@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/core/provisioning/synchronizer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}

package/dist/core/provisioning/synchronizer/index.mjs

@@ -0,0 +1,22 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningEntityResolver } from "./entity-resolver.mjs";
+import { ProvisioningJunctionSynchronizer } from "./junction-synchronizer.mjs";
+import { ClientProvisioningSynchronizer } from "./client/module.mjs";
+import "./client/index.mjs";
+import { PermissionProvisioningSynchronizer } from "./permission/module.mjs";
+import "./permission/index.mjs";
+import { PolicyProvisioningSynchronizer } from "./policy/module.mjs";
+import { RealmProvisioningSynchronizer } from "./realm/module.mjs";
+import "./realm/index.mjs";
+import { RoleProvisioningSynchronizer } from "./role/module.mjs";
+import "./role/index.mjs";
+import { GraphProvisioningSynchronizer } from "./root/module.mjs";
+import { RobotProvisioningSynchronizer } from "./robot/module.mjs";
+import "./robot/index.mjs";
+import { ScopeProvisioningSynchronizer } from "./scope/module.mjs";
+import "./scope/index.mjs";
+import { UserProvisioningSynchronizer } from "./user/module.mjs";
+import "./user/index.mjs";
+export { ClientProvisioningSynchronizer, GraphProvisioningSynchronizer, PermissionProvisioningSynchronizer, PolicyProvisioningSynchronizer, ProvisioningEntityResolver, ProvisioningJunctionSynchronizer, RealmProvisioningSynchronizer, RobotProvisioningSynchronizer, RoleProvisioningSynchronizer, ScopeProvisioningSynchronizer, UserProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/junction-synchronizer.d.ts

@@ -0,0 +1,19 @@
+import type { ObjectLiteral } from '@authup/kit';
+import type { IEntityRepository } from '@authup/server-kit';
+export type ProvisioningJunctionSynchronizerContext<T extends ObjectLiteral = ObjectLiteral> = {
+    repository: IEntityRepository<T>;
+    ownerKey: string;
+    ownerRealmKey: string;
+};
+export declare class ProvisioningJunctionSynchronizer<T extends ObjectLiteral = ObjectLiteral> {
+    protected ctx: ProvisioningJunctionSynchronizerContext<T>;
+    constructor(ctx: ProvisioningJunctionSynchronizerContext<T>);
+    synchronize(owner: {
+        id: string;
+        realm_id?: string | null;
+    }, targets: Array<{
+        id: string;
+        realm_id?: string | null;
+    }>, targetKey: string, targetRealmKey: string, extraAttributes?: Record<string, unknown>): Promise<void>;
+}
+//# sourceMappingURL=junction-synchronizer.d.ts.map

package/dist/core/provisioning/synchronizer/junction-synchronizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-synchronizer.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,MAAM,uCAAuC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAAI;IAC3F,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBAAa,gCAAgC,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjF,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC,CAAC;gBAE9C,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAIrD,WAAW,CACb,KAAK,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3B,EACD,OAAO,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC3B,CAAC,EACF,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC;CAoBnB"}

package/dist/core/provisioning/synchronizer/junction-synchronizer.mjs

@@ -0,0 +1,29 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/provisioning/synchronizer/junction-synchronizer.ts
+var ProvisioningJunctionSynchronizer = class {
+	ctx;
+	constructor(ctx) {
+		this.ctx = ctx;
+	}
+	async synchronize(owner, targets, targetKey, targetRealmKey, extraAttributes) {
+		for (const target of targets) if (!await this.ctx.repository.findOneBy({
+			[this.ctx.ownerKey]: owner.id,
+			[targetKey]: target.id
+		})) {
+			const entity = this.ctx.repository.create({
+				[this.ctx.ownerKey]: owner.id,
+				[this.ctx.ownerRealmKey]: owner.realm_id,
+				[targetKey]: target.id,
+				[targetRealmKey]: target.realm_id,
+				...extraAttributes || {}
+			});
+			await this.ctx.repository.save(entity);
+		}
+	}
+};
+//#endregion
+export { ProvisioningJunctionSynchronizer };
+
+//# sourceMappingURL=junction-synchronizer.mjs.map

package/dist/core/provisioning/synchronizer/junction-synchronizer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"junction-synchronizer.mjs","names":["ProvisioningJunctionSynchronizer","ctx","synchronize","owner","targets","targetKey","targetRealmKey","extraAttributes","target","existing","repository","findOneBy","ownerKey","id","entity","create","ownerRealmKey","realm_id","save"],"sources":["../../../../src/core/provisioning/synchronizer/junction-synchronizer.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '@authup/server-kit';\n\nexport type ProvisioningJunctionSynchronizerContext<T extends ObjectLiteral = ObjectLiteral> = {\n    repository: IEntityRepository<T>,\n    ownerKey: string,\n    ownerRealmKey: string,\n};\n\nexport class ProvisioningJunctionSynchronizer<T extends ObjectLiteral = ObjectLiteral> {\n    protected ctx: ProvisioningJunctionSynchronizerContext<T>;\n\n    constructor(ctx: ProvisioningJunctionSynchronizerContext<T>) {\n        this.ctx = ctx;\n    }\n\n    async synchronize(\n        owner: {\n            id: string,\n            realm_id?: string | null \n        },\n        targets: Array<{\n            id: string,\n            realm_id?: string | null \n        }>,\n        targetKey: string,\n        targetRealmKey: string,\n        extraAttributes?: Record<string, unknown>,\n    ): Promise<void> {\n        for (const target of targets) {\n            const existing = await this.ctx.repository.findOneBy({\n                [this.ctx.ownerKey]: owner.id,\n                [targetKey]: target.id,\n            });\n\n            if (!existing) {\n                const entity = this.ctx.repository.create({\n                    [this.ctx.ownerKey]: owner.id,\n                    [this.ctx.ownerRealmKey]: owner.realm_id,\n                    [targetKey]: target.id,\n                    [targetRealmKey]: target.realm_id,\n                    ...(extraAttributes || {}),\n                } as Partial<T>);\n\n                await this.ctx.repository.save(entity);\n            }\n        }\n    }\n}\n"],"mappings":";;;;AAgBA,IAAaA,mCAAb,MAAaA;CACCC;CAEV,YAAYA,KAAiD;EACzD,KAAKA,MAAMA;CACf;CAEA,MAAMC,YACFC,OAIAC,SAIAC,WACAC,gBACAC,iBACa;EACb,KAAK,MAAMC,UAAUJ,SAMjB,IAAI,CAACK,MALkB,KAAKR,IAAIS,WAAWC,UAAU;IAChD,KAAKV,IAAIW,WAAWT,MAAMU;IAC1BR,YAAYG,OAAOK;EACxB,CAAA,GAEe;GACX,MAAMC,SAAS,KAAKb,IAAIS,WAAWK,OAAO;KACrC,KAAKd,IAAIW,WAAWT,MAAMU;KAC1B,KAAKZ,IAAIe,gBAAgBb,MAAMc;KAC/BZ,YAAYG,OAAOK;KACnBP,iBAAiBE,OAAOS;IACzB,GAAIV,mBAAmB,CAAC;GAC5B,CAAA;GAEA,MAAM,KAAKN,IAAIS,WAAWQ,KAAKJ,MAAAA;EACnC;CAER;AACJ"}

package/dist/core/provisioning/synchronizer/permission/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/permission/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PermissionProvisioningSynchronizer } from "./module.mjs";
+export { PermissionProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/permission/module.d.ts

@@ -0,0 +1,14 @@
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';
+import type { PermissionProvisioningEntity } from '../../entities/permission';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import type { PermissionProvisioningSynchronizerContext } from './types.ts';
+export declare class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {
+    protected repository: IPermissionRepository;
+    protected policyRepository?: IPolicyRepository;
+    protected permissionPolicyRepository?: IPermissionPolicyRepository;
+    constructor(ctx: PermissionProvisioningSynchronizerContext);
+    synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity>;
+    private synchronizePolicies;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/permission/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,kCAAmC,SAAQ,4BAA4B,CAAC,4BAA4B,CAAC;IAC9G,SAAS,CAAC,UAAU,EAAG,qBAAqB,CAAC;IAE7C,SAAS,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IAE/C,SAAS,CAAC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;gBAEvD,GAAG,EAAE,yCAAyC;IAQpD,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC;YAkD/E,mBAAmB;CAgCpC"}

package/dist/core/provisioning/synchronizer/permission/module.mjs

@@ -0,0 +1,73 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/permission/module.ts
+var PermissionProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	policyRepository;
+	permissionPolicyRepository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.policyRepository = ctx.policyRepository;
+		this.permissionPolicyRepository = ctx.permissionPolicyRepository;
+	}
+	async synchronize(input) {
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.repository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null,
+			client_id: input.attributes.client_id || null
+		});
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.repository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.repository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.repository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.repository.save(this.repository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (input.relations?.policies && input.relations.policies.length > 0) await this.synchronizePolicies(attributes, input.relations.policies);
+		return {
+			...input,
+			attributes
+		};
+	}
+	async synchronizePolicies(permission, policyNames) {
+		if (!this.policyRepository || !this.permissionPolicyRepository) throw new Error("Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.");
+		for (const policyName of policyNames) {
+			const policy = await this.policyRepository.findOneByName(policyName);
+			if (!policy) throw new Error(`Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`);
+			if (await this.permissionPolicyRepository.findOneBy({
+				permission_id: permission.id,
+				policy_id: policy.id
+			})) continue;
+			const entry = this.permissionPolicyRepository.create({
+				permission_id: permission.id,
+				permission_realm_id: permission.realm_id,
+				policy_id: policy.id,
+				policy_realm_id: policy.realm_id
+			});
+			await this.permissionPolicyRepository.save(entry);
+		}
+	}
+};
+//#endregion
+export { PermissionProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/permission/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","strategy","attributes","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","existing","permission_id","policy_id","entry","permission_realm_id","policy_realm_id"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName);\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permission_id: permission.id,\n                policy_id: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permission_id: permission.id,\n                permission_realm_id: permission.realm_id,\n                policy_id: policy.id,\n                policy_realm_id: policy.realm_id,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAA4E;EAC1F,MAAMC,WAAWT,oCAAoCQ,MAAMC,QAAQ;EAEnE,IAAIC,aAAa,MAAM,KAAKP,WAAWQ,UAAU;GAC7CC,MAAMJ,MAAME,WAAWE;GACvBC,UAAUL,MAAME,WAAWG,YAAY;GACvCC,WAAWN,MAAME,WAAWI,aAAa;EAC7C,CAAA;EAEA,IAAIL,SAASM,SAAShB,+BAA+BiB,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKP,WAAWc,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASM,MAAjB;GACI,KAAKhB,+BAA+BmB;IAChCR,aAAa,KAAKP,WAAWgB,MACzBT,YACAD,SAASC,aACLZ,WAAWU,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKP,WAAWiB,KAAKV,UAAAA;IACxC;GACJ,KAAKX,+BAA+BsB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKP,WAAWiB,KAAK,KAAKjB,WAAWoB,OAAOf,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMgB,WAAWC,YAAYjB,MAAMgB,UAAUC,SAASC,SAAS,GAC/D,MAAM,KAAKC,oBAAoBjB,YAAYF,MAAMgB,UAAUC,QAAQ;EAGvE,OAAO;GACH,GAAGjB;GACHE;EACJ;CACJ;CAEA,MAAciB,oBAAoBC,YAAwBC,aAAsC;EAC5F,IAAI,CAAC,KAAKzB,oBAAoB,CAAC,KAAKC,4BAChC,MAAM,IAAIyB,MACN,qGAAA;EAIR,KAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK5B,iBAAiB6B,cAAcF,UAAAA;GACzD,IAAI,CAACC,QACD,MAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,GAAG;GAQ7F,IAAIsB,MAJmB,KAAK7B,2BAA2BM,UAAU;IAC7DwB,eAAeP,WAAWN;IAC1Bc,WAAWJ,OAAOV;GACtB,CAAA,GAEI;GAGJ,MAAMe,QAAQ,KAAKhC,2BAA2BkB,OAAO;IACjDY,eAAeP,WAAWN;IAC1BgB,qBAAqBV,WAAWf;IAChCuB,WAAWJ,OAAOV;IAClBiB,iBAAiBP,OAAOnB;GAC5B,CAAA;GACA,MAAM,KAAKR,2BAA2Be,KAAKiB,KAAAA;EAC/C;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/permission/types.d.ts

@@ -0,0 +1,8 @@
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';
+export type PermissionProvisioningSynchronizerContext = {
+    repository: IPermissionRepository;
+    policyRepository?: IPolicyRepository;
+    permissionPolicyRepository?: IPermissionPolicyRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/permission/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE3F,MAAM,MAAM,yCAAyC,GAAG;IACpD,UAAU,EAAE,qBAAqB,CAAC;IAClC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,0BAA0B,CAAC,EAAE,2BAA2B,CAAC;CAC5D,CAAC"}

package/dist/core/provisioning/synchronizer/permission/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/policy/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PolicyProvisioningSynchronizer } from "./module.mjs";
+export { PolicyProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/policy/module.d.ts

@@ -0,0 +1,15 @@
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPolicyRepository } from '../../../entities/index.ts';
+import type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import type { PolicyProvisioningSynchronizerContext } from './types.ts';
+export declare class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {
+    protected repository: IPolicyRepository;
+    protected permissionPolicyRepository: IPermissionPolicyRepository;
+    constructor(ctx: PolicyProvisioningSynchronizerContext);
+    synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity>;
+    private synchronizeChildren;
+    private cleanupStaleChildren;
+    private cleanupStaleChild;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/policy/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,GAAG,EAAE,qCAAqC;IAOhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;YAmCvE,mBAAmB;YAgBnB,oBAAoB;YAgBpB,iBAAiB;CAclC"}

package/dist/core/provisioning/synchronizer/policy/module.mjs

@@ -0,0 +1,70 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+//#region src/core/provisioning/synchronizer/policy/module.ts
+var PolicyProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	permissionPolicyRepository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.permissionPolicyRepository = ctx.permissionPolicyRepository;
+	}
+	async synchronize(input) {
+		let entity = await this.repository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null
+		});
+		if (entity) {
+			const mergeData = {
+				type: input.attributes.type,
+				built_in: input.attributes.built_in,
+				parent_id: input.attributes.parent_id,
+				parent: input.attributes.parent
+			};
+			if (typeof input.attributes.invert !== "undefined") mergeData.invert = input.attributes.invert;
+			entity = this.repository.merge(entity, mergeData);
+			await this.repository.saveWithEA(entity, input.extraAttributes);
+		} else {
+			entity = this.repository.create(input.attributes);
+			await this.repository.saveWithEA(entity, input.extraAttributes);
+		}
+		await this.synchronizeChildren(entity.id, input.children || []);
+		return {
+			...input,
+			attributes: entity
+		};
+	}
+	async synchronizeChildren(parentId, children = []) {
+		const declaredNames = children.map((c) => c.attributes.name);
+		await children.reduce(async (prev, child) => {
+			await prev;
+			child.attributes.parent_id = parentId;
+			child.attributes.parent = { id: parentId };
+			await this.synchronize(child);
+		}, Promise.resolve());
+		await this.cleanupStaleChildren(parentId, declaredNames);
+	}
+	async cleanupStaleChildren(parentId, declaredNames) {
+		await (await this.repository.findManyBy({ parent_id: parentId })).filter((child) => !declaredNames.includes(child.name)).reduce(async (prev, child) => {
+			await prev;
+			await this.cleanupStaleChild(child);
+		}, Promise.resolve());
+	}
+	async cleanupStaleChild(child) {
+		if ((await this.permissionPolicyRepository.findManyBy({ policy_id: child.id })).length === 0) await this.repository.deleteFromTree(child);
+		else {
+			const detached = this.repository.merge(child, {
+				parent_id: null,
+				parent: null,
+				built_in: false
+			});
+			await this.repository.saveWithEA(detached);
+		}
+	}
+};
+//#endregion
+export { PolicyProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/policy/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","PolicyProvisioningSynchronizer","repository","permissionPolicyRepository","ctx","synchronize","input","entity","findOneBy","name","attributes","realm_id","mergeData","type","built_in","parent_id","parent","invert","merge","saveWithEA","extraAttributes","create","synchronizeChildren","id","children","parentId","declaredNames","map","c","reduce","prev","child","Promise","resolve","cleanupStaleChildren","existingChildren","findManyBy","staleChildren","filter","includes","cleanupStaleChild","referencingJunctions","policy_id","length","deleteFromTree","detached"],"sources":["../../../../../src/core/provisioning/synchronizer/policy/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Policy } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPolicyRepository } from '../../../entities/index.ts';\nimport type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PolicyProvisioningSynchronizerContext } from './types.ts';\n\nexport class PolicyProvisioningSynchronizer extends BaseProvisioningSynchronizer<PolicyProvisioningEntity> {\n    protected repository: IPolicyRepository;\n\n    protected permissionPolicyRepository: IPermissionPolicyRepository;\n\n    constructor(ctx: PolicyProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PolicyProvisioningEntity): Promise<PolicyProvisioningEntity> {\n        let entity = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (entity) {\n            // Only assign `invert` when the source declares it explicitly.\n            // TypeORM's `merge` is a plain assign and would otherwise clobber\n            // an existing flag with `undefined` (turning `invert: true` into\n            // `null`/`false` on every reprovisioning pass).\n            const mergeData: Partial<Policy> = {\n                type: input.attributes.type,\n                built_in: input.attributes.built_in,\n                parent_id: input.attributes.parent_id,\n                parent: input.attributes.parent,\n            };\n            if (typeof input.attributes.invert !== 'undefined') {\n                mergeData.invert = input.attributes.invert;\n            }\n            entity = this.repository.merge(entity, mergeData);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        } else {\n            entity = this.repository.create(input.attributes);\n            await this.repository.saveWithEA(entity, input.extraAttributes);\n        }\n\n        await this.synchronizeChildren(entity.id, input.children || []);\n\n        return {\n            ...input,\n            attributes: entity,\n        };\n    }\n\n    private async synchronizeChildren(\n        parentId: string,\n        children: PolicyProvisioningEntity[] = [],\n    ): Promise<void> {\n        const declaredNames = children.map((c) => c.attributes.name);\n\n        await children.reduce(async (prev, child) => {\n            await prev;\n            child.attributes.parent_id = parentId;\n            child.attributes.parent = { id: parentId } as any;\n            await this.synchronize(child);\n        }, Promise.resolve());\n\n        await this.cleanupStaleChildren(parentId, declaredNames);\n    }\n\n    private async cleanupStaleChildren(\n        parentId: string,\n        declaredNames: (string | undefined)[],\n    ): Promise<void> {\n        const existingChildren = await this.repository.findManyBy({ parent_id: parentId });\n\n        const staleChildren = existingChildren.filter(\n            (child) => !declaredNames.includes(child.name),\n        );\n\n        await staleChildren.reduce(async (prev, child) => {\n            await prev;\n            await this.cleanupStaleChild(child);\n        }, Promise.resolve());\n    }\n\n    private async cleanupStaleChild(child: Policy): Promise<void> {\n        const referencingJunctions = await this.permissionPolicyRepository.findManyBy({ policy_id: child.id });\n\n        if (referencingJunctions.length === 0) {\n            await this.repository.deleteFromTree(child);\n        } else {\n            const detached = this.repository.merge(child, {\n                parent_id: null,\n                parent: null,\n                built_in: false,\n            });\n            await this.repository.saveWithEA(detached);\n        }\n    }\n}\n"],"mappings":";;;;;AAcA,IAAaC,iCAAb,cAAoDD,6BAAAA;CACtCE;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKF,aAAaE,IAAIF;EACtB,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAAoE;EAClF,IAAIC,SAAS,MAAM,KAAKL,WAAWM,UAAU;GACzCC,MAAMH,MAAMI,WAAWD;GACvBE,UAAUL,MAAMI,WAAWC,YAAY;EAC3C,CAAA;EAEA,IAAIJ,QAAQ;GAKR,MAAMK,YAA6B;IAC/BC,MAAMP,MAAMI,WAAWG;IACvBC,UAAUR,MAAMI,WAAWI;IAC3BC,WAAWT,MAAMI,WAAWK;IAC5BC,QAAQV,MAAMI,WAAWM;GAC7B;GACA,IAAI,OAAOV,MAAMI,WAAWO,WAAW,aACnCL,UAAUK,SAASX,MAAMI,WAAWO;GAExCV,SAAS,KAAKL,WAAWgB,MAAMX,QAAQK,SAAAA;GACvC,MAAM,KAAKV,WAAWiB,WAAWZ,QAAQD,MAAMc,eAAe;EAClE,OAAO;GACHb,SAAS,KAAKL,WAAWmB,OAAOf,MAAMI,UAAU;GAChD,MAAM,KAAKR,WAAWiB,WAAWZ,QAAQD,MAAMc,eAAe;EAClE;EAEA,MAAM,KAAKE,oBAAoBf,OAAOgB,IAAIjB,MAAMkB,YAAY,CAAA,CAAE;EAE9D,OAAO;GACH,GAAGlB;GACHI,YAAYH;EAChB;CACJ;CAEA,MAAce,oBACVG,UACAD,WAAuC,CAAA,GAC1B;EACb,MAAME,gBAAgBF,SAASG,KAAKC,MAAMA,EAAElB,WAAWD,IAAI;EAE3D,MAAMe,SAASK,OAAO,OAAOC,MAAMC,UAAAA;GAC/B,MAAMD;GACNC,MAAMrB,WAAWK,YAAYU;GAC7BM,MAAMrB,WAAWM,SAAS,EAAEO,IAAIE,SAAS;GACzC,MAAM,KAAKpB,YAAY0B,KAAAA;EAC3B,GAAGC,QAAQC,QAAO,CAAA;EAElB,MAAM,KAAKC,qBAAqBT,UAAUC,aAAAA;CAC9C;CAEA,MAAcQ,qBACVT,UACAC,eACa;EAOb,OAJsBS,MAFS,KAAKjC,WAAWkC,WAAW,EAAErB,WAAWU,SAAS,CAAA,EAAA,CAEzCa,QAClCP,UAAU,CAACL,cAAca,SAASR,MAAMtB,IAAI,CAG3C4B,CAAAA,CAAcR,OAAO,OAAOC,MAAMC,UAAAA;GACpC,MAAMD;GACN,MAAM,KAAKU,kBAAkBT,KAAAA;EACjC,GAAGC,QAAQC,QAAO,CAAA;CACtB;CAEA,MAAcO,kBAAkBT,OAA8B;EAG1D,KAAIU,MAF+B,KAAKtC,2BAA2BiC,WAAW,EAAEM,WAAWX,MAAMR,GAAG,CAAA,EAAA,CAE3EoB,WAAW,GAChC,MAAM,KAAKzC,WAAW0C,eAAeb,KAAAA;OAClC;GACH,MAAMc,WAAW,KAAK3C,WAAWgB,MAAMa,OAAO;IAC1ChB,WAAW;IACXC,QAAQ;IACRF,UAAU;GACd,CAAA;GACA,MAAM,KAAKZ,WAAWiB,WAAW0B,QAAAA;EACrC;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/policy/types.d.ts

@@ -0,0 +1,7 @@
+import type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';
+import type { IPolicyRepository } from '../../../entities/index.ts';
+export type PolicyProvisioningSynchronizerContext = {
+    repository: IPolicyRepository;
+    permissionPolicyRepository: IPermissionPolicyRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/policy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,MAAM,MAAM,qCAAqC,GAAG;IAChD,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0BAA0B,EAAE,2BAA2B,CAAC;CAC3D,CAAC"}

package/dist/core/provisioning/synchronizer/policy/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/realm/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/realm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/realm/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RealmProvisioningSynchronizer } from "./module.mjs";
+export { RealmProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/realm/module.d.ts

@@ -0,0 +1,22 @@
+import type { IRealmRepository } from '../../../entities/index.ts';
+import type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';
+import type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';
+import type { RealmProvisioningEntity } from '../../entities/realm/index.ts';
+import type { RobotProvisioningEntity } from '../../entities/robot/index.ts';
+import type { RoleProvisioningEntity } from '../../entities/role/index.ts';
+import type { UserProvisioningEntity } from '../../entities/user/index.ts';
+import type { IProvisioningSynchronizer } from '../../types.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import type { RealmProvisioningSynchronizerContext } from './types.ts';
+export declare class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {
+    protected repository: IRealmRepository;
+    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;
+    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
+    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
+    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;
+    protected robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;
+    protected scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;
+    constructor(ctx: RealmProvisioningSynchronizerContext);
+    synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/realm/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;IAExC,SAAS,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAElF,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAEhF,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;gBAErE,GAAG,EAAE,oCAAoC;IAY/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAsGtF"}

package/dist/core/provisioning/synchronizer/realm/module.mjs

@@ -0,0 +1,106 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/realm/module.ts
+var RealmProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	clientSynchronizer;
+	permissionSynchronizer;
+	roleSynchronizer;
+	userSynchronizer;
+	robotSynchronizer;
+	scopeSynchronizer;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.clientSynchronizer = ctx.clientSynchronizer;
+		this.permissionSynchronizer = ctx.permissionSynchronizer;
+		this.roleSynchronizer = ctx.roleSynchronizer;
+		this.userSynchronizer = ctx.userSynchronizer;
+		this.robotSynchronizer = ctx.robotSynchronizer;
+		this.scopeSynchronizer = ctx.scopeSynchronizer;
+	}
+	async synchronize(input) {
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.repository.findOneBy({ name: input.attributes.name });
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.repository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.repository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.repository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.repository.save(this.repository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (input.relations && input.relations.clients) {
+			const clients = input.relations.clients.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.clientSynchronizer.synchronizeMany(clients);
+		}
+		if (input.relations && input.relations.permissions) {
+			const permissions = input.relations.permissions.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.permissionSynchronizer.synchronizeMany(permissions);
+		}
+		if (input.relations && input.relations.roles) {
+			const roles = input.relations.roles.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.roleSynchronizer.synchronizeMany(roles);
+		}
+		if (input.relations && input.relations.users) {
+			const users = input.relations.users.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.userSynchronizer.synchronizeMany(users);
+		}
+		if (input.relations && input.relations.robots) {
+			const robots = input.relations.robots.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.robotSynchronizer.synchronizeMany(robots);
+		}
+		if (input.relations && input.relations.scopes) {
+			const scopes = input.relations.scopes.map((child) => {
+				child.attributes.realm_id = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.scopeSynchronizer.synchronizeMany(scopes);
+		}
+		return {
+			...input,
+			attributes
+		};
+	}
+};
+//#endregion
+export { RealmProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/realm/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","robotSynchronizer","scopeSynchronizer","ctx","synchronize","input","strategy","attributes","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","clients","map","child","realm_id","realm","synchronizeMany","permissions","roles","users","robots","scopes"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.robotSynchronizer = ctx.robotSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realm_id = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        if (input.relations && input.relations.robots) {\n            const robots = input.relations.robots.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.robotSynchronizer.synchronizeMany(robots);\n        }\n\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realm_id = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAoBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKP,aAAaO,IAAIP;EACtB,KAAKC,qBAAqBM,IAAIN;EAC9B,KAAKC,yBAAyBK,IAAIL;EAClC,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,MAAMC,WAAWb,oCAAoCY,MAAMC,QAAQ;EACnE,IAAIC,aAAa,MAAM,KAAKX,WAAWY,UAAU,EAAEC,MAAMJ,MAAME,WAAWE,KAAK,CAAA;EAE/E,IAAIH,SAASI,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIJ,YACA,MAAM,KAAKX,WAAWgB,OAAOL,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQD,SAASI,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCN,aAAa,KAAKX,WAAWkB,MACzBP,YACAD,SAASC,aACLhB,WAAWc,MAAME,YAAYD,SAASC,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWmB,KAAKR,UAAAA;IACxC;GACJ,KAAKf,+BAA+BwB;IAChCX,MAAME,WAAWU,KAAKV,WAAWU;IACjCV,aAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKX,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOb,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMc,aAAad,MAAMc,UAAUC,SAAS;GAC5C,MAAMA,UAAUf,MAAMc,UAAUC,QAAQC,KACnCC,UAAAA;IACGA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBL,OAAAA;EAClD;EAEA,IAAIf,MAAMc,aAAad,MAAMc,UAAUO,aAAa;GAChD,MAAMA,cAAcrB,MAAMc,UAAUO,YAAYL,KAAKC,UAAAA;IACjDA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBC,WAAAA;EACtD;EAEA,IAAIrB,MAAMc,aAAad,MAAMc,UAAUQ,OAAO;GAC1C,MAAMA,QAAQtB,MAAMc,UAAUQ,MAAMN,KAAKC,UAAAA;IACrCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBE,KAAAA;EAChD;EAEA,IAAItB,MAAMc,aAAad,MAAMc,UAAUS,OAAO;GAC1C,MAAMA,QAAQvB,MAAMc,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBG,KAAAA;EAChD;EAEA,IAAIvB,MAAMc,aAAad,MAAMc,UAAUU,QAAQ;GAC3C,MAAMA,SAASxB,MAAMc,UAAUU,OAAOR,KAAKC,UAAAA;IACvCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBI,MAAAA;EACjD;EAEA,IAAIxB,MAAMc,aAAad,MAAMc,UAAUW,QAAQ;GAC3C,MAAMA,SAASzB,MAAMc,UAAUW,OAAOT,KAAKC,UAAAA;IACvCA,MAAMf,WAAWgB,WAAWhB,WAAWU;IACvCK,MAAMf,WAAWiB,QAAQjB;IACzB,OAAOe;GACX,CAAA;GAEA,MAAM,KAAKpB,kBAAkBuB,gBAAgBK,MAAAA;EACjD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/realm/types.d.ts

@@ -0,0 +1,18 @@
+import type { IRealmRepository } from '../../../entities/index.ts';
+import type { ScopeProvisioningEntity } from '../../entities/index.ts';
+import type { ClientProvisioningEntity } from '../../entities/client/index.ts';
+import type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';
+import type { RobotProvisioningEntity } from '../../entities/robot/index.ts';
+import type { RoleProvisioningEntity } from '../../entities/role/index.ts';
+import type { UserProvisioningEntity } from '../../entities/user/index.ts';
+import type { IProvisioningSynchronizer } from '../../types.ts';
+export type RealmProvisioningSynchronizerContext = {
+    repository: IRealmRepository;
+    clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;
+    roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
+    permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
+    userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;
+    robotSynchronizer: IProvisioningSynchronizer<RobotProvisioningEntity>;
+    scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/realm/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,oCAAoC,GAAG;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAE7B,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IACxE,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAChF,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IACtE,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;CACzE,CAAC"}

package/dist/core/provisioning/synchronizer/realm/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/robot/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/robot/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/robot/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/robot/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RobotProvisioningSynchronizer } from "./module.mjs";
+export { RobotProvisioningSynchronizer };