@authup/server-core 1.0.0-beta.50 → 1.0.0-beta.52

package/dist/adapters/database/domains/user-permission/entity.d.ts

@@ -1,10 +1,11 @@
-import type { Permission, Policy, Realm, User, UserPermission } from '@authup/core-kit';
+import type { Permission, Policy, Realm, RealmScopeValue, User, UserPermission } from '@authup/core-kit';
 export declare class UserPermissionEntity implements UserPermission {
     id: string;
     created_at: string;
     updated_at: string;
     policy_id: string | null;
     policy: Policy | null;
+    realm_scope: RealmScopeValue;
     user_id: User['id'];
     user: User;
     user_realm_id: Realm['id'] | null;

package/dist/adapters/database/domains/user-permission/entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/domains/user-permission/entity.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,KAAK,EACL,IAAI,EACJ,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAM1B,qBAEa,oBAAqB,YAAW,cAAc;IAEvD,EAAE,EAAE,MAAM,CAAC;IAKX,UAAU,EAAE,MAAM,CAAC;IAGnB,UAAU,EAAE,MAAM,CAAC;IAKnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAOzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAGtB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAIpB,IAAI,EAAE,IAAI,CAAC;IAGX,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAOlC,UAAU,EAAE,KAAK,GAAG,IAAI,CAAC;IAGzB,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAIhC,UAAU,EAAE,UAAU,CAAC;IAGvB,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAOxC,gBAAgB,EAAE,KAAK,GAAG,IAAI,CAAC;CAClC"}
+{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/domains/user-permission/entity.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,KAAK,EACL,eAAe,EACf,IAAI,EACJ,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAM1B,qBAEa,oBAAqB,YAAW,cAAc;IAEvD,EAAE,EAAE,MAAM,CAAC;IAKX,UAAU,EAAE,MAAM,CAAC;IAGnB,UAAU,EAAE,MAAM,CAAC;IAKnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAOzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAOtB,WAAW,EAAE,eAAe,CAAC;IAG7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAIpB,IAAI,EAAE,IAAI,CAAC;IAGX,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAOlC,UAAU,EAAE,KAAK,GAAG,IAAI,CAAC;IAGzB,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAIhC,UAAU,EAAE,UAAU,CAAC;IAGvB,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAOxC,gBAAgB,EAAE,KAAK,GAAG,IAAI,CAAC;CAClC"}

package/dist/adapters/database/domains/user-permission/entity.mjs

@@ -26,6 +26,7 @@ var UserPermissionEntity = class {
 	updated_at;
 	policy_id;
 	policy;
+	realm_scope;
 	user_id;
 	user;
 	user_realm_id;
@@ -47,6 +48,11 @@ _ts_decorate([
 	JoinColumn({ name: "policy_id" }),
 	_ts_metadata("design:type", Object)
 ], UserPermissionEntity.prototype, "policy", void 0);
+_ts_decorate([Column({
+	type: "varchar",
+	length: 50,
+	default: "own"
+}), _ts_metadata("design:type", typeof RealmScopeValue === "undefined" ? Object : RealmScopeValue)], UserPermissionEntity.prototype, "realm_scope", void 0);
 _ts_decorate([Column(), _ts_metadata("design:type", Object)], UserPermissionEntity.prototype, "user_id", void 0);
 _ts_decorate([
 	ManyToOne(() => UserEntity, { onDelete: "CASCADE" }),

package/dist/adapters/database/domains/user-permission/entity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity.mjs","names":["Column","CreateDateColumn","Entity","Index","JoinColumn","ManyToOne","PrimaryGeneratedColumn","UpdateDateColumn","dateToISOStringTransformer","PolicyEntity","UserEntity","PermissionEntity","RealmEntity","UserPermissionEntity","id","created_at","updated_at","policy_id","policy","user_id","user","user_realm_id","user_realm","permission_id","permission","permission_realm_id","permission_realm","transformer","nullable","onDelete","name","unique"],"sources":["../../../../../src/adapters/database/domains/user-permission/entity.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2021.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    Column,\n    CreateDateColumn,\n    Entity, \n    Index,\n    JoinColumn,\n    ManyToOne,\n    PrimaryGeneratedColumn,\n    UpdateDateColumn,\n} from 'typeorm';\nimport { dateToISOStringTransformer } from '../../helpers/index.ts';\nimport type {\n    Permission,\n    Policy,\n    Realm,\n    User, \n    UserPermission,\n} from '@authup/core-kit';\nimport { PolicyEntity } from '../policy/index.ts';\nimport { UserEntity } from '../user/entity.ts';\nimport { PermissionEntity } from '../permission/entity.ts';\nimport { RealmEntity } from '../realm/index.ts';\n\n@Entity({ name: 'auth_user_permissions' })\n@Index(['permission_id', 'user_id'], { unique: true })\nexport class UserPermissionEntity implements UserPermission {\n    @PrimaryGeneratedColumn('uuid')\n    id: string;\n\n    // ------------------------------------------------------------------\n\n    @CreateDateColumn({ transformer: dateToISOStringTransformer })\n    created_at: string;\n\n    @UpdateDateColumn({ transformer: dateToISOStringTransformer })\n    updated_at: string;\n\n    // ------------------------------------------------------------------\n\n    @Column({ nullable: true })\n    policy_id: string | null;\n\n    @ManyToOne(() => PolicyEntity, {\n        onDelete: 'SET NULL',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'policy_id' })\n    policy: Policy | null;\n\n    @Column()\n    user_id: User['id'];\n\n    @ManyToOne(() => UserEntity, { onDelete: 'CASCADE' })\n    @JoinColumn({ name: 'user_id' })\n    user: User;\n\n    @Column({ nullable: true })\n    user_realm_id: Realm['id'] | null;\n\n    @ManyToOne(() => RealmEntity, {\n        onDelete: 'CASCADE',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'user_realm_id' })\n    user_realm: Realm | null;\n\n    @Column()\n    permission_id: Permission['id'];\n\n    @ManyToOne(() => PermissionEntity, { onDelete: 'CASCADE' })\n    @JoinColumn({ name: 'permission_id' })\n    permission: Permission;\n\n    @Column({ nullable: true })\n    permission_realm_id: Realm['id'] | null;\n\n    @ManyToOne(() => RealmEntity, {\n        onDelete: 'CASCADE',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'permission_realm_id' })\n    permission_realm: Realm | null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAaa,uBAAb,MAAaA;CAETC;CAKAC;CAGAC;CAKAC;CAOAC;CAGAC;CAIAC;CAGAC;CAOAC;CAGAC;CAIAC;CAGAC;CAOAC;AACJ;;iCAnDwBC,aAAanB,2BAAAA,CAAAA,GAAAA,aAAAA,eAAAA,MAAAA,CAAAA,GAAAA,qBAAAA,WAAAA,cAAAA,KAAAA,CAAAA;iCAGbmB,aAAanB,2BAAAA,CAAAA,GAAAA,aAAAA,eAAAA,MAAAA,CAAAA,GAAAA,qBAAAA,WAAAA,cAAAA,KAAAA,CAAAA;uBAKvBoB,UAAU,KAAA,CAAA,GAAA,aAAA,eAAA,MAAA,CAAA,GAAA,qBAAA,WAAA,aAAA,KAAA,CAAA;;iBAGHnB,cAAAA;EACboB,UAAU;EACVD,UAAU;;cAEAE,MAAM,YAAA,CAAA;;;;;iBAMHpB,YAAAA,EAAcmB,UAAU,UAAA,CAAA;cAC3BC,MAAM,UAAA,CAAA;;;uBAGVF,UAAU,KAAA,CAAA,GAAA,aAAA,eAAA,MAAA,CAAA,GAAA,qBAAA,WAAA,iBAAA,KAAA,CAAA;;iBAGHhB,aAAAA;EACbiB,UAAU;EACVD,UAAU;;cAEAE,MAAM,gBAAA,CAAA;;;;;iBAMHnB,kBAAAA,EAAoBkB,UAAU,UAAA,CAAA;cACjCC,MAAM,gBAAA,CAAA;;;uBAGVF,UAAU,KAAA,CAAA,GAAA,aAAA,eAAA,MAAA,CAAA,GAAA,qBAAA,WAAA,uBAAA,KAAA,CAAA;;iBAGHhB,aAAAA;EACbiB,UAAU;EACVD,UAAU;;cAEAE,MAAM,sBAAA,CAAA;;;8CAzDdA,MAAM,wBAAA,CAAA,GAAA,MAAA,CACR,iBAAiB,SAAA,GAAA,EAAcC,QAAQ,KAAA,CAAA,CAAA,GAAA,oBAAA"}
+{"version":3,"file":"entity.mjs","names":["Column","CreateDateColumn","Entity","Index","JoinColumn","ManyToOne","PrimaryGeneratedColumn","UpdateDateColumn","dateToISOStringTransformer","PolicyEntity","UserEntity","PermissionEntity","RealmEntity","UserPermissionEntity","id","created_at","updated_at","policy_id","policy","realm_scope","user_id","user","user_realm_id","user_realm","permission_id","permission","permission_realm_id","permission_realm","transformer","nullable","onDelete","name","type","length","default","unique"],"sources":["../../../../../src/adapters/database/domains/user-permission/entity.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2021.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    Column,\n    CreateDateColumn,\n    Entity, \n    Index,\n    JoinColumn,\n    ManyToOne,\n    PrimaryGeneratedColumn,\n    UpdateDateColumn,\n} from 'typeorm';\nimport { dateToISOStringTransformer } from '../../helpers/index.ts';\nimport type {\n    Permission,\n    Policy,\n    Realm,\n    RealmScopeValue,\n    User,\n    UserPermission,\n} from '@authup/core-kit';\nimport { PolicyEntity } from '../policy/index.ts';\nimport { UserEntity } from '../user/entity.ts';\nimport { PermissionEntity } from '../permission/entity.ts';\nimport { RealmEntity } from '../realm/index.ts';\n\n@Entity({ name: 'auth_user_permissions' })\n@Index(['permission_id', 'user_id'], { unique: true })\nexport class UserPermissionEntity implements UserPermission {\n    @PrimaryGeneratedColumn('uuid')\n    id: string;\n\n    // ------------------------------------------------------------------\n\n    @CreateDateColumn({ transformer: dateToISOStringTransformer })\n    created_at: string;\n\n    @UpdateDateColumn({ transformer: dateToISOStringTransformer })\n    updated_at: string;\n\n    // ------------------------------------------------------------------\n\n    @Column({ nullable: true })\n    policy_id: string | null;\n\n    @ManyToOne(() => PolicyEntity, {\n        onDelete: 'SET NULL',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'policy_id' })\n    policy: Policy | null;\n\n    @Column({\n        type: 'varchar',\n        length: 50,\n        default: 'own',\n    })\n    realm_scope: RealmScopeValue;\n\n    @Column()\n    user_id: User['id'];\n\n    @ManyToOne(() => UserEntity, { onDelete: 'CASCADE' })\n    @JoinColumn({ name: 'user_id' })\n    user: User;\n\n    @Column({ nullable: true })\n    user_realm_id: Realm['id'] | null;\n\n    @ManyToOne(() => RealmEntity, {\n        onDelete: 'CASCADE',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'user_realm_id' })\n    user_realm: Realm | null;\n\n    @Column()\n    permission_id: Permission['id'];\n\n    @ManyToOne(() => PermissionEntity, { onDelete: 'CASCADE' })\n    @JoinColumn({ name: 'permission_id' })\n    permission: Permission;\n\n    @Column({ nullable: true })\n    permission_realm_id: Realm['id'] | null;\n\n    @ManyToOne(() => RealmEntity, {\n        onDelete: 'CASCADE',\n        nullable: true, \n    })\n    @JoinColumn({ name: 'permission_realm_id' })\n    permission_realm: Realm | null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAaa,uBAAb,MAAaA;CAETC;CAKAC;CAGAC;CAKAC;CAOAC;CAOAC;CAGAC;CAIAC;CAGAC;CAOAC;CAGAC;CAIAC;CAGAC;CAOAC;AACJ;;iCA1DwBC,aAAapB,2BAAAA,CAAAA,GAAAA,aAAAA,eAAAA,MAAAA,CAAAA,GAAAA,qBAAAA,WAAAA,cAAAA,KAAAA,CAAAA;iCAGboB,aAAapB,2BAAAA,CAAAA,GAAAA,aAAAA,eAAAA,MAAAA,CAAAA,GAAAA,qBAAAA,WAAAA,cAAAA,KAAAA,CAAAA;uBAKvBqB,UAAU,KAAA,CAAA,GAAA,aAAA,eAAA,MAAA,CAAA,GAAA,qBAAA,WAAA,aAAA,KAAA,CAAA;;iBAGHpB,cAAAA;EACbqB,UAAU;EACVD,UAAU;;cAEAE,MAAM,YAAA,CAAA;;;;CAIhBC,MAAM;CACNC,QAAQ;CACRC,SAAS;;;;iBAOIxB,YAAAA,EAAcoB,UAAU,UAAA,CAAA;cAC3BC,MAAM,UAAA,CAAA;;;uBAGVF,UAAU,KAAA,CAAA,GAAA,aAAA,eAAA,MAAA,CAAA,GAAA,qBAAA,WAAA,iBAAA,KAAA,CAAA;;iBAGHjB,aAAAA;EACbkB,UAAU;EACVD,UAAU;;cAEAE,MAAM,gBAAA,CAAA;;;;;iBAMHpB,kBAAAA,EAAoBmB,UAAU,UAAA,CAAA;cACjCC,MAAM,gBAAA,CAAA;;;uBAGVF,UAAU,KAAA,CAAA,GAAA,aAAA,eAAA,MAAA,CAAA,GAAA,qBAAA,WAAA,uBAAA,KAAA,CAAA;;iBAGHjB,aAAAA;EACbkB,UAAU;EACVD,UAAU;;cAEAE,MAAM,sBAAA,CAAA;;;8CAhEdA,MAAM,wBAAA,CAAA,GAAA,MAAA,CACR,iBAAiB,SAAA,GAAA,EAAcI,QAAQ,KAAA,CAAA,CAAA,GAAA,oBAAA"}

package/dist/adapters/database/index.mjs

@@ -51,6 +51,7 @@ import { IdentityProviderRoleSubscriber } from "./domains/identity-provider-role
 import { RobotEntity } from "./domains/robot/entity.mjs";
 import { RobotSubscriber } from "./domains/robot/subscriber.mjs";
 import { SessionEntity } from "./domains/session/entity.mjs";
+import { SessionTokenEntity } from "./domains/session-token/entity.mjs";
 import { PermissionPolicyEntity } from "./domains/permission-policy/entity.mjs";
 import { RobotPermissionEntity } from "./domains/robot-permission/entity.mjs";
 import { RobotPermissionSubscriber } from "./domains/robot-permission/subscriber.mjs";
@@ -70,4 +71,4 @@ import { DataSourceOptionsBuilder } from "./data-source/options/module.mjs";
 import "./data-source/index.mjs";
 import { DatabaseConflictError } from "./errors/conflict.mjs";
 import "./errors/index.mjs";
-export { CachePrefix, ClientEntity, ClientPermissionEntity, ClientPermissionSubscriber, ClientRoleEntity, ClientRoleSubscriber, ClientScopeEntity, ClientScopeSubscriber, ClientSubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseQueryResultCache, EntitySubscriber, IdentityProviderAccountEntity, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeSubscriber, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderRepository, IdentityProviderRoleMappingEntity, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, KeyEntity, PermissionEntity, PermissionPolicyEntity, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyEntity, PolicyRepository, PolicySubscriber, RealmEntity, RealmRepository, RealmSubscriber, RobotEntity, RobotPermissionEntity, RobotPermissionSubscriber, RobotRoleEntity, RobotRoleSubscriber, RobotSubscriber, RoleAttributeEntity, RoleAttributeSubscriber, RoleEntity, RolePermissionEntity, RolePermissionSubscriber, RoleRepository, RoleSubscriber, ScopeEntity, ScopeSubscriber, SessionEntity, UserAttributeEntity, UserAttributeSubscriber, UserEntity, UserPermissionEntity, UserPermissionSubscriber, UserRepository, UserRoleEntity, UserRoleSubscriber, UserSubscriber, buildEntityDestinations, dateToISOStringTransformer, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment };
+export { CachePrefix, ClientEntity, ClientPermissionEntity, ClientPermissionSubscriber, ClientRoleEntity, ClientRoleSubscriber, ClientScopeEntity, ClientScopeSubscriber, ClientSubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseQueryResultCache, EntitySubscriber, IdentityProviderAccountEntity, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeSubscriber, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderRepository, IdentityProviderRoleMappingEntity, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, KeyEntity, PermissionEntity, PermissionPolicyEntity, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyEntity, PolicyRepository, PolicySubscriber, RealmEntity, RealmRepository, RealmSubscriber, RobotEntity, RobotPermissionEntity, RobotPermissionSubscriber, RobotRoleEntity, RobotRoleSubscriber, RobotSubscriber, RoleAttributeEntity, RoleAttributeSubscriber, RoleEntity, RolePermissionEntity, RolePermissionSubscriber, RoleRepository, RoleSubscriber, ScopeEntity, ScopeSubscriber, SessionEntity, SessionTokenEntity, UserAttributeEntity, UserAttributeSubscriber, UserEntity, UserPermissionEntity, UserPermissionSubscriber, UserRepository, UserRoleEntity, UserRoleSubscriber, UserSubscriber, buildEntityDestinations, dateToISOStringTransformer, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment };

package/dist/adapters/database/migrations/mysql/1779300000000-Default.d.ts

@@ -0,0 +1,7 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class Default1779300000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1779300000000-Default.d.ts.map

package/dist/adapters/database/migrations/mysql/1779300000000-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1779300000000-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1779300000000-Default.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AA4C/D,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA8C3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAO7D"}

package/dist/adapters/database/migrations/mysql/1779300000000-Default.mjs

@@ -0,0 +1,85 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1779300000000-Default.ts
+/**
+* realm_scope enum on the four permission-junction tables (fail-closed realm scoping).
+*
+* Adds the coarse, actor-relative `realm_scope` column (default 'own') and migrates the
+* realm-scoping that previously lived in policies into the column. The redundant system
+* realm policies (`system.realm-match` child of `system.default`,
+* `system.realm-bound`, `system.realm-or-global`) are deleted here as a deterministic
+* safety net; the provisioner ALSO prunes them on boot (cleanupStaleChildren for the
+* realm-match child + the top-level stale-prune), so a fresh install needs no migration.
+*
+* up() ordering is LOAD-BEARING: schema -> convert-by-policy-name -> lift-admin ->
+* delete policy rows (the policy-name joins must resolve before the rows are deleted).
+*
+* BREAKING (existing data): only admin (-> any, matched by role name) and realm_admin
+* (its realm-or-global / realm-bound junction policies -> ownOrNull / own) are converted.
+* Every OTHER pre-existing grant with no realm policy keeps the 'own' default, so a custom
+* role or a direct identity grant that previously reached global (realm_id = null) building
+* blocks via the old system.realm-match baseline is now fail-closed to its own realm. Those
+* grants must be re-widened to ownOrNull/any by hand: there is deliberately no automatic
+* bump, because a policy-less grant that managed global resources is indistinguishable in
+* the data from one that only ever acted on its own realm (auto-widening would fail open).
+*
+* down() is BEST-EFFORT and NOT a true inverse: it drops the column only. The deleted
+* system policies and the nulled junction policy_id pointers are NOT reconstructed, and
+* boot re-provisioning does NOT repair them either -- the junction synchronizer is
+* create-only (it never rewrites realm_scope/policy_id on an already-existing row). So a
+* revert (or revert + re-run) on a POPULATED database permanently pins realm_admin and any
+* converted grant to the fail-closed 'own' default until fixed by hand; a forward-only
+* upgrade is unaffected.
+*/ const JUNCTION_TABLES = [
+	"auth_role_permissions",
+	"auth_user_permissions",
+	"auth_client_permissions",
+	"auth_robot_permissions"
+];
+const SCOPE_BY_POLICY = [{
+	policy: "system.realm-or-global",
+	scope: "ownOrNull"
+}, {
+	policy: "system.realm-bound",
+	scope: "own"
+}];
+var Default1779300000000 = class {
+	name = "Default1779300000000";
+	async up(queryRunner) {
+		for (const table of JUNCTION_TABLES) await queryRunner.query(`
+                ALTER TABLE \`${table}\`
+                ADD \`realm_scope\` varchar(50) NOT NULL DEFAULT 'own'
+            `);
+		for (const table of JUNCTION_TABLES) for (const { policy, scope } of SCOPE_BY_POLICY) await queryRunner.query(`
+                    UPDATE \`${table}\` rp
+                    JOIN \`auth_policies\` p ON rp.\`policy_id\` = p.\`id\`
+                    SET rp.\`realm_scope\` = '${scope}', rp.\`policy_id\` = NULL
+                    WHERE p.\`name\` = '${policy}'
+                      AND p.\`built_in\` = 1
+                      AND p.\`realm_id\` IS NULL
+                `);
+		await queryRunner.query(`
+            UPDATE \`auth_role_permissions\` rp
+            JOIN \`auth_roles\` r ON rp.\`role_id\` = r.\`id\`
+            SET rp.\`realm_scope\` = 'any'
+            WHERE r.\`name\` = 'admin'
+              AND r.\`built_in\` = 1
+        `);
+		await queryRunner.query(`
+            DELETE FROM \`auth_policies\`
+            WHERE \`name\` IN ('system.realm-match', 'system.realm-bound', 'system.realm-or-global')
+              AND \`built_in\` = 1
+              AND \`realm_id\` IS NULL
+        `);
+	}
+	async down(queryRunner) {
+		for (const table of JUNCTION_TABLES) await queryRunner.query(`
+                ALTER TABLE \`${table}\` DROP COLUMN \`realm_scope\`
+            `);
+	}
+};
+//#endregion
+export { Default1779300000000 };
+
+//# sourceMappingURL=1779300000000-Default.mjs.map

package/dist/adapters/database/migrations/mysql/1779300000000-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1779300000000-Default.mjs","names":["JUNCTION_TABLES","SCOPE_BY_POLICY","policy","scope","Default1779300000000","name","up","queryRunner","table","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1779300000000-Default.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * realm_scope enum on the four permission-junction tables (fail-closed realm scoping).\n *\n * Adds the coarse, actor-relative `realm_scope` column (default 'own') and migrates the\n * realm-scoping that previously lived in policies into the column. The redundant system\n * realm policies (`system.realm-match` child of `system.default`,\n * `system.realm-bound`, `system.realm-or-global`) are deleted here as a deterministic\n * safety net; the provisioner ALSO prunes them on boot (cleanupStaleChildren for the\n * realm-match child + the top-level stale-prune), so a fresh install needs no migration.\n *\n * up() ordering is LOAD-BEARING: schema -> convert-by-policy-name -> lift-admin ->\n * delete policy rows (the policy-name joins must resolve before the rows are deleted).\n *\n * BREAKING (existing data): only admin (-> any, matched by role name) and realm_admin\n * (its realm-or-global / realm-bound junction policies -> ownOrNull / own) are converted.\n * Every OTHER pre-existing grant with no realm policy keeps the 'own' default, so a custom\n * role or a direct identity grant that previously reached global (realm_id = null) building\n * blocks via the old system.realm-match baseline is now fail-closed to its own realm. Those\n * grants must be re-widened to ownOrNull/any by hand: there is deliberately no automatic\n * bump, because a policy-less grant that managed global resources is indistinguishable in\n * the data from one that only ever acted on its own realm (auto-widening would fail open).\n *\n * down() is BEST-EFFORT and NOT a true inverse: it drops the column only. The deleted\n * system policies and the nulled junction policy_id pointers are NOT reconstructed, and\n * boot re-provisioning does NOT repair them either -- the junction synchronizer is\n * create-only (it never rewrites realm_scope/policy_id on an already-existing row). So a\n * revert (or revert + re-run) on a POPULATED database permanently pins realm_admin and any\n * converted grant to the fail-closed 'own' default until fixed by hand; a forward-only\n * upgrade is unaffected.\n */\nconst JUNCTION_TABLES = [\n    'auth_role_permissions',\n    'auth_user_permissions',\n    'auth_client_permissions',\n    'auth_robot_permissions',\n];\n\nconst SCOPE_BY_POLICY: { policy: string, scope: string }[] = [\n    { policy: 'system.realm-or-global', scope: 'ownOrNull' },\n    { policy: 'system.realm-bound', scope: 'own' },\n];\n\nexport class Default1779300000000 implements MigrationInterface {\n    name = 'Default1779300000000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        // 1. schema\n        for (const table of JUNCTION_TABLES) {\n            await queryRunner.query(`\n                ALTER TABLE \\`${table}\\`\n                ADD \\`realm_scope\\` varchar(50) NOT NULL DEFAULT 'own'\n            `);\n        }\n\n        // 2. convert the realm-scoping policies into the enum (clearing only those\n        //    policy_id pointers; non-realm policies are preserved).\n        for (const table of JUNCTION_TABLES) {\n            for (const { policy, scope } of SCOPE_BY_POLICY) {\n                await queryRunner.query(`\n                    UPDATE \\`${table}\\` rp\n                    JOIN \\`auth_policies\\` p ON rp.\\`policy_id\\` = p.\\`id\\`\n                    SET rp.\\`realm_scope\\` = '${scope}', rp.\\`policy_id\\` = NULL\n                    WHERE p.\\`name\\` = '${policy}'\n                      AND p.\\`built_in\\` = 1\n                      AND p.\\`realm_id\\` IS NULL\n                `);\n            }\n        }\n\n        // 3. lift admin-role grants to unrestricted (admin grants carry no policy, so\n        //    they are unreachable by the policy join above — join by role name instead).\n        await queryRunner.query(`\n            UPDATE \\`auth_role_permissions\\` rp\n            JOIN \\`auth_roles\\` r ON rp.\\`role_id\\` = r.\\`id\\`\n            SET rp.\\`realm_scope\\` = 'any'\n            WHERE r.\\`name\\` = 'admin'\n              AND r.\\`built_in\\` = 1\n        `);\n\n        // 4. delete the three now-redundant system realm policies (by exact name —\n        //    never by type, which would wipe user-defined realm-match policies).\n        //    A cascading closure-tree FK detaches the realm-match child from\n        //    system.default; the provisioner re-prunes idempotently on boot.\n        await queryRunner.query(`\n            DELETE FROM \\`auth_policies\\`\n            WHERE \\`name\\` IN ('system.realm-match', 'system.realm-bound', 'system.realm-or-global')\n              AND \\`built_in\\` = 1\n              AND \\`realm_id\\` IS NULL\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        for (const table of JUNCTION_TABLES) {\n            await queryRunner.query(`\n                ALTER TABLE \\`${table}\\` DROP COLUMN \\`realm_scope\\`\n            `);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCA,MAAMA,kBAAkB;CACpB;CACA;CACA;CACA;;AAGJ,MAAMC,kBAAuD,CACzD;CAAEC,QAAQ;CAA0BC,OAAO;AAAY,GACvD;CAAED,QAAQ;CAAsBC,OAAO;AAAM,CAAA;AAGjD,IAAaC,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EAErD,KAAK,MAAMC,SAASR,iBAChB,MAAMO,YAAYE,MAAM;gCACJD,MAAM;;aAEzB;EAKL,KAAK,MAAMA,SAASR,iBAChB,KAAK,MAAM,EAAEE,QAAQC,WAAWF,iBAC5B,MAAMM,YAAYE,MAAM;+BACTD,MAAM;;gDAEWL,MAAM;0CACZD,OAAO;;;iBAGhC;EAMT,MAAMK,YAAYE,MAAM;;;;;;SAMvB;EAMD,MAAMF,YAAYE,MAAM;;;;;SAKvB;CACL;CAEA,MAAaC,KAAKH,aAAyC;EACvD,KAAK,MAAMC,SAASR,iBAChB,MAAMO,YAAYE,MAAM;gCACJD,MAAM;aACzB;CAET;AACJ"}

package/dist/adapters/database/migrations/mysql/1783325495597-Default.d.ts

@@ -0,0 +1,28 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Refresh token rotation + replay detection (plan 016).
+ *
+ * - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was
+ *   IPv4-only, a latent truncation bug).
+ * - Adds auth_session_tokens: one durable row per issued access/refresh token,
+ *   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for
+ *   refresh-token validity (consume/replay/revoke); the cache stays the
+ *   verification fast-path.
+ *
+ * BREAKING: at deploy the table is empty, so every in-flight refresh token has
+ * no row and its first refresh returns invalid_grant — active users
+ * re-authenticate once (hard cutover, RT horizon 3 days).
+ *
+ * down() narrows ip_address back to 15, which fails if any IPv6 value was
+ * stored (best-effort, per the 1779300000000 precedent).
+ *
+ * Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated
+ * OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.
+ * Folded into this still-unreleased migration rather than a new file.
+ */
+export declare class Default1783325495597 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1783325495597-Default.d.ts.map

package/dist/adapters/database/migrations/mysql/1783325495597-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783325495597-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1783325495597-Default.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB7D"}

package/dist/adapters/database/migrations/mysql/1783325495597-Default.mjs

@@ -0,0 +1,85 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1783325495597-Default.ts
+/**
+* Refresh token rotation + replay detection (plan 016).
+*
+* - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was
+*   IPv4-only, a latent truncation bug).
+* - Adds auth_session_tokens: one durable row per issued access/refresh token,
+*   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for
+*   refresh-token validity (consume/replay/revoke); the cache stays the
+*   verification fast-path.
+*
+* BREAKING: at deploy the table is empty, so every in-flight refresh token has
+* no row and its first refresh returns invalid_grant — active users
+* re-authenticate once (hard cutover, RT horizon 3 days).
+*
+* down() narrows ip_address back to 15, which fails if any IPv6 value was
+* stored (best-effort, per the 1779300000000 precedent).
+*
+* Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated
+* OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.
+* Folded into this still-unreleased migration rather than a new file.
+*/ var Default1783325495597 = class {
+	name = "Default1783325495597";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` MODIFY \`ip_address\` varchar(45) NOT NULL
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_session_tokens\` (
+                \`id\` varchar(36) NOT NULL,
+                \`session_id\` varchar(36) NOT NULL,
+                \`kind\` varchar(16) NOT NULL,
+                \`parent_id\` varchar(36) NULL,
+                \`refresh_token_id\` varchar(36) NULL,
+                \`ip_address\` varchar(45) NOT NULL,
+                \`user_agent\` varchar(512) NOT NULL,
+                \`consumed_at\` varchar(28) NULL,
+                \`revoked_at\` varchar(28) NULL,
+                \`expires_at\` varchar(28) NOT NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                INDEX \`IDX_auth_session_tokens_session_id\` (\`session_id\`),
+                INDEX \`IDX_auth_session_tokens_kind\` (\`kind\`),
+                INDEX \`IDX_auth_session_tokens_expires_at\` (\`expires_at\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_session_tokens\`
+            ADD CONSTRAINT \`FK_auth_session_tokens_session_id\` FOREIGN KEY (\`session_id\`) REFERENCES \`auth_sessions\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`post_logout_redirect_uri\` text NULL
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`post_logout_redirect_uri\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_session_tokens\` DROP FOREIGN KEY \`FK_auth_session_tokens_session_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_session_tokens_expires_at\` ON \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_session_tokens_kind\` ON \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_session_tokens_session_id\` ON \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_session_tokens\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` MODIFY \`ip_address\` varchar(15) NOT NULL
+        `);
+	}
+};
+//#endregion
+export { Default1783325495597 };
+
+//# sourceMappingURL=1783325495597-Default.mjs.map

package/dist/adapters/database/migrations/mysql/1783325495597-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783325495597-Default.mjs","names":["Default1783325495597","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1783325495597-Default.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Refresh token rotation + replay detection (plan 016).\n *\n * - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was\n *   IPv4-only, a latent truncation bug).\n * - Adds auth_session_tokens: one durable row per issued access/refresh token,\n *   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for\n *   refresh-token validity (consume/replay/revoke); the cache stays the\n *   verification fast-path.\n *\n * BREAKING: at deploy the table is empty, so every in-flight refresh token has\n * no row and its first refresh returns invalid_grant — active users\n * re-authenticate once (hard cutover, RT horizon 3 days).\n *\n * down() narrows ip_address back to 15, which fails if any IPv6 value was\n * stored (best-effort, per the 1779300000000 precedent).\n *\n * Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated\n * OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.\n * Folded into this still-unreleased migration rather than a new file.\n */\nexport class Default1783325495597 implements MigrationInterface {\n    name = 'Default1783325495597';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` MODIFY \\`ip_address\\` varchar(45) NOT NULL\n        `);\n\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_session_tokens\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`session_id\\` varchar(36) NOT NULL,\n                \\`kind\\` varchar(16) NOT NULL,\n                \\`parent_id\\` varchar(36) NULL,\n                \\`refresh_token_id\\` varchar(36) NULL,\n                \\`ip_address\\` varchar(45) NOT NULL,\n                \\`user_agent\\` varchar(512) NOT NULL,\n                \\`consumed_at\\` varchar(28) NULL,\n                \\`revoked_at\\` varchar(28) NULL,\n                \\`expires_at\\` varchar(28) NOT NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                INDEX \\`IDX_auth_session_tokens_session_id\\` (\\`session_id\\`),\n                INDEX \\`IDX_auth_session_tokens_kind\\` (\\`kind\\`),\n                INDEX \\`IDX_auth_session_tokens_expires_at\\` (\\`expires_at\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_session_tokens\\`\n            ADD CONSTRAINT \\`FK_auth_session_tokens_session_id\\` FOREIGN KEY (\\`session_id\\`) REFERENCES \\`auth_sessions\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // Dedicated post-logout redirect allow-list for OIDC RP-Initiated\n        // Logout (plan 042) — no longer conflated with the login redirect_uri.\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`post_logout_redirect_uri\\` text NULL\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`post_logout_redirect_uri\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_session_tokens\\` DROP FOREIGN KEY \\`FK_auth_session_tokens_session_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_session_tokens_expires_at\\` ON \\`auth_session_tokens\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_session_tokens_kind\\` ON \\`auth_session_tokens\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_session_tokens_session_id\\` ON \\`auth_session_tokens\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_session_tokens\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` MODIFY \\`ip_address\\` varchar(15) NOT NULL\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;GAuBA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;SAkBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EAID,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;CACL;AACJ"}

package/dist/adapters/database/migrations/postgres/1779300000000-Default.d.ts

@@ -0,0 +1,7 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class Default1779300000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1779300000000-Default.d.ts.map

package/dist/adapters/database/migrations/postgres/1779300000000-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1779300000000-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1779300000000-Default.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AA4C/D,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAO7D"}

package/dist/adapters/database/migrations/postgres/1779300000000-Default.mjs

@@ -0,0 +1,87 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1779300000000-Default.ts
+/**
+* realm_scope enum on the four permission-junction tables (fail-closed realm scoping).
+*
+* Adds the coarse, actor-relative `realm_scope` column (default 'own') and migrates the
+* realm-scoping that previously lived in policies into the column. The redundant system
+* realm policies (`system.realm-match` child of `system.default`,
+* `system.realm-bound`, `system.realm-or-global`) are deleted here as a deterministic
+* safety net; the provisioner ALSO prunes them on boot (cleanupStaleChildren for the
+* realm-match child + the top-level stale-prune), so a fresh install needs no migration.
+*
+* up() ordering is LOAD-BEARING: schema -> convert-by-policy-name -> lift-admin ->
+* delete policy rows (the policy-name joins must resolve before the rows are deleted).
+*
+* BREAKING (existing data): only admin (-> any, matched by role name) and realm_admin
+* (its realm-or-global / realm-bound junction policies -> ownOrNull / own) are converted.
+* Every OTHER pre-existing grant with no realm policy keeps the 'own' default, so a custom
+* role or a direct identity grant that previously reached global (realm_id = null) building
+* blocks via the old system.realm-match baseline is now fail-closed to its own realm. Those
+* grants must be re-widened to ownOrNull/any by hand: there is deliberately no automatic
+* bump, because a policy-less grant that managed global resources is indistinguishable in
+* the data from one that only ever acted on its own realm (auto-widening would fail open).
+*
+* down() is BEST-EFFORT and NOT a true inverse: it drops the column only. The deleted
+* system policies and the nulled junction policy_id pointers are NOT reconstructed, and
+* boot re-provisioning does NOT repair them either -- the junction synchronizer is
+* create-only (it never rewrites realm_scope/policy_id on an already-existing row). So a
+* revert (or revert + re-run) on a POPULATED database permanently pins realm_admin and any
+* converted grant to the fail-closed 'own' default until fixed by hand; a forward-only
+* upgrade is unaffected.
+*/ const JUNCTION_TABLES = [
+	"auth_role_permissions",
+	"auth_user_permissions",
+	"auth_client_permissions",
+	"auth_robot_permissions"
+];
+const SCOPE_BY_POLICY = [{
+	policy: "system.realm-or-global",
+	scope: "ownOrNull"
+}, {
+	policy: "system.realm-bound",
+	scope: "own"
+}];
+var Default1779300000000 = class {
+	name = "Default1779300000000";
+	async up(queryRunner) {
+		for (const table of JUNCTION_TABLES) await queryRunner.query(`
+                ALTER TABLE "${table}"
+                ADD "realm_scope" character varying(50) NOT NULL DEFAULT 'own'
+            `);
+		for (const table of JUNCTION_TABLES) for (const { policy, scope } of SCOPE_BY_POLICY) await queryRunner.query(`
+                    UPDATE "${table}" rp
+                    SET "realm_scope" = '${scope}', "policy_id" = NULL
+                    FROM "auth_policies" p
+                    WHERE rp."policy_id" = p."id"
+                      AND p."name" = '${policy}'
+                      AND p."built_in" = true
+                      AND p."realm_id" IS NULL
+                `);
+		await queryRunner.query(`
+            UPDATE "auth_role_permissions" rp
+            SET "realm_scope" = 'any'
+            FROM "auth_roles" r
+            WHERE rp."role_id" = r."id"
+              AND r."name" = 'admin'
+              AND r."built_in" = true
+        `);
+		await queryRunner.query(`
+            DELETE FROM "auth_policies"
+            WHERE "name" IN ('system.realm-match', 'system.realm-bound', 'system.realm-or-global')
+              AND "built_in" = true
+              AND "realm_id" IS NULL
+        `);
+	}
+	async down(queryRunner) {
+		for (const table of JUNCTION_TABLES) await queryRunner.query(`
+                ALTER TABLE "${table}" DROP COLUMN "realm_scope"
+            `);
+	}
+};
+//#endregion
+export { Default1779300000000 };
+
+//# sourceMappingURL=1779300000000-Default.mjs.map

package/dist/adapters/database/migrations/postgres/1779300000000-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1779300000000-Default.mjs","names":["JUNCTION_TABLES","SCOPE_BY_POLICY","policy","scope","Default1779300000000","name","up","queryRunner","table","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1779300000000-Default.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * realm_scope enum on the four permission-junction tables (fail-closed realm scoping).\n *\n * Adds the coarse, actor-relative `realm_scope` column (default 'own') and migrates the\n * realm-scoping that previously lived in policies into the column. The redundant system\n * realm policies (`system.realm-match` child of `system.default`,\n * `system.realm-bound`, `system.realm-or-global`) are deleted here as a deterministic\n * safety net; the provisioner ALSO prunes them on boot (cleanupStaleChildren for the\n * realm-match child + the top-level stale-prune), so a fresh install needs no migration.\n *\n * up() ordering is LOAD-BEARING: schema -> convert-by-policy-name -> lift-admin ->\n * delete policy rows (the policy-name joins must resolve before the rows are deleted).\n *\n * BREAKING (existing data): only admin (-> any, matched by role name) and realm_admin\n * (its realm-or-global / realm-bound junction policies -> ownOrNull / own) are converted.\n * Every OTHER pre-existing grant with no realm policy keeps the 'own' default, so a custom\n * role or a direct identity grant that previously reached global (realm_id = null) building\n * blocks via the old system.realm-match baseline is now fail-closed to its own realm. Those\n * grants must be re-widened to ownOrNull/any by hand: there is deliberately no automatic\n * bump, because a policy-less grant that managed global resources is indistinguishable in\n * the data from one that only ever acted on its own realm (auto-widening would fail open).\n *\n * down() is BEST-EFFORT and NOT a true inverse: it drops the column only. The deleted\n * system policies and the nulled junction policy_id pointers are NOT reconstructed, and\n * boot re-provisioning does NOT repair them either -- the junction synchronizer is\n * create-only (it never rewrites realm_scope/policy_id on an already-existing row). So a\n * revert (or revert + re-run) on a POPULATED database permanently pins realm_admin and any\n * converted grant to the fail-closed 'own' default until fixed by hand; a forward-only\n * upgrade is unaffected.\n */\nconst JUNCTION_TABLES = [\n    'auth_role_permissions',\n    'auth_user_permissions',\n    'auth_client_permissions',\n    'auth_robot_permissions',\n];\n\nconst SCOPE_BY_POLICY: { policy: string, scope: string }[] = [\n    { policy: 'system.realm-or-global', scope: 'ownOrNull' },\n    { policy: 'system.realm-bound', scope: 'own' },\n];\n\nexport class Default1779300000000 implements MigrationInterface {\n    name = 'Default1779300000000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        // 1. schema\n        for (const table of JUNCTION_TABLES) {\n            await queryRunner.query(`\n                ALTER TABLE \"${table}\"\n                ADD \"realm_scope\" character varying(50) NOT NULL DEFAULT 'own'\n            `);\n        }\n\n        // 2. convert the realm-scoping policies into the enum (clearing only those\n        //    policy_id pointers; non-realm policies are preserved).\n        for (const table of JUNCTION_TABLES) {\n            for (const { policy, scope } of SCOPE_BY_POLICY) {\n                await queryRunner.query(`\n                    UPDATE \"${table}\" rp\n                    SET \"realm_scope\" = '${scope}', \"policy_id\" = NULL\n                    FROM \"auth_policies\" p\n                    WHERE rp.\"policy_id\" = p.\"id\"\n                      AND p.\"name\" = '${policy}'\n                      AND p.\"built_in\" = true\n                      AND p.\"realm_id\" IS NULL\n                `);\n            }\n        }\n\n        // 3. lift admin-role grants to unrestricted (admin grants carry no policy, so\n        //    they are unreachable by the policy join above — join by role name instead).\n        await queryRunner.query(`\n            UPDATE \"auth_role_permissions\" rp\n            SET \"realm_scope\" = 'any'\n            FROM \"auth_roles\" r\n            WHERE rp.\"role_id\" = r.\"id\"\n              AND r.\"name\" = 'admin'\n              AND r.\"built_in\" = true\n        `);\n\n        // 4. delete the three now-redundant system realm policies (by exact name —\n        //    never by type, which would wipe user-defined realm-match policies).\n        //    A cascading closure-tree FK detaches the realm-match child from\n        //    system.default; the provisioner re-prunes idempotently on boot.\n        await queryRunner.query(`\n            DELETE FROM \"auth_policies\"\n            WHERE \"name\" IN ('system.realm-match', 'system.realm-bound', 'system.realm-or-global')\n              AND \"built_in\" = true\n              AND \"realm_id\" IS NULL\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        for (const table of JUNCTION_TABLES) {\n            await queryRunner.query(`\n                ALTER TABLE \"${table}\" DROP COLUMN \"realm_scope\"\n            `);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCA,MAAMA,kBAAkB;CACpB;CACA;CACA;CACA;;AAGJ,MAAMC,kBAAuD,CACzD;CAAEC,QAAQ;CAA0BC,OAAO;AAAY,GACvD;CAAED,QAAQ;CAAsBC,OAAO;AAAM,CAAA;AAGjD,IAAaC,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EAErD,KAAK,MAAMC,SAASR,iBAChB,MAAMO,YAAYE,MAAM;+BACLD,MAAM;;aAExB;EAKL,KAAK,MAAMA,SAASR,iBAChB,KAAK,MAAM,EAAEE,QAAQC,WAAWF,iBAC5B,MAAMM,YAAYE,MAAM;8BACVD,MAAM;2CACOL,MAAM;;;wCAGTD,OAAO;;;iBAG9B;EAMT,MAAMK,YAAYE,MAAM;;;;;;;SAOvB;EAMD,MAAMF,YAAYE,MAAM;;;;;SAKvB;CACL;CAEA,MAAaC,KAAKH,aAAyC;EACvD,KAAK,MAAMC,SAASR,iBAChB,MAAMO,YAAYE,MAAM;+BACLD,MAAM;aACxB;CAET;AACJ"}

package/dist/adapters/database/migrations/postgres/1783325495597-Default.d.ts

@@ -0,0 +1,28 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Refresh token rotation + replay detection (plan 016).
+ *
+ * - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was
+ *   IPv4-only, a latent truncation bug).
+ * - Adds auth_session_tokens: one durable row per issued access/refresh token,
+ *   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for
+ *   refresh-token validity (consume/replay/revoke); the cache stays the
+ *   verification fast-path.
+ *
+ * BREAKING: at deploy the table is empty, so every in-flight refresh token has
+ * no row and its first refresh returns invalid_grant — active users
+ * re-authenticate once (hard cutover, RT horizon 3 days).
+ *
+ * down() narrows ip_address back to 15, which fails if any IPv6 value was
+ * stored (best-effort, per the 1779300000000 precedent).
+ *
+ * Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated
+ * OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.
+ * Folded into this still-unreleased migration rather than a new file.
+ */
+export declare class Default1783325495597 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1783325495597-Default.d.ts.map

package/dist/adapters/database/migrations/postgres/1783325495597-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783325495597-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1783325495597-Default.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB7D"}

package/dist/adapters/database/migrations/postgres/1783325495597-Default.mjs

@@ -0,0 +1,79 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/postgres/1783325495597-Default.ts
+/**
+* Refresh token rotation + replay detection (plan 016).
+*
+* - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was
+*   IPv4-only, a latent truncation bug).
+* - Adds auth_session_tokens: one durable row per issued access/refresh token,
+*   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for
+*   refresh-token validity (consume/replay/revoke); the cache stays the
+*   verification fast-path.
+*
+* BREAKING: at deploy the table is empty, so every in-flight refresh token has
+* no row and its first refresh returns invalid_grant — active users
+* re-authenticate once (hard cutover, RT horizon 3 days).
+*
+* down() narrows ip_address back to 15, which fails if any IPv6 value was
+* stored (best-effort, per the 1779300000000 precedent).
+*
+* Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated
+* OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.
+* Folded into this still-unreleased migration rather than a new file.
+*/ var Default1783325495597 = class {
+	name = "Default1783325495597";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" ALTER COLUMN "ip_address" TYPE character varying(45)
+        `);
+		await queryRunner.query(`
+            CREATE TABLE "auth_session_tokens" (
+                "id" uuid NOT NULL,
+                "session_id" uuid NOT NULL,
+                "kind" character varying(16) NOT NULL,
+                "parent_id" uuid,
+                "refresh_token_id" uuid,
+                "ip_address" character varying(45) NOT NULL,
+                "user_agent" character varying(512) NOT NULL,
+                "consumed_at" character varying(28),
+                "revoked_at" character varying(28),
+                "expires_at" character varying(28) NOT NULL,
+                "created_at" TIMESTAMP NOT NULL DEFAULT now(),
+                CONSTRAINT "PK_auth_session_tokens" PRIMARY KEY ("id")
+            )
+        `);
+		await queryRunner.query("CREATE INDEX \"IDX_auth_session_tokens_session_id\" ON \"auth_session_tokens\" (\"session_id\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_session_tokens_kind\" ON \"auth_session_tokens\" (\"kind\")");
+		await queryRunner.query("CREATE INDEX \"IDX_auth_session_tokens_expires_at\" ON \"auth_session_tokens\" (\"expires_at\")");
+		await queryRunner.query(`
+            ALTER TABLE "auth_session_tokens"
+            ADD CONSTRAINT "FK_auth_session_tokens_session_id" FOREIGN KEY ("session_id") REFERENCES "auth_sessions"("id") ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" ADD "post_logout_redirect_uri" text
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE "auth_clients" DROP COLUMN "post_logout_redirect_uri"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_session_tokens" DROP CONSTRAINT "FK_auth_session_tokens_session_id"
+        `);
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_session_tokens_expires_at\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_session_tokens_kind\"");
+		await queryRunner.query("DROP INDEX \"public\".\"IDX_auth_session_tokens_session_id\"");
+		await queryRunner.query(`
+            DROP TABLE "auth_session_tokens"
+        `);
+		await queryRunner.query(`
+            ALTER TABLE "auth_sessions" ALTER COLUMN "ip_address" TYPE character varying(15)
+        `);
+	}
+};
+//#endregion
+export { Default1783325495597 };
+
+//# sourceMappingURL=1783325495597-Default.mjs.map

package/dist/adapters/database/migrations/postgres/1783325495597-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783325495597-Default.mjs","names":["Default1783325495597","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/postgres/1783325495597-Default.ts"],"sourcesContent":["import type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Refresh token rotation + replay detection (plan 016).\n *\n * - Widens auth_sessions.ip_address 15 -> 45 (IPv6-sized; the old length was\n *   IPv4-only, a latent truncation bug).\n * - Adds auth_session_tokens: one durable row per issued access/refresh token,\n *   FK to auth_sessions (ON DELETE CASCADE). The row is the authority for\n *   refresh-token validity (consume/replay/revoke); the cache stays the\n *   verification fast-path.\n *\n * BREAKING: at deploy the table is empty, so every in-flight refresh token has\n * no row and its first refresh returns invalid_grant — active users\n * re-authenticate once (hard cutover, RT horizon 3 days).\n *\n * down() narrows ip_address back to 15, which fails if any IPv6 value was\n * stored (best-effort, per the 1779300000000 precedent).\n *\n * Also adds auth_clients.post_logout_redirect_uri (plan 042) — a dedicated\n * OIDC RP-Initiated Logout allow-list, no longer conflated with redirect_uri.\n * Folded into this still-unreleased migration rather than a new file.\n */\nexport class Default1783325495597 implements MigrationInterface {\n    name = 'Default1783325495597';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\" ALTER COLUMN \"ip_address\" TYPE character varying(45)\n        `);\n\n        await queryRunner.query(`\n            CREATE TABLE \"auth_session_tokens\" (\n                \"id\" uuid NOT NULL,\n                \"session_id\" uuid NOT NULL,\n                \"kind\" character varying(16) NOT NULL,\n                \"parent_id\" uuid,\n                \"refresh_token_id\" uuid,\n                \"ip_address\" character varying(45) NOT NULL,\n                \"user_agent\" character varying(512) NOT NULL,\n                \"consumed_at\" character varying(28),\n                \"revoked_at\" character varying(28),\n                \"expires_at\" character varying(28) NOT NULL,\n                \"created_at\" TIMESTAMP NOT NULL DEFAULT now(),\n                CONSTRAINT \"PK_auth_session_tokens\" PRIMARY KEY (\"id\")\n            )\n        `);\n        await queryRunner.query('CREATE INDEX \"IDX_auth_session_tokens_session_id\" ON \"auth_session_tokens\" (\"session_id\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_session_tokens_kind\" ON \"auth_session_tokens\" (\"kind\")');\n        await queryRunner.query('CREATE INDEX \"IDX_auth_session_tokens_expires_at\" ON \"auth_session_tokens\" (\"expires_at\")');\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_session_tokens\"\n            ADD CONSTRAINT \"FK_auth_session_tokens_session_id\" FOREIGN KEY (\"session_id\") REFERENCES \"auth_sessions\"(\"id\") ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // Dedicated post-logout redirect allow-list for OIDC RP-Initiated\n        // Logout (plan 042) — no longer conflated with the login redirect_uri.\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" ADD \"post_logout_redirect_uri\" text\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query(`\n            ALTER TABLE \"auth_clients\" DROP COLUMN \"post_logout_redirect_uri\"\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_session_tokens\" DROP CONSTRAINT \"FK_auth_session_tokens_session_id\"\n        `);\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_session_tokens_expires_at\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_session_tokens_kind\"');\n        await queryRunner.query('DROP INDEX \"public\".\"IDX_auth_session_tokens_session_id\"');\n        await queryRunner.query(`\n            DROP TABLE \"auth_session_tokens\"\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \"auth_sessions\" ALTER COLUMN \"ip_address\" TYPE character varying(15)\n        `);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;GAuBA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;SAevB;EACD,MAAMD,YAAYC,MAAM,iGAAA;EACxB,MAAMD,YAAYC,MAAM,qFAAA;EACxB,MAAMD,YAAYC,MAAM,iGAAA;EAExB,MAAMD,YAAYC,MAAM;;;SAGvB;EAID,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM,8DAAA;EACxB,MAAMD,YAAYC,MAAM,wDAAA;EACxB,MAAMD,YAAYC,MAAM,8DAAA;EACxB,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;CACL;AACJ"}

package/dist/adapters/database/subscriber/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cAUtC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;cAQ9D,OAAO,CAAC,KAAK,EAAE,GAAG,sBAAsB,EAAE,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;CAcvF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/database/subscriber/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACH,sBAAsB,EAGzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EACR,UAAU,EACV,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,WAAW,EACX,WAAW,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,aAAa,EAC3D,IAAI,EAAE,GAAG,UAAU,EAAE,EACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GACrD,CAAC,IAAI,EAAE,CAAC,KAAK,uBAAuB,CAsBvC;AAED,qBAAa,gBAAgB,CAAC,CAAC,SAAS,aAAa,CAAE,YAAW,yBAAyB,CAAC,CAAC,CAAC;IAC1F,SAAS,CAAC,GAAG,EAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,SAAS,CAAC,EAAG,qBAAqB,CAAC;gBAEjC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAK3C,YAAY,CAAC,SAAS,EAAE,qBAAqB,GAAI,IAAI;IAKrD,QAAQ,IAAK,QAAQ,GAAG,MAAM;IAIxB,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAYhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhD,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cActC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;cAQ9D,OAAO,CAAC,KAAK,EAAE,GAAG,sBAAsB,EAAE,EAAE,IAAI,EAAE,CAAC,GAAI,OAAO,CAAC,IAAI,CAAC;CAcvF"}

package/dist/adapters/database/subscriber/module.mjs

@@ -44,9 +44,10 @@ var EntitySubscriber = class {
 		await this.publish(EntityDefaultEventName.UPDATED, event.entity);
 	}
 	async afterRemove(event) {
-		if (!event.entity) return;
-		await this.dropCacheKeys(event.connection, event.entity);
-		await this.publish(EntityDefaultEventName.DELETED, event.entity);
+		const entity = event.databaseEntity ?? event.entity;
+		if (!entity) return;
+		await this.dropCacheKeys(event.connection, entity);
+		await this.publish(EntityDefaultEventName.DELETED, entity);
 	}
 	async dropCacheKeys(connection, data) {
 		if (!this.ctx.cache || !connection.queryResultCache) return;