@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs

@@ -0,0 +1,63 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenEntity } from "../../../../../adapters/database/domains/session-token/entity.mjs";
+import "../../../../../adapters/database/domains/index.mjs";
+import { In, LessThan } from "typeorm";
+//#region src/app/modules/oauth2/repositories/session-token/repository.ts
+var SessionTokenRepositoryAdapter = class {
+	repository;
+	constructor(dataSource) {
+		this.repository = dataSource.getRepository(SessionTokenEntity);
+	}
+	async create(input) {
+		const entity = this.repository.create({
+			id: input.id,
+			session_id: input.session_id,
+			kind: input.kind,
+			parent_id: input.parent_id ?? null,
+			refresh_token_id: input.refresh_token_id ?? null,
+			ip_address: input.ip_address,
+			user_agent: input.user_agent,
+			consumed_at: null,
+			revoked_at: null,
+			expires_at: input.expires_at
+		});
+		await this.repository.insert(entity);
+		entity.created_at = entity.created_at ?? (/* @__PURE__ */ new Date()).toISOString();
+		return entity;
+	}
+	async findOneById(id) {
+		return this.repository.findOne({ where: { id } });
+	}
+	async findBySessionId(sessionId) {
+		return this.repository.find({ where: { session_id: sessionId } });
+	}
+	async markRefreshConsumed(id, at) {
+		return ((await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ consumed_at: at }).where("id = :id", { id }).andWhere("kind = :kind", { kind: "refresh" }).andWhere("consumed_at IS NULL").andWhere("revoked_at IS NULL").execute()).affected ?? 0) > 0;
+	}
+	async hasConsumedChild(parentId) {
+		return await this.repository.createQueryBuilder().where("parent_id = :parentId", { parentId }).andWhere("consumed_at IS NOT NULL").getCount() > 0;
+	}
+	async revokeById(id, at) {
+		await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where("id = :id", { id }).andWhere("revoked_at IS NULL").execute();
+	}
+	async revokeBySessionId(sessionId, at) {
+		const refs = (await this.repository.find({
+			where: { session_id: sessionId },
+			select: ["id", "expires_at"]
+		})).map((row) => ({
+			id: row.id,
+			expires_at: row.expires_at
+		}));
+		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revoked_at: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revoked_at IS NULL").execute();
+		return refs;
+	}
+	async deleteExpired(before) {
+		return