { OAuth2BaseGrant } from "./base.mjs";
 import { buildOAuth2BearerTokenResponse } from "../response/bearer.mjs";
+import { OAuth2BaseGrant } from "./base.mjs";
 import { isSessionTokenRelationMissingError } from "../session-token/error.mjs";
 import "../session-token/index.mjs";
 import { EventName, EventRefType, EventScope } from "@authup/core-kit";

package/dist/core/oauth2/index.d.ts

@@ -1,9 +1,13 @@
 export * from './access-policy/index.ts';
 export * from './authorization/index.ts';
+export * from './backchannel-logout/index.ts';
 export * from './client/index.ts';
+export * from './console-login/index.ts';
+export * from './session-credential/index.ts';
 export * from './end-session/index.ts';
 export * from './federated-login/index.ts';
 export * from './grant-types/index.ts';
+export * from './introspection/index.ts';
 export * from './mfa-login/index.ts';
 export * from './openid/index.ts';
 export * from './response/index.ts';

package/dist/core/oauth2/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/core/oauth2/index.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { OAuth2AccessPolicyEvaluator } from "./access-policy/module.mjs";
 import "./access-policy/index.mjs";
 import { OAuth2AuthorizationCodeIssuer } from "./authorization/code/issuer/module.mjs";
-import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
+import { base64URLEncode, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, deriveAmrAcr, generateOAuth2CodeVerifier } from "./authorization/helpers.mjs";
 import { OAuth2AuthorizationCodeVerifier } from "./authorization/code/verifier/module.mjs";
 import { OAuth2ClientAuthenticator } from "./client/authenticator.mjs";
 import { assertClientGrantAllowed } from "./client/grant-type.mjs";
@@ -14,24 +14,35 @@ import { OAuth2AuthorizationCodeRequestValidator } from "./authorization/code-re
 import { OAuth2AuthorizationStateManager } from "./authorization/state/module.mjs";
 import { OAuth2Authorization } from "./authorization/module.mjs";
 import "./authorization/index.mjs";
+import { OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT } from "./backchannel-logout/constants.mjs";
+import { OAuth2BackchannelLogoutNotifier } from "./backchannel-logout/module.mjs";
+import "./backchannel-logout/index.mjs";
+import { CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL } from "./console-login/constants.mjs";
+import { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH } from "./session-credential/constants.mjs";
+import { createSessionSecret, hashSessionSecret } from "./session-credential/module.mjs";
+import "./session-credential/index.mjs";
 import { OAuth2EndSessionService } from "./end-session/service.mjs";
 import { OAuth2EndSessionRequestValidator } from "./end-session/validator.mjs";
 import "./end-session/index.mjs";
+import { OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL } from "./federated-login/constants.mjs";
+import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
 import { OAuth2FederatedLoginRefusal } from "./federated-login/types.mjs";
 import { OAuth2FederatedLoginService } from "./federated-login/module.mjs";
 import "./federated-login/index.mjs";
-import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
 import { IdentityGrantType } from "./grant-types/identity.mjs";
 import { PasswordGrantType } from "./grant-types/password.mjs";
+import { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE } from "./session-token/constants.mjs";
 import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./session-token/error.mjs";
 import "./session-token/index.mjs";
 import { OAuth2RefreshTokenGrant } from "./grant-types/refresh-token.mjs";
 import "./grant-types/index.mjs";
+import { OAuth2OpenIDClaimsBuilder } from "./openid/claims.mjs";
+import { resolveIntrospectionSubject } from "./introspection/module.mjs";
+import "./introspection/index.mjs";
 import { OAuth2MfaLoginService } from "./mfa-login/module.mjs";
 import "./mfa-login/index.mjs";
-import { OAuth2OpenIDClaimsBuilder } from "./openid/claims.mjs";
 import "./openid/index.mjs";
 import { OAuth2ScopeAttributesResolver } from "./scope/resolver.mjs";
 import "./scope/index.mjs";
@@ -43,4 +54,4 @@ import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
 import "./token/index.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier, isSessionTokenRelationMissingError };
+export { CONSOLE_LOGIN_COOKIE, CONSOLE_LOGIN_TTL, ClientCredentialsGrant, IdentityGrantType, OAUTH2_BACKCHANNEL_LOGOUT_EVENT, OAUTH2_BACKCHANNEL_LOGOUT_MAX_AGE, OAUTH2_BACKCHANNEL_LOGOUT_TIMEOUT, OAUTH2_FEDERATED_LOGIN_COOKIE, OAUTH2_FEDERATED_LOGIN_TTL, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2BackchannelLogoutNotifier, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH, SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, createOAuth2PKCE, createSessionSecret, deriveAmrAcr, generateOAuth2CodeVerifier, hashSessionSecret, isSessionTokenRelationMissingError, resolveIntrospectionSubject };

