.cursorrules
.dockerignore
.gitignore
.gitleaks-baseline.json
AGENTS.md
AI-ADVOCATE.md
ARCHITECTURE.md
CHANGELOG.md
CLAUDE.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
Dockerfile
Dockerfile.authentik-capauth
LICENSE
MANIFEST.in
MISSION.md
README.md
SECURITY.md
SKILL.md
SOP.md
index.d.ts
index.js
integrations
package.json
pyproject.toml
ruff-0.15.4-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
skill.yaml
urllib.error
.github/workflows/ci.yml
.github/workflows/docs-check.yml
.github/workflows/nextcloud-appstore.yml
.github/workflows/publish.yml
.github/workflows/pytest.yml
.github/workflows/secret-scan.yml
authentik-custom/capauth_migrate.py
authentik-custom/imghdr.py
authentik-custom/user_settings.py
bin/cli.js
browser-extension/.gitignore
browser-extension/README.md
browser-extension/RELEASING.md
browser-extension/background.js
browser-extension/manifest.firefox.json
browser-extension/manifest.json
browser-extension/package-lock.json
browser-extension/package.json
browser-extension/vitest.config.js
browser-extension/content_scripts/autofill.js
browser-extension/content_scripts/cross_origin_signing.js
browser-extension/content_scripts/detector.js
browser-extension/content_scripts/provider.js
browser-extension/content_scripts/provider_bridge.js
browser-extension/icons/icon.svg
browser-extension/icons/icon128.png
browser-extension/icons/icon16.png
browser-extension/icons/icon48.png
browser-extension/lib/bunker-e2e.js
browser-extension/lib/keyqr.js
browser-extension/lib/keyvault.js
browser-extension/lib/openpgp.js
browser-extension/lib/signer-backends.js
browser-extension/native-host/capauth_signer.py
browser-extension/native-host/com.capauth.signer.json
browser-extension/native-host/install.sh
browser-extension/options/options.html
browser-extension/options/options.js
browser-extension/popup/popup.css
browser-extension/popup/popup.html
browser-extension/popup/popup.js
browser-extension/scripts/build.js
browser-extension/scripts/generate-icons.js
browser-extension/stages/AuthenticatorSelectionStage.js
browser-extension/stages/CapAuthStage.js
browser-extension/stages/QRDisplayStage.js
browser-extension/stages/SignatureVerificationStage.js
browser-extension/stages/StagePipeline.js
browser-extension/submission/STORE_LISTING.md
browser-extension/submission/privacy-policy.md
browser-extension/tests/fixtures/test_key.json
browser-extension/tests/unit/background.test.js
browser-extension/tests/unit/bunker_e2e.test.js
browser-extension/tests/unit/detector.test.js
browser-extension/tests/unit/keyqr.test.js
browser-extension/tests/unit/keyvault.test.js
browser-extension/tests/unit/openpgp.test.js
browser-extension/tests/unit/provider_api.test.js
browser-extension/tests/unit/provider_tierb.test.js
browser-extension/tests/unit/remote_bunker.test.js
browser-extension/tests/unit/signer_backends.test.js
deploy/capauth-service/.env.example
deploy/capauth-service/deploy.sh
deploy/capauth-service/docker-compose.yml
deploy/capauth-service/systemd/capauth-backup.service
deploy/capauth-service/systemd/capauth-backup.timer
deploy/forgejo-capauth/.env.example
deploy/forgejo-capauth/docker-compose.yml
deploy/forgejo-capauth/preflight.sh
docs/AIRGAPPED_SIGNING_WORKSTATION.md
docs/ARCHITECTURE.md
docs/AUTHENTIK_CUSTOM_STAGE.md
