@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.51

package/dist/core/provisioning/synchronizer/robot/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RobotProvisioningSynchronizer","robotRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","robotPermissionRepository","ownerKey","ownerRealmKey","robotRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/robot/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    RobotPermission, \n    RobotRole, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IRobotRepository } from '../../../entities/index.ts';\nimport type { RobotProvisioningEntity } from '../../entities/robot/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RobotProvisioningSynchronizerContext } from './types.ts';\n\nexport class RobotProvisioningSynchronizer extends BaseProvisioningSynchronizer<RobotProvisioningEntity> {\n    protected robotRepository: IRobotRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RobotPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<RobotRole>;\n\n    constructor(ctx: RobotProvisioningSynchronizerContext) {\n        super();\n\n        this.robotRepository = ctx.robotRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotPermissionRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.robotRoleRepository,\n            ownerKey: 'robot_id',\n            ownerRealmKey: 'robot_realm_id',\n        });\n    }\n\n    async synchronize(input: RobotProvisioningEntity): Promise<RobotProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.robotRepository.findOneBy({\n            name: input.attributes.name,\n            ...(input.attributes.realm_id ? { realm_id: input.attributes.realm_id } : { realm_id: null }),\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.robotRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.robotRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.robotRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.robotRepository.save(this.robotRepository.create(input.attributes));\n        }\n\n        // Permissions (Global & Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global & Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,IAAaM,gCAAb,cAAmDH,6BAAAA;CACrCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKL,kBAAkBK,IAAIL;EAE3B,KAAKC,qBAAqB,IAAIJ,2BAA2BQ,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIL,2BAA2BQ,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIL,iCAAiC;GAC3DU,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIN,iCAAiC;GACrDU,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWtB,oCAAoCmB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKhB,gBAAgBkB,UAAU;GAClDC,MAAML,MAAME,WAAWG;GACvB,GAAIL,MAAME,WAAWI,WAAW,EAAEA,UAAUN,MAAME,WAAWI,SAAS,IAAI,EAAEA,UAAU,KAAK;EAC/F,CAAA;EAEA,IAAIH,SAASI,SAAS3B,+BAA+B4B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKhB,gBAAgBuB,OAAOP,UAAAA;GAEtC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK3B,+BAA+B8B;IAChCR,aAAa,KAAKhB,gBAAgByB,MAC9BT,YACAC,SAASD,aACLvB,WAAWqB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKhB,gBAAgB0B,KAAKV,UAAAA;IAC7C;GACJ,KAAKtB,+BAA+BiC;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKhB,gBAAgB0B,KAAK,KAAK1B,gBAAgB6B,OAAOf,MAAME,UAAU,CAAA;IACzF;EACR;OAEAA,aAAa,MAAM,KAAKhB,gBAAgB0B,KAAK,KAAK1B,gBAAgB6B,OAAOf,MAAME,UAAU,CAAA;EAI7F,MAAMc,cAAc,CAAA,GACb,MAAM,KAAK7B,mBAAmB8B,cAC7BjB,MAAMkB,aAAalB,MAAMkB,UAAUC,iBAAiB,GAAA,GAEpDjB,WAAWI,WACX,MAAM,KAAKnB,mBAAmBiC,aAC1BpB,MAAMkB,aAAalB,MAAMkB,UAAUG,kBACnCnB,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKjC,mBAAmBU,YAC1BG,YACAc,aACA,iBACA,qBAAA;EAKR,MAAMO,QAAQ,CAAA,GACP,MAAM,KAAKnC,aAAa6B,cACvBjB,MAAMkB,aAAalB,MAAMkB,UAAUM,WAAW,GAAA,GAE9CtB,WAAWI,WACX,MAAM,KAAKlB,aAAagC,aACpBpB,MAAMkB,aAAalB,MAAMkB,UAAUO,YACnCvB,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKhC,aAAaS,YACpBG,YACAqB,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGvB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/robot/types.d.ts