package/dist/core/oauth2/introspection/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/introspection/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/introspection/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/introspection/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { resolveIntrospectionSubject } from "./module.mjs";
+export { resolveIntrospectionSubject };

package/dist/core/oauth2/introspection/module.d.ts

@@ -0,0 +1,14 @@
+import type { OAuth2IntrospectionSubject, OAuth2IntrospectionSubjectContext, OAuth2IntrospectionSubjectInput } from './types.ts';
+/**
+ * The subject half of an introspection answer: resolve the identity, build its
+ * OpenID claims and, only for an active credential, project its permissions.
+ *
+ * One owner for that projection, so a second consumer (the console session
+ * endpoint, plan 088) cannot drift from `POST /token/introspect`. The token
+ * half (verification, the `active` derivation, the RFC 7662 reporting rules)
+ * stays in the controller, which also owns the response spread order.
+ *
+ * @throws OAuth2RequestError when the subject no longer resolves.
+ */
+export declare function resolveIntrospectionSubject(ctx: OAuth2IntrospectionSubjectContext, input: OAuth2IntrospectionSubjectInput): Promise<OAuth2IntrospectionSubject>;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/introspection/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/introspection/module.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACR,0BAA0B,EAC1B,iCAAiC,EACjC,+BAA+B,EAClC,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC7C,GAAG,EAAE,iCAAiC,EACtC,KAAK,EAAE,+BAA+B,GACtC,OAAO,CAAC,0BAA0B,CAAC,CA2CtC"}