docs/AUTHENTIK_DEPLOYMENT_SKSSO.md
docs/AUTHENTIK_FORGEJO_DEPLOYMENT.md
docs/AUTHENTIK_STRATEGY_DECISION.md
docs/CAPAUTH_BUNKER_REMOTE_SIGNER.md
docs/CAPAUTH_OIDC_IDP.md
docs/CLAIMS.md
docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md
docs/CRYPTO_SPEC.md
docs/ENTERPRISE_MANAGED_KEYS.md
docs/INTEGRATION_BLUEPRINT.md
docs/M0-capauth-api-v1.md
docs/M0-capauth-importer-inventory.md
docs/PQC_CAPAUTH_REVISIT.md
docs/PQC_ROOT_MIGRATION.md
docs/PROTOCOL.md
docs/ROOT_ROTATION_CEREMONY.md
docs/TRUST_GRAPH_COORD_PROJECTION.md
docs/ZERO_KNOWLEDGE_PROFILE.md
docs/authentik-capauth.md
docs/deploy-plan/capauth-bulletproof-deploy.md
openclaw-plugin.archived-2026-04-23/package.json
openclaw-plugin.archived-2026-04-23/src/index.ts
openclaw-plugin.archived-2026-04-23/src/openclaw.plugin.json
phone-signer/app.js
phone-signer/index.html
phone-signer/manifest.webmanifest
phone-signer/sw.js
phone-signer/icons/icon-192.png
phone-signer/icons/icon-512.png
phone-signer/lib/bunker-e2e.js
phone-signer/lib/bunker-signer.js
phone-signer/lib/canonical.js
phone-signer/lib/keyqr.js
phone-signer/lib/keyvault.js
phone-signer/vendor/openpgp.min.js
phone-signer/vendor/qrcode-generator.js
scripts/build_authentik_capauth_image.sh
scripts/capauth-backup.sh
scripts/capauth-restore.sh
scripts/migrate_canonical_subjects.py
scripts/pqc_ceremony_dryrun.py
scripts/provision_agent_profiles.py
src/capauth/__init__.py
src/capauth/agent_identity.py
src/capauth/apps.py
src/capauth/authz.py
src/capauth/cli.py
src/capauth/custody.py
src/capauth/did.py
src/capauth/exceptions.py
src/capauth/identity.py
src/capauth/identity_class.py
src/capauth/integration.py
src/capauth/key_transparency.py
src/capauth/login.py
src/capauth/manifest.py
src/capauth/mesh.py
src/capauth/models.py
src/capauth/pma.py
src/capauth/pqc_confidentiality.py
src/capauth/pqc_identity.py
src/capauth/pqc_root_identity.py
src/capauth/pqc_tokens.py
src/capauth/profile.py
src/capauth/provisioning.py
src/capauth/registry.py
src/capauth/seal.py
src/capauth/subject.py
src/capauth/sync.py
src/capauth/testing.py
src/capauth/tokens.py
src/capauth.egg-info/PKG-INFO
src/capauth.egg-info/SOURCES.txt
src/capauth.egg-info/dependency_links.txt
src/capauth.egg-info/entry_points.txt
src/capauth.egg-info/requires.txt
src/capauth.egg-info/top_level.txt
src/capauth/authentik/__init__.py
src/capauth/authentik/api.py
src/capauth/authentik/claims_mapper.py
src/capauth/authentik/nonce_store.py
src/capauth/authentik/stage.py
src/capauth/authentik/urls.py
src/capauth/authentik/verifier.py
src/capauth/authentik/blueprints/capauth-pgp-login.yaml
src/capauth/crypto/__init__.py
src/capauth/crypto/base.py
src/capauth/crypto/gnupg_backend.py
src/capauth/crypto/pgpy_backend.py
src/capauth/crypto/sequoia_backend.py
src/capauth/crypto/skpgp_backend.py
src/capauth/discovery/__init__.py
src/capauth/discovery/base.py
src/capauth/discovery/file_discovery.py
src/capauth/discovery/mdns.py
src/capauth/discovery/syncthing.py
src/capauth/integrations/__init__.py
src/capauth/integrations/forgejo/__init__.py
src/capauth/integrations/forgejo/auth_flow.py
src/capauth/integrations/forgejo/cli.py
src/capauth/integrations/forgejo/config.py
src/capauth/integrations/forgejo/forgejo_api.py
src/capauth/integrations/forgejo/oidc_provider.py