@@ -0,0 +1,9 @@
+import type { IPermissionRepository, IRobotPermissionRepository, IRobotRepository, IRobotRoleRepository, IRoleRepository } from '../../../entities/index.ts';
+export type RobotProvisioningSynchronizerContext = {
+    robotRepository: IRobotRepository;
+    robotRoleRepository: IRobotRoleRepository;
+    robotPermissionRepository: IRobotPermissionRepository;
+    roleRepository: IRoleRepository;
+    permissionRepository: IPermissionRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/robot/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/robot/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,qBAAqB,EACrB,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,oCAAoC,GAAG;IAC/C,eAAe,EAAE,gBAAgB,CAAC;IAClC,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,yBAAyB,EAAE,0BAA0B,CAAC;IAEtD,cAAc,EAAE,eAAe,CAAC;IAChC,oBAAoB,EAAE,qBAAqB,CAAC;CAC/C,CAAC"}

package/dist/core/provisioning/synchronizer/robot/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/role/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/role/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/role/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/role/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RoleProvisioningSynchronizer } from "./module.mjs";
+export { RoleProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/role/module.d.ts

@@ -0,0 +1,16 @@
+import type { Permission, RolePermission } from '@authup/core-kit';
+import type { IRoleRepository } from '../../../entities/index.ts';
+import type { RoleProvisioningEntity } from '../../entities/role/index.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import { ProvisioningEntityResolver } from '../entity-resolver.ts';
+import { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';
+import type { RoleProvisioningSynchronizerContext } from './types.ts';
+export declare class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {
+    protected repository: IRoleRepository;
+    protected permissionResolver: ProvisioningEntityResolver<Permission>;
+    protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;
+    constructor(ctx: RoleProvisioningSynchronizerContext);
+    synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity>;
+    private buildRealmScopeOverrides;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/role/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEtE,qBAAa,4BAA6B,SAAQ,4BAA4B,CAAC,sBAAsB,CAAC;IAClG,SAAS,CAAC,UAAU,EAAG,eAAe,CAAC;IAEvC,SAAS,CAAC,kBAAkB,EAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAEtE,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,cAAc,CAAC,CAAC;gBAEnE,GAAG,EAAE,mCAAmC;IAY9C,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+FjF,OAAO,CAAC,wBAAwB;CAcnC"}

package/dist/core/provisioning/synchronizer/role/module.mjs

@@ -0,0 +1,90 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { ProvisioningEntityResolver } from "../entity-resolver.mjs";
+import { ProvisioningJunctionSynchronizer } from "../junction-synchronizer.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/role/module.ts
+var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	permissionResolver;
+	permissionJunction;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
+		this.permissionJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.rolePermissionRepository,
+			ownerKey: "role_id",
+			ownerRealmKey: "role_realm_id"
+		});
+	}
+	async synchronize(input) {
+		this.canonicalizeName(input.attributes);
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.repository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null,
+			client_id: input.attributes.client_id || null
+		});
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.repository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.repository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.repository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.repository.save(this.repository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (!input.relations) return {
+			...input,
+			attributes
+		};
+		let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);
+		if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {
+			const excludeSet = new Set(input.relations.globalPermissionsExclude);
+			globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));
+		}
+		const realmPermissions = attributes.realm_id ? await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) : [];
+		const permissions = [...globalPermissions, ...realmPermissions];
+		if (permissions.length > 0) {
+			const defaultScope = input.relations.globalPermissionsRealmScope;
+			if (defaultScope) {
+				const overrides = this.buildRealmScopeOverrides(input);
+				for (const permission of permissions) {
+					const realmScope = overrides.get(permission.name) ?? defaultScope;
+					await this.permissionJunction.synchronize(attributes, [permission], "permission_id", "permission_realm_id", { realm_scope: realmScope });
+				}
+			} else await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
+		}
+		return {
+			...input,
+			attributes
+		};
+	}
+	buildRealmScopeOverrides(input) {
+		const overrides = /* @__PURE__ */ new Map();
+		if (input.relations?.globalPermissionsRealmScopeOverrides) for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {
+			if (!permissionNames) continue;
+			for (const permName of permissionNames) overrides.set(permName, realmScope);
+		}
+		return overrides;
+	}
+};
+//#endregion
+export { RoleProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/role/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","client_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","realm_scope","Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n    protected repository : IRoleRepository;\n\n    protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n    constructor(ctx: RoleProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.rolePermissionRepository,\n            ownerKey: 'role_id',\n            ownerRealmKey: 'role_realm_id',\n        });\n    }\n\n    async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n            client_id: input.attributes.client_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (!input.relations) {\n            return {\n                ...input,\n                attributes,\n            };\n        }\n\n        let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n        if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n            const excludeSet = new Set(input.relations.globalPermissionsExclude);\n            globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n        }\n\n        const realmPermissions = attributes.realm_id ?\n            await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realm_id) :\n            [];\n\n        const permissions = [\n            ...globalPermissions,\n            ...realmPermissions,\n        ];\n\n        if (permissions.length > 0) {\n            const defaultScope = input.relations.globalPermissionsRealmScope;\n\n            if (defaultScope) {\n                const overrides = this.buildRealmScopeOverrides(input);\n                for (const permission of permissions) {\n                    const realmScope = overrides.get(permission.name) ?? defaultScope;\n                    await this.permissionJunction.synchronize(\n                        attributes,\n                        [permission],\n                        'permission_id',\n                        'permission_realm_id',\n                        { realm_scope: realmScope },\n                    );\n                }\n            } else {\n                await this.permissionJunction.synchronize(\n                    attributes,\n                    permissions,\n                    'permission_id',\n                    'permission_realm_id',\n                );\n            }\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n        const overrides = new Map<string, string>();\n        if (input.relations?.globalPermissionsRealmScopeOverrides) {\n            for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n                if (!permissionNames) {\n                    continue;\n                }\n                for (const permName of permissionNames) {\n                    overrides.set(permName, realmScope);\n                }\n            }\n        }\n        return overrides;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;GACvCC,WAAWP,MAAME,WAAWK,aAAa;EAC7C,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,WAChC,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,QAAQ,IAChG,CAAA;EAEJ,MAAMuB,cAAc,CAAA,GACbX,mBAAAA,GACAS,gBAAAA;EAGP,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAAA,GACD,iBACA,uBACA,EAAEG,aAAaF,WAAW,CAAA;IAElC;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,iBACA,qBAAA;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,IAAIM,IAAAA;EACtB,IAAItC,MAAMiB,WAAWsB,sCACjB,KAAK,MAAM,CAACJ,YAAYK,oBAAoBC,OAAOC,QAAQ1C,MAAMiB,UAAUsB,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,iBACnBR,UAAUY,IAAID,UAAUR,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}

package/dist/core/provisioning/synchronizer/role/types.d.ts

@@ -0,0 +1,7 @@
+import type { IPermissionRepository, IRolePermissionRepository, IRoleRepository } from '../../../entities/index.ts';
+export type RoleProvisioningSynchronizerContext = {
+    repository: IRoleRepository;
+    permissionRepository: IPermissionRepository;
+    rolePermissionRepository: IRolePermissionRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/role/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/role/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,mCAAmC,GAAG;IAC9C,UAAU,EAAE,eAAe,CAAC;IAC5B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,wBAAwB,EAAE,yBAAyB,CAAC;CACvD,CAAC"}

package/dist/core/provisioning/synchronizer/role/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/root/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/root/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/root/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/root/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { GraphProvisioningSynchronizer } from "./module.mjs";
+export { GraphProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/root/module.d.ts

@@ -0,0 +1,15 @@
+import type { PolicyProvisioningEntity, RealmProvisioningEntity, RoleProvisioningEntity, RootProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';
+import type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';
+import type { IProvisioningSynchronizer } from '../../types.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import type { RootProvisioningSynchronizerContext } from './types.ts';
+export declare class GraphProvisioningSynchronizer extends BaseProvisioningSynchronizer<RootProvisioningEntity> {
+    protected policySynchronizer: IProvisioningSynchronizer<PolicyProvisioningEntity>;
+    protected realmSynchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;
+    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
+    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
+    protected scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;
+    constructor(ctx: RootProvisioningSynchronizerContext);
+    synchronize(input: RootProvisioningEntity): Promise<RootProvisioningEntity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/root/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/root/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEtE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,sBAAsB,CAAC;IACnG,SAAS,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAElF,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAEhF,SAAS,CAAC,sBAAsB,EAAG,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE3F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;gBAEpE,GAAG,EAAE,mCAAmC;IAU9C,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAyBpF"}

package/dist/core/provisioning/synchronizer/root/module.mjs

@@ -0,0 +1,33 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+//#region src/core/provisioning/synchronizer/root/module.ts
+var GraphProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	policySynchronizer;
+	realmSynchronizer;
+	permissionSynchronizer;
+	roleSynchronizer;
+	scopeSynchronizer;
+	constructor(ctx) {
+		super();
+		this.policySynchronizer = ctx.policySynchronizer;
+		this.permissionSynchronizer = ctx.permissionSynchronizer;
+		this.realmSynchronizer = ctx.realmSynchronizer;
+		this.roleSynchronizer = ctx.roleSynchronizer;
+		this.scopeSynchronizer = ctx.scopeSynchronizer;
+	}
+	async synchronize(input) {
+		const output = {};
+		if (input.policies) output.policies = await this.policySynchronizer.synchronizeMany(input.policies);
+		if (input.permissions) output.permissions = await this.permissionSynchronizer.synchronizeMany(input.permissions);
+		if (input.roles) output.roles = await this.roleSynchronizer.synchronizeMany(input.roles);
+		if (input.scopes) output.scopes = await this.scopeSynchronizer.synchronizeMany(input.scopes);
+		if (input.realms) output.realms = await this.realmSynchronizer.synchronizeMany(input.realms);
+		return output;
+	}
+};
+//#endregion
+export { GraphProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/root/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["BaseProvisioningSynchronizer","GraphProvisioningSynchronizer","policySynchronizer","realmSynchronizer","permissionSynchronizer","roleSynchronizer","scopeSynchronizer","ctx","synchronize","input","output","policies","synchronizeMany","permissions","roles","scopes","realms"],"sources":["../../../../../src/core/provisioning/synchronizer/root/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    PolicyProvisioningEntity,\n    RealmProvisioningEntity,\n    RoleProvisioningEntity,\n    RootProvisioningEntity,\n    ScopeProvisioningEntity,\n} from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RootProvisioningSynchronizerContext } from './types.ts';\n\nexport class GraphProvisioningSynchronizer extends BaseProvisioningSynchronizer<RootProvisioningEntity> {\n    protected policySynchronizer: IProvisioningSynchronizer<PolicyProvisioningEntity>;\n\n    protected realmSynchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;\n\n    protected permissionSynchronizer : IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RootProvisioningSynchronizerContext) {\n        super();\n\n        this.policySynchronizer = ctx.policySynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.realmSynchronizer = ctx.realmSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RootProvisioningEntity): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        if (input.policies) {\n            output.policies = await this.policySynchronizer.synchronizeMany(input.policies);\n        }\n\n        if (input.permissions) {\n            output.permissions = await this.permissionSynchronizer.synchronizeMany(input.permissions);\n        }\n\n        if (input.roles) {\n            output.roles = await this.roleSynchronizer.synchronizeMany(input.roles);\n        }\n\n        if (input.scopes) {\n            output.scopes = await this.scopeSynchronizer.synchronizeMany(input.scopes);\n        }\n\n        if (input.realms) {\n            output.realms = await this.realmSynchronizer.synchronizeMany(input.realms);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;AAmBA,IAAaC,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKL,qBAAqBK,IAAIL;EAC9B,KAAKE,yBAAyBG,IAAIH;EAClC,KAAKD,oBAAoBI,IAAIJ;EAC7B,KAAKE,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAgE;EAC9E,MAAMC,SAAkC,CAAC;EAEzC,IAAID,MAAME,UACND,OAAOC,WAAW,MAAM,KAAKT,mBAAmBU,gBAAgBH,MAAME,QAAQ;EAGlF,IAAIF,MAAMI,aACNH,OAAOG,cAAc,MAAM,KAAKT,uBAAuBQ,gBAAgBH,MAAMI,WAAW;EAG5F,IAAIJ,MAAMK,OACNJ,OAAOI,QAAQ,MAAM,KAAKT,iBAAiBO,gBAAgBH,MAAMK,KAAK;EAG1E,IAAIL,MAAMM,QACNL,OAAOK,SAAS,MAAM,KAAKT,kBAAkBM,gBAAgBH,MAAMM,MAAM;EAG7E,IAAIN,MAAMO,QACNN,OAAOM,SAAS,MAAM,KAAKb,kBAAkBS,gBAAgBH,MAAMO,MAAM;EAG7E,OAAON;CACX;AACJ"}

package/dist/core/provisioning/synchronizer/root/types.d.ts

@@ -0,0 +1,14 @@
+import type { PolicyProvisioningEntity } from '../../entities/policy/index.ts';
+import type { ScopeProvisioningEntity } from '../../entities/scope/index.ts';
+import type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';
+import type { RealmProvisioningEntity } from '../../entities/realm/index.ts';
+import type { RoleProvisioningEntity } from '../../entities/role/index.ts';
+import type { IProvisioningSynchronizer } from '../../types.ts';
+export type RootProvisioningSynchronizerContext = {
+    policySynchronizer: IProvisioningSynchronizer<PolicyProvisioningEntity>;
+    permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
+    realmSynchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;
+    roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
+    scopeSynchronizer: IProvisioningSynchronizer<ScopeProvisioningEntity>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/root/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/root/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,mCAAmC,GAAG;IAC9C,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IACxE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAChF,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IACtE,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,iBAAiB,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;CACzE,CAAC"}

package/dist/core/provisioning/synchronizer/root/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/scope/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/scope/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/scope/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/scope/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ScopeProvisioningSynchronizer } from "./module.mjs";
+export { ScopeProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/scope/module.d.ts

@@ -0,0 +1,10 @@
+import type { IScopeRepository } from '../../../entities/index.ts';
+import type { ScopeProvisioningEntity } from '../../entities/index.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import type { ScopeProvisioningSynchronizerContext } from './types.ts';
+export declare class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {
+    protected repository: IScopeRepository;
+    constructor(ctx: ScopeProvisioningSynchronizerContext);
+    synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/scope/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;gBAE5B,GAAG,EAAE,oCAAoC;IAM/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CA8CtF"}

package/dist/core/provisioning/synchronizer/scope/module.mjs

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { pickRecord } from "@authup/kit";
+//#region src/core/provisioning/synchronizer/scope/module.ts
+var ScopeProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	repository;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+	}
+	async synchronize(input) {
+		this.canonicalizeName(input.attributes);
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.repository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null
+		});
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.repository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				attributes = this.repository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.repository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.id = attributes.id;
+				attributes = await this.repository.save(this.repository.create(input.attributes));
+				break;
+		}
+		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		return {
+			...input,
+			attributes
+		};
+	}
+};
+//#endregion
+export { ScopeProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/scope/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n    protected repository : IScopeRepository;\n\n    constructor(ctx: ScopeProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n    }\n\n    async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;EAC3C,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/scope/types.d.ts

@@ -0,0 +1,5 @@
+import type { IScopeRepository } from '../../../entities/index.ts';
+export type ScopeProvisioningSynchronizerContext = {
+    repository: IScopeRepository;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/scope/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/scope/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,MAAM,oCAAoC,GAAG;IAC/C,UAAU,EAAE,gBAAgB,CAAC;CAChC,CAAC"}

package/dist/core/provisioning/synchronizer/scope/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/user/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/user/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/user/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/synchronizer/user/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { UserProvisioningSynchronizer } from "./module.mjs";
+export { UserProvisioningSynchronizer };

package/dist/core/provisioning/synchronizer/user/module.d.ts

@@ -0,0 +1,18 @@
+import type { Permission, Role, UserPermission, UserRole } from '@authup/core-kit';
+import type { IClientRepository, IUserRepository } from '../../../entities/index.ts';
+import type { UserProvisioningEntity } from '../../entities/user/index.ts';
+import { BaseProvisioningSynchronizer } from '../base.ts';
+import { ProvisioningEntityResolver } from '../entity-resolver.ts';
+import { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';
+import type { UserProvisioningSynchronizerContext } from './types.ts';
+export declare class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {
+    protected userRepository: IUserRepository;
+    protected clientRepository: IClientRepository;
+    protected permissionResolver: ProvisioningEntityResolver<Permission>;
+    protected roleResolver: ProvisioningEntityResolver<Role>;
+    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;
+    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;
+    constructor(ctx: UserProvisioningSynchronizerContext);
+    synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/synchronizer/user/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,UAAU,EACV,IAAI,EACJ,cAAc,EACd,QAAQ,EACX,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACR,iBAAiB,EACjB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,YAAY,CAAC;AAEtE,qBAAa,4BAA6B,SAAQ,4BAA4B,CAAC,sBAAsB,CAAC;IAClG,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,cAAc,CAAC,CAAC;IAE/E,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,QAAQ,CAAC,CAAC;gBAEvD,GAAG,EAAE,mCAAmC;IAqB9C,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAiJpF"}

package/dist/core/provisioning/synchronizer/user/module.mjs

@@ -0,0 +1,106 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningEntityStrategyType } from "../../strategy/constants.mjs";
+import { normalizeEntityProvisioningStrategy } from "../../strategy/normalize.mjs";
+import "../../strategy/index.mjs";
+import { BaseProvisioningSynchronizer } from "../base.mjs";
+import { ProvisioningEntityResolver } from "../entity-resolver.mjs";
+import { ProvisioningJunctionSynchronizer } from "../junction-synchronizer.mjs";
+import { pickRecord } from "@authup/kit";
+import { buildUserFakeEmail } from "@authup/core-kit";
+//#region src/core/provisioning/synchronizer/user/module.ts
+var UserProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
+	userRepository;
+	clientRepository;
+	permissionResolver;
+	roleResolver;
+	permissionJunction;
+	roleJunction;
+	constructor(ctx) {
+		super();
+		this.userRepository = ctx.userRepository;
+		this.clientRepository = ctx.clientRepository;
+		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
+		this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);
+		this.permissionJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.userPermissionRepository,
+			ownerKey: "user_id",
+			ownerRealmKey: "user_realm_id"
+		});
+		this.roleJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.userRoleRepository,
+			ownerKey: "user_id",
+			ownerRealmKey: "user_realm_id"
+		});
+	}
+	async synchronize(input) {
+		this.canonicalizeName(input.attributes);
+		const strategy = normalizeEntityProvisioningStrategy(input.strategy);
+		let attributes = await this.userRepository.findOneBy({
+			name: input.attributes.name,
+			realm_id: input.attributes.realm_id || null
+		});
+		if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {
+			if (attributes) await this.userRepository.remove(attributes);
+			return {
+				...input,
+				attributes: attributes || input.attributes
+			};
+		}
+		if (attributes) switch (strategy.type) {
+			case ProvisioningEntityStrategyType.MERGE:
+				if (strategy.attributes && strategy.attributes.includes("email")) input.attributes.email = input.attributes.email || attributes.email || buildUserFakeEmail(input.attributes.name || attributes.name);
+				attributes = this.userRepository.merge(attributes, strategy.attributes ? pickRecord(input.attributes, strategy.attributes) : input.attributes);
+				attributes = await this.userRepository.save(attributes);
+				break;
+			case ProvisioningEntityStrategyType.REPLACE:
+				input.attributes.email = input.attributes.email || attributes.email || (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : void 0);
+				input.attributes.id = attributes.id;
+				attributes = await this.userRepository.save(this.userRepository.create(input.attributes));
+				break;
+		}
+		else {
+			if (!input.attributes.email && input.attributes.name) input.attributes.email = buildUserFakeEmail(input.attributes.name);
+			attributes = await this.userRepository.save(this.userRepository.create(input.attributes));
+		}
+		const permissions = [...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions), ...attributes.realm_id ? await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realm_id) : []];
+		if (input.relations && input.relations.clientPermissions) {
+			const clientKeys = Object.keys(input.relations.clientPermissions);
+			for (const clientKey of clientKeys) {
+				const client = await this.clientRepository.findOneBy({
+					name: clientKey,
+					realm_id: attributes.realm_id
+				});
+				if (client) {
+					const entities = await this.permissionResolver.resolveClient(input.relations.clientPermissions[clientKey], attributes.realm_id, client.id);
+					permissions.push(...entities);
+				}
+			}
+		}
+		if (permissions.length > 0) await this.permissionJunction.synchronize(attributes, permissions, "permission_id", "permission_realm_id");
+		const roles = [...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles), ...attributes.realm_id ? await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realm_id) : []];
+		if (input.relations && input.relations.clientRoles) {
+			const clientKeys = Object.keys(input.relations.clientRoles);
+			for (const clientKey of clientKeys) {
+				const client = await this.clientRepository.findOneBy({
+					name: clientKey,
+					realm_id: attributes.realm_id
+				});
+				if (client) {
+					const entities = await this.roleResolver.resolveClient(input.relations.clientRoles[clientKey], attributes.realm_id, client.id);
+					roles.push(...entities);
+				}
+			}
+		}
+		if (roles.length > 0) await this.roleJunction.synchronize(attributes, roles, "role_id", "role_realm_id");
+		return {
+			...input,
+			attributes
+		};
+	}
+};
+//#endregion
+export { UserProvisioningSynchronizer };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/synchronizer/user/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;EAC3C,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWI,WACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWI,WACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}