package/dist/core/oauth2/introspection/module.mjs

@@ -0,0 +1,49 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { OAuth2OpenIDClaimsBuilder } from "../openid/claims.mjs";
+import { buildPermissionKey } from "@authup/access";
+import { OAuth2RequestError } from "@authup/specs";
+//#region src/core/oauth2/introspection/module.ts
+/**
+* The subject half of an introspection answer: resolve the identity, build its
+* OpenID claims and, only for an active credential, project its permissions.
+*
+* One owner for that projection, so a second consumer (the console session
+* endpoint, plan 088) cannot drift from `POST /token/introspect`. The token
+* half (verification, the `active` derivation, the RFC 7662 reporting rules)
+* stays in the controller, which also owns the response spread order.
+*
+* @throws OAuth2RequestError when the subject no longer resolves.
+*/ async function resolveIntrospectionSubject(ctx, input) {
+	const identity = await ctx.identityResolver.resolve(input.subKind, input.sub);
+	if (!identity) throw OAuth2RequestError.identityInvalid();
+	const claims = new OAuth2OpenIDClaimsBuilder().fromIdentity(identity);
+	if (!input.active) return {
+		identity,
+		claims
+	};
+	const permissions = await ctx.identityPermissionProvider.getFor({
+		id: input.sub,
+		type: input.subKind,
+		clientId: input.clientId,
+		realmId: input.realmId
+	});
+	return {
+		identity,
+		claims,
+		permissions: Object.values(permissions.reduce((acc, binding) => {
+			const key = buildPermissionKey(binding.permission);
+			if (!acc[key]) acc[key] = {
+				name: binding.permission.name,
+				client_id: binding.permission.clientId,
+				realm_id: binding.permission.realmId
+			};
+			return acc;
+		}, {}))
+	};
+}
+//#endregion
+export { resolveIntrospectionSubject };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/introspection/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["buildPermissionKey","OAuth2RequestError","OAuth2OpenIDClaimsBuilder","resolveIntrospectionSubject","ctx","input","identity","identityResolver","resolve","subKind","sub","identityInvalid","claimsBuilder","claims","fromIdentity","active","permissions","identityPermissionProvider","getFor","id","type","clientId","realmId","Object","values","reduce","acc","binding","key","permission","name","client_id","realm_id"],"sources":["../../../../src/core/oauth2/introspection/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { buildPermissionKey } from '@authup/access';\nimport type { OAuth2TokenPermission } from '@authup/specs';\nimport { OAuth2RequestError } from '@authup/specs';\nimport { OAuth2OpenIDClaimsBuilder } from '../openid/claims.ts';\nimport type {\n    OAuth2IntrospectionSubject,\n    OAuth2IntrospectionSubjectContext,\n    OAuth2IntrospectionSubjectInput,\n} from './types.ts';\n\n/**\n * The subject half of an introspection answer: resolve the identity, build its\n * OpenID claims and, only for an active credential, project its permissions.\n *\n * One owner for that projection, so a second consumer (the console session\n * endpoint, plan 088) cannot drift from `POST /token/introspect`. The token\n * half (verification, the `active` derivation, the RFC 7662 reporting rules)\n * stays in the controller, which also owns the response spread order.\n *\n * @throws OAuth2RequestError when the subject no longer resolves.\n */\nexport async function resolveIntrospectionSubject(\n    ctx: OAuth2IntrospectionSubjectContext,\n    input: OAuth2IntrospectionSubjectInput,\n) : Promise<OAuth2IntrospectionSubject> {\n    const identity = await ctx.identityResolver.resolve(input.subKind, input.sub);\n    if (!identity) {\n        // todo: differentiate between client & user\n        throw OAuth2RequestError.identityInvalid();\n    }\n\n    const claimsBuilder = new OAuth2OpenIDClaimsBuilder();\n    const claims = claimsBuilder.fromIdentity(identity);\n\n    if (!input.active) {\n        return {\n            identity,\n            claims,\n        };\n    }\n\n    // todo: only receive client specific permissions\n    const permissions = await ctx.identityPermissionProvider.getFor({\n        id: input.sub,\n        type: input.subKind,\n        clientId: input.clientId,\n        realmId: input.realmId,\n    });\n\n    return {\n        identity,\n        claims,\n        // todo: permissions property should be removed.\n        permissions: Object.values(\n            permissions.reduce((acc, binding) => {\n                const key = buildPermissionKey(binding.permission);\n                if (!acc[key]) {\n                    acc[key] = {\n                        name: binding.permission.name,\n                        client_id: binding.permission.clientId,\n                        realm_id: binding.permission.realmId,\n                    } as OAuth2TokenPermission;\n                }\n                return acc;\n            }, {} as Record<string, OAuth2TokenPermission>),\n        ),\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;GA4BA,eAAsBG,4BAClBC,KACAC,OAAsC;CAEtC,MAAMC,WAAW,MAAMF,IAAIG,iBAAiBC,QAAQH,MAAMI,SAASJ,MAAMK,GAAG;CAC5E,IAAI,CAACJ,UAED,MAAML,mBAAmBU,gBAAe;CAI5C,MAAME,SAASD,IADWV,0BACXU,CAAAA,CAAcE,aAAaR,QAAAA;CAE1C,IAAI,CAACD,MAAMU,QACP,OAAO;EACHT;EACAO;CACJ;CAIJ,MAAMG,cAAc,MAAMZ,IAAIa,2BAA2BC,OAAO;EAC5DC,IAAId,MAAMK;EACVU,MAAMf,MAAMI;EACZY,UAAUhB,MAAMgB;EAChBC,SAASjB,MAAMiB;CACnB,CAAA;CAEA,OAAO;EACHhB;EACAO;EAEAG,aAAaO,OAAOC,OAChBR,YAAYS,QAAQC,KAAKC,YAAAA;GACrB,MAAMC,MAAM5B,mBAAmB2B,QAAQE,UAAU;GACjD,IAAI,CAACH,IAAIE,MACLF,IAAIE,OAAO;IACPE,MAAMH,QAAQE,WAAWC;IACzBC,WAAWJ,QAAQE,WAAWR;IAC9BW,UAAUL,QAAQE,WAAWP;GACjC;GAEJ,OAAOI;EACX,GAAG,CAAC,CAAA,CAAA;CAEZ;AACJ"}

package/dist/core/oauth2/introspection/types.d.ts

@@ -0,0 +1,45 @@
+import type { Identity, IdentityType } from '@authup/core-kit';
+import type { OAuth2TokenPermission, OpenIDTokenPayload } from '@authup/specs';
+import type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';
+import type { IIdentityResolver } from '../../identity/resolver/types.ts';
+export type OAuth2IntrospectionSubjectContext = {
+    identityResolver: IIdentityResolver;
+    identityPermissionProvider: IIdentityPermissionProvider;
+};
+export type OAuth2IntrospectionSubjectInput = {
+    /**
+     * Subject id.
+     */
+    sub: string;
+    /**
+     * Subject kind (user, client).
+     */
+    subKind: `${IdentityType}`;
+    /**
+     * The client the projection is scoped to. For a token this is the
+     * payload's `client_id`; for the console session endpoint it is the
+     * console's own client id, never `RequestIdentity.clientId` (which for a
+     * user identity is the user row's own unrelated column).
+     */
+    clientId?: string | null;
+    /**
+     * The realm the projection is scoped to.
+     */
+    realmId?: string | null;
+    /**
+     * Whether the credential the projection describes is usable. Permissions
+     * are resolved ONLY when it is: an inactive credential reports who it
+     * belonged to and nothing about what they may do, and a dead credential
+     * must not pay for a permission read.
+     */
+    active: boolean;
+};
+export type OAuth2IntrospectionSubject = {
+    identity: Identity;
+    claims: OpenIDTokenPayload;
+    /**
+     * Present only for an `active` input.
+     */
+    permissions?: OAuth2TokenPermission[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/introspection/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/introspection/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,MAAM,MAAM,iCAAiC,GAAG;IAC5C,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC1C;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,MAAM,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;OAEG;IACH,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAC;CACzC,CAAC"}

package/dist/core/oauth2/introspection/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/oauth2/openid/claims.d.ts

@@ -1,10 +1,18 @@
 import type { Client, Identity, User } from '@authup/core-kit';
-import type { OpenIDTokenPayload } from '@authup/specs';
+import type { OpenIDClaims, OpenIDTokenPayload } from '@authup/specs';
 import type { ObjectLiteral } from 'validup';
 type AttributeMapTuple<T> = {
     [K in keyof T]: [K, (value: unknown) => any];
 }[keyof T];
-type AttributeMap<T extends Record<string, any>> = Record<keyof OpenIDTokenPayload, keyof T | AttributeMapTuple<T>>;
+/**
+ * Keyed on `OpenIDClaims`, never on `OpenIDTokenPayload`: the latter inherits
+ * `JWTClaims`' `[key: string]: any`, so `keyof` collapses to `string | number`
+ * and the map accepts any claim name at all — a typo compiles and the claim is
+ * simply never emitted, which is the failure mode #3518 is about. `OpenIDClaims`
+ * carries no index signature, so a name that is not a claim fails the build.
+ * `Partial`, because a map declares only the claims its entity can supply.
+ */
+type AttributeMap<T extends Record<string, any>> = Partial<Record<keyof OpenIDClaims, keyof T | AttributeMapTuple<T>>>;
 export declare class OAuth2OpenIDClaimsBuilder {
     protected clientMap: AttributeMap<Client>;
     protected userMap: AttributeMap<User>;
@@ -16,6 +24,16 @@ export declare class OAuth2OpenIDClaimsBuilder {
     fromIdentity(identity: Identity): OpenIDTokenPayload;
     fromClient(input: Client): OpenIDTokenPayload;
     fromUser(input: User): OpenIDTokenPayload;
+    /**
+     * A claim is emitted only for a value that exists AND is not nullish.
+     *
+     * The map reads entity columns, several of which are nullable, and OIDC
+     * models an unavailable claim as one that is not returned rather than one
+     * returned as `null` — so a user without a display name must omit
+     * `nickname`, not answer `nickname: null` (#3518). Emitting the null also
+     * put a JSON `null` claim value into every id_token, which no relying
+     * party expects.
+     */
     protected extract<T extends ObjectLiteral = ObjectLiteral>(attributeMap: AttributeMap<T>, attributes: T): OpenIDTokenPayload;
 }
 export {};

package/dist/core/oauth2/openid/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/openid/claims.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,MAAM,EACN,QAAQ,EACR,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,GAAG,CAAC;CAC/C,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CACrD,MAAM,kBAAkB,EAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAC7B,CAAC;AAEF,qBAAa,yBAAyB;IAClC,SAAS,CAAC,SAAS,EAAG,YAAY,CAAC,MAAM,CAAC,CAcxC;IAEF,SAAS,CAAC,OAAO,EAAG,YAAY,CAAC,IAAI,CAAC,CAmBpC;IAEF;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAI,kBAAkB;IAQrD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,kBAAkB;IAI9C,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAI,kBAAkB;IAI1C,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EACrD,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,EAC7B,UAAU,EAAE,CAAC,GACb,kBAAkB;CAqBzB"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/openid/claims.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,MAAM,EACN,QAAQ,EACR,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,iBAAiB,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,GAAG,CAAC;CAC/C,CAAC,MAAM,CAAC,CAAC,CAAC;AAEX;;;;;;;GAOG;AACH,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAC7D,MAAM,YAAY,EACtB,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAC7B,CAAC,CAAC;AAEH,qBAAa,yBAAyB;IAClC,SAAS,CAAC,SAAS,EAAG,YAAY,CAAC,MAAM,CAAC,CAcxC;IAEF,SAAS,CAAC,OAAO,EAAG,YAAY,CAAC,IAAI,CAAC,CAmBpC;IAEF;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAI,kBAAkB;IAQrD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAI,kBAAkB;IAI9C,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAI,kBAAkB;IAI1C;;;;;;;;;OASG;IACH,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,EACrD,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,EAC7B,UAAU,EAAE,CAAC,GACb,kBAAkB;CAuCzB"}

package/dist/core/oauth2/openid/claims.mjs

@@ -25,7 +25,7 @@ var OAuth2OpenIDClaimsBuilder = class {
 			return value;
 		}],
 		email: "email",
-		email_verified: "active"
+		email_verified: "emailVerified"
 	};
 	/**
 	* Build OpenID Claims form Oauth2 Identity.
@@ -41,17 +41,31 @@ var OAuth2OpenIDClaimsBuilder = class {
 	fromUser(input) {
 		return this.extract(this.userMap, input);
 	}
-	extract(attributeMap, attributes) {
+	/**
+	* A claim is emitted only for a value that exists AND is not nullish.
+	*
+	* The map reads entity columns, several of which are nullable, and OIDC
+	* models an unavailable claim as one that is not returned rather than one
+	* returned as `null` — so a user without a display name must omit
+	* `nickname`, not answer `nickname: null` (#3518). Emitting the null also
+	* put a JSON `null` claim value into every id_token, which no relying
+	* party expects.
+	*/ extract(attributeMap, attributes) {
 		const result = {};
 		const keys = Object.keys(attributeMap);
 		for (const key_ of keys) {
 			const attribute = attributeMap[key_];
+			let value;
 			if (typeof attribute === "string") {
-				if (hasOwnProperty(attributes, attribute)) result[key_] = attributes[attribute];
+				if (!hasOwnProperty(attributes, attribute)) continue;
+				value = attributes[attribute];
 			} else {
 				const [key, transformer] = attribute;
-				if (hasOwnProperty(attributes, key)) result[key_] = transformer(attributes[key]);
+				if (!hasOwnProperty(attributes, key)) continue;
+				value = transformer(attributes[key]);
 			}
+			if (typeof value === "undefined" || value === null) continue;
+			result[key_] = value;
 		}
 		return result;
 	}

package/dist/core/oauth2/openid/claims.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'lastName',\n        given_name: 'firstName',\n        nickname: 'displayName',\n        preferred_username: 'displayName',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AA0BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;CACL;CAEUK,UAA+B;EACrCT,MAAM;EACNU,aAAa;EACbC,YAAY;EACZV,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;EAEDQ,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASnB,cAAcoB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,OAAO,KAAKC,SAASL,SAASI,IAAI;CACtC;CAEAD,WAAWG,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAKvB,WAAWsB,KAAAA;CACxC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKb,SAASY,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc,UACjBjC;QAAAA,eAAe4B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIjC,eAAe4B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDClaims, OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\n/**\n * Keyed on `OpenIDClaims`, never on `OpenIDTokenPayload`: the latter inherits\n * `JWTClaims`' `[key: string]: any`, so `keyof` collapses to `string | number`\n * and the map accepts any claim name at all — a typo compiles and the claim is\n * simply never emitted, which is the failure mode #3518 is about. `OpenIDClaims`\n * carries no index signature, so a name that is not a claim fails the build.\n * `Partial`, because a map declares only the claims its entity can supply.\n */\ntype AttributeMap<T extends Record<string, any>> = Partial<Record<\n    keyof OpenIDClaims,\nkeyof T | AttributeMapTuple<T>\n>>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'lastName',\n        given_name: 'firstName',\n        nickname: 'displayName',\n        preferred_username: 'displayName',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'emailVerified',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    /**\n     * A claim is emitted only for a value that exists AND is not nullish.\n     *\n     * The map reads entity columns, several of which are nullable, and OIDC\n     * models an unavailable claim as one that is not returned rather than one\n     * returned as `null` — so a user without a display name must omit\n     * `nickname`, not answer `nickname: null` (#3518). Emitting the null also\n     * put a JSON `null` claim value into every id_token, which no relying\n     * party expects.\n     */\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap) as (keyof OpenIDClaims)[];\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n\n            let value : unknown;\n            if (typeof attribute === 'string') {\n                if (!hasOwnProperty(attributes, attribute)) {\n                    continue;\n                }\n\n                value = attributes[attribute];\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (!hasOwnProperty(attributes, key)) {\n                    continue;\n                }\n\n                value = transformer(attributes[key]);\n            }\n\n            if (\n                typeof value === 'undefined' ||\n                value === null\n            ) {\n                continue;\n            }\n\n            // Cast on the VALUE side only: which claim is written is checked by\n            // `AttributeMap`'s key type, while the value comes out of an entity\n            // column through an untyped transformer and never had a type here.\n            (result as Record<string, unknown>)[key_] = value;\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AAkCA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;CACL;CAEUK,UAA+B;EACrCT,MAAM;EACNU,aAAa;EACbC,YAAY;EACZV,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;EAEDQ,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASnB,cAAcoB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,OAAO,KAAKC,SAASL,SAASI,IAAI;CACtC;CAEAD,WAAWG,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAKvB,WAAWsB,KAAAA;CACxC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKb,SAASY,KAAAA;CACtC;;;;;;;;;;IAYA,QACIE,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAE/B,IAAIxB;GACJ,IAAI,OAAOyB,cAAc,UAAU;IAC/B,IAAI,CAACjC,eAAe4B,YAAYK,SAAAA,GAC5B;IAGJzB,QAAQoB,WAAWK;GACvB,OAAO;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAI,CAACjC,eAAe4B,YAAYM,GAAAA,GAC5B;IAGJ1B,QAAQ2B,YAAYP,WAAWM,IAAI;GACvC;GAEA,IACI,OAAO1B,UAAU,eACjBA,UAAU,MAEV;GAMHqB,OAAmCG,QAAQxB;EAChD;EAEA,OAAOqB;CACX;AACJ"}

package/dist/core/oauth2/session-credential/constants.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The cookie carrying the opaque session credential: the `secret` half of an
+ * `auth_sessions` row, never its id (the id is published as `sid` in every
+ * id_token and `/sessions` row, so it is an identifier and not a credential).
+ *
+ * `HttpOnly`, `Secure` under an https publicUrl, and `SameSite=Strict`: it is
+ * an ambient credential for the whole API, so it must never ride a cross-site
+ * request. See plan 088 for the full gate (`Strict` + `Origin` + a mandatory
+ * `Sec-Fetch-Site: same-origin`).
+ */
+export declare const SESSION_COOKIE = "authup_session";
+/**
+ * Length of the opaque session credential, in nanoid characters. 48 chars of
+ * the default 36-symbol alphabet is ~248 bits. The credential is presented on
+ * every request and never rotated within a session, so it is sized well past
+ * the point where guessing is the weakest link.
+ */
+export declare const SESSION_SECRET_LENGTH = 48;
+/**
+ * How often a cookie-authenticated request slides the session's expiry.
+ *
+ * A bearer-mode session is kept alive by the refresh grant, which cookie mode
+ * removes: `ping()` moves only `seenAt`, so an active console user would be
+ * signed out mid-task once the session reached its ~3-day lifetime. The cookie
+ * branch therefore calls `refresh()` instead, throttled to one write per
+ * window so a page load's burst of API calls does not rewrite the row a dozen
+ * times. It costs nothing extra: `ping()` was already saving the row.
+ */
+export declare const SESSION_REFRESH_THROTTLE: number;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/session-credential/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-credential/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,QAAY,CAAC"}

package/dist/core/oauth2/session-credential/constants.mjs

@@ -0,0 +1,34 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/session-credential/constants.ts
+/**
+* The cookie carrying the opaque session credential: the `secret` half of an
+* `auth_sessions` row, never its id (the id is published as `sid` in every
+* id_token and `/sessions` row, so it is an identifier and not a credential).
+*
+* `HttpOnly`, `Secure` under an https publicUrl, and `SameSite=Strict`: it is
+* an ambient credential for the whole API, so it must never ride a cross-site
+* request. See plan 088 for the full gate (`Strict` + `Origin` + a mandatory
+* `Sec-Fetch-Site: same-origin`).
+*/ const SESSION_COOKIE = "authup_session";
+/**
+* Length of the opaque session credential, in nanoid characters. 48 chars of
+* the default 36-symbol alphabet is ~248 bits. The credential is presented on
+* every request and never rotated within a session, so it is sized well past
+* the point where guessing is the weakest link.
+*/ const SESSION_SECRET_LENGTH = 48;
+/**
+* How often a cookie-authenticated request slides the session's expiry.
+*
+* A bearer-mode session is kept alive by the refresh grant, which cookie mode
+* removes: `ping()` moves only `seenAt`, so an active console user would be
+* signed out mid-task once the session reached its ~3-day lifetime. The cookie
+* branch therefore calls `refresh()` instead, throttled to one write per
+* window so a page load's burst of API calls does not rewrite the row a dozen
+* times. It costs nothing extra: `ping()` was already saving the row.
+*/ const SESSION_REFRESH_THROTTLE = 6e4;
+//#endregion
+export { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/session-credential/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["SESSION_COOKIE","SESSION_SECRET_LENGTH","SESSION_REFRESH_THROTTLE"],"sources":["../../../../src/core/oauth2/session-credential/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The cookie carrying the opaque session credential: the `secret` half of an\n * `auth_sessions` row, never its id (the id is published as `sid` in every\n * id_token and `/sessions` row, so it is an identifier and not a credential).\n *\n * `HttpOnly`, `Secure` under an https publicUrl, and `SameSite=Strict`: it is\n * an ambient credential for the whole API, so it must never ride a cross-site\n * request. See plan 088 for the full gate (`Strict` + `Origin` + a mandatory\n * `Sec-Fetch-Site: same-origin`).\n */\nexport const SESSION_COOKIE = 'authup_session';\n\n/**\n * Length of the opaque session credential, in nanoid characters. 48 chars of\n * the default 36-symbol alphabet is ~248 bits. The credential is presented on\n * every request and never rotated within a session, so it is sized well past\n * the point where guessing is the weakest link.\n */\nexport const SESSION_SECRET_LENGTH = 48;\n\n/**\n * How often a cookie-authenticated request slides the session's expiry.\n *\n * A bearer-mode session is kept alive by the refresh grant, which cookie mode\n * removes: `ping()` moves only `seenAt`, so an active console user would be\n * signed out mid-task once the session reached its ~3-day lifetime. The cookie\n * branch therefore calls `refresh()` instead, throttled to one write per\n * window so a page load's burst of API calls does not rewrite the row a dozen\n * times. It costs nothing extra: `ping()` was already saving the row.\n */\nexport const SESSION_REFRESH_THROTTLE = 1000 * 60;\n"],"mappings":";;;;;;;;;;;;;GAiBA,MAAaA,iBAAiB;;;;;;GAQ9B,MAAaC,wBAAwB;;;;;;;;;;GAYrC,MAAaC,2BAA2B"}

package/dist/core/oauth2/session-credential/index.d.ts

@@ -0,0 +1,3 @@
+export * from './constants.ts';
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/session-credential/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-credential/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/session-credential/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH } from "./constants.mjs";
+import { createSessionSecret, hashSessionSecret } from "./module.mjs";
+export { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH, createSessionSecret, hashSessionSecret };

package/dist/core/oauth2/session-credential/module.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Mint the opaque credential a console browser presents (plan 088). It is
+ * written to `auth_sessions.secret` (a `select: false` column resolved only by
+ * `ISessionRepository.findOneBySecret`) and handed to the browser in the
+ * console session cookie.
+ */
+export declare function createSessionSecret(): string;
+/**
+ * The value actually stored in `auth_sessions.secret`.
+ *
+ * `select: false` limits what the ORM projects; it does nothing about what the
+ * database CONTAINS, so storing the credential verbatim would make any read of
+ * that table — a leaked backup, a read replica, a SQL injection that only
+ * SELECTs — a source of replayable `authup_session` cookies. The
+ * column holds a digest instead, and the cookie value never lands anywhere it
+ * can be read back.
+ *
+ * A plain SHA-256 rather than a keyed HMAC, deliberately. Keying defends a
+ * LOW-entropy input against offline guessing, which is why a password needs
+ * bcrypt; this input is 48 nanoid characters over a 36-symbol alphabet (~248
+ * bits), so there is no guessing attack for a key to frustrate. A keyed scheme
+ * would also have to be GLOBAL — the lookup resolves a session BY this value,
+ * so the realm is unknown at that point and a per-realm key is unavailable —
+ * and the only global key (`SECRETS_ENCRYPTION_KEY`) is optional, so keying
+ * would either be absent by default or need key management of its own.
+ *
+ * Deterministic, so the lookup stays a single indexed equality. Hex SHA-256 is
+ * exactly 64 characters, which is the column's width.
+ */
+export declare function hashSessionSecret(secret: string): string;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/session-credential/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-credential/module.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAK,MAAM,CAE7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,CAEzD"}