src/capauth/integrations/forgejo/tests/__init__.py
src/capauth/integrations/forgejo/tests/test_auth_flow.py
src/capauth/integrations/forgejo/tests/test_cli.py
src/capauth/integrations/forgejo/tests/test_config.py
src/capauth/integrations/forgejo/tests/test_forgejo_api.py
src/capauth/integrations/forgejo/tests/test_oidc_provider.py
src/capauth/integrations/nextcloud/.gitignore
src/capauth/integrations/nextcloud/.nextcloudignore
src/capauth/integrations/nextcloud/CSR-PR.md
src/capauth/integrations/nextcloud/INFO-XML-CHANGES.md
src/capauth/integrations/nextcloud/PUBLISHING.md
src/capauth/integrations/nextcloud/README.md
src/capauth/integrations/nextcloud/build-release.sh
src/capauth/integrations/nextcloud/composer.json
src/capauth/integrations/nextcloud/krankerl.toml
src/capauth/integrations/nextcloud/phpunit.xml
src/capauth/integrations/nextcloud/appinfo/info.xml
src/capauth/integrations/nextcloud/appinfo/routes.php
src/capauth/integrations/nextcloud/certificates/.gitignore
src/capauth/integrations/nextcloud/certificates/capauth.crt
src/capauth/integrations/nextcloud/certificates/capauth.csr
src/capauth/integrations/nextcloud/css/login.css
src/capauth/integrations/nextcloud/js/login.js
src/capauth/integrations/nextcloud/lib/AlternativeLogin/CapAuthLogin.php
src/capauth/integrations/nextcloud/lib/AppInfo/Application.php
src/capauth/integrations/nextcloud/lib/BackgroundJob/PruneExpiredNonces.php
src/capauth/integrations/nextcloud/lib/Controller/LoginController.php
src/capauth/integrations/nextcloud/lib/Controller/TokenController.php
src/capauth/integrations/nextcloud/lib/Db/KeyRegistry.php
src/capauth/integrations/nextcloud/lib/Exception/CapAuthUnauthorizedException.php
src/capauth/integrations/nextcloud/lib/Middleware/PgpVerificationMiddleware.php
src/capauth/integrations/nextcloud/lib/Migration/Version000300Date20260301000000.php
src/capauth/integrations/nextcloud/lib/Provider/CapAuthProvider.php
src/capauth/integrations/nextcloud/lib/Service/ChallengeService.php
src/capauth/integrations/nextcloud/lib/Service/GroupSyncService.php
src/capauth/integrations/nextcloud/lib/Service/UserProvisioningService.php
src/capauth/integrations/nextcloud/lib/Service/VerifierService.php
src/capauth/integrations/nextcloud/lib/User/Backend.php
src/capauth/integrations/nextcloud/screenshots/README.md
src/capauth/integrations/nextcloud/screenshots/login.png
src/capauth/integrations/nextcloud/templates/login.php
src/capauth/integrations/nextcloud/tests/bootstrap.php
src/capauth/integrations/nextcloud/tests/integration/FullAuthFlowTest.php
src/capauth/integrations/nextcloud/tests/oidc/oidc_e2e_login_test.py
src/capauth/integrations/nextcloud/tests/unit/Controller/LoginControllerTest.php
src/capauth/integrations/nextcloud/tests/unit/Db/KeyRegistryTest.php
src/capauth/integrations/nextcloud/tests/unit/Provider/CapAuthProviderTest.php
src/capauth/integrations/nextcloud/tests/unit/Service/ChallengeServiceTest.php
src/capauth/integrations/nextcloud/tests/unit/Service/VerifierServiceTest.php
src/capauth/integrations/nextcloud/tests/unit/User/BackendTest.php
src/capauth/migrations/0001_initial.py
src/capauth/migrations/0002_widen_fingerprint_to_64.py
src/capauth/migrations/__init__.py
src/capauth/pairing/__init__.py
src/capauth/pairing/canonicalize.py
src/capauth/pairing/kernel.py
src/capauth/pairing/operator_session.py
src/capauth/pairing/proof.py
src/capauth/pairing/records.py
src/capauth/pairing/store.py
src/capauth/pairing/window.py
src/capauth/service/__init__.py
src/capauth/service/app.py
src/capauth/service/bunker.py
src/capauth/service/bunker_e2e.py
src/capauth/service/keystore.py
src/capauth/service/push.py
src/capauth/service/server.py
src/capauth/service/oidc/__init__.py
src/capauth/service/oidc/clients.example.json
src/capauth/service/oidc/clients.py
src/capauth/service/oidc/passkey.py
src/capauth/service/oidc/provider.py
src/capauth/service/oidc/signing_key.py
src/capauth/service/oidc/store.py
src/capauth/trust/__init__.py
src/capauth/trust/calibration.py
src/capauth/trust/graph.py
stages/ak-stage-capauth/.gitignore
stages/ak-stage-capauth/package-lock.json
stages/ak-stage-capauth/package.json
stages/ak-stage-capauth/vite.config.js
stages/ak-stage-capauth/src/CapAuthStage.test.js
stages/ak-stage-capauth/src/CapAuthStage.vue
stages/ak-stage-capauth/src/index.js
tests/__init__.py
tests/conftest.py
tests/test_agent_identity.py
tests/test_agentrun_capabilities.py
tests/test_audience_mint_helper.py
tests/test_audience_tokens.py
tests/test_authz.py
tests/test_authz_legacy_grace.py
tests/test_authz_signature_gate.py
tests/test_backup_restore.py
tests/test_bunker.py
tests/test_bunker_e2e.py
tests/test_canonicalize.py
tests/test_capauth_service_deploy.py
tests/test_change_capabilities.py
tests/test_claims_mapper.py
tests/test_crypto.py
tests/test_custody.py
tests/test_device_key_proof.py
tests/test_did_capability_relationships.py
tests/test_enrollment_proof_helper.py
tests/test_fingerprint_v6.py
tests/test_forgejo_preflight.py
tests/test_home_resolution.py
tests/test_identity.py
tests/test_identity_class.py
tests/test_identity_ttl.py
tests/test_integration.py
tests/test_key_revocation_expiry.py
tests/test_key_transparency.py
tests/test_login.py
tests/test_manifest.py
tests/test_mesh.py
tests/test_models_pqc_q0.py
tests/test_nextcloud_app.py
tests/test_no_subapp_dependency.py
tests/test_nonce_store.py
tests/test_oidc_idp.py
tests/test_oidc_idp_e2e.py
tests/test_operator_session.py
tests/test_pairing.py
tests/test_pairing_base_dir_env.py
tests/test_passkey.py
tests/test_pma.py
tests/test_pqc_confidentiality.py
tests/test_pqc_identity.py
tests/test_pqc_root_integration.py
tests/test_pqc_t3_gate.py
tests/test_pqc_tokens.py
tests/test_profile.py
tests/test_provisioning.py
tests/test_push.py
tests/test_py313_compat.py
tests/test_qr_login.py
tests/test_real_pgp_e2e.py
tests/test_register_cli.py
tests/test_registry.py
tests/test_seal.py
tests/test_sequoia_backend.py
tests/test_service.py
tests/test_service_authz_decide.py
tests/test_service_v6_fingerprint.py
tests/test_skpgp_backend.py
tests/test_subject.py
tests/test_syncthing_discovery.py
tests/test_testing_helper.py
tests/test_token_gc.py
tests/test_token_store_flag.py
tests/test_tokens.py
tests/test_trust_calibration.py
tests/test_trust_graph.py
tests/test_trust_graph_coord_audit.py
tests/test_verifier.py
tests/test_version_honesty.py
tests/test_zk_profile.py
tests/fixtures/bunker_e2e_v1_vector.json
tests/fixtures/canonical_nonce_v2_vector.json
tools/build-sq.sh
web/README.md
web/stages/capauth/CapAuthStage.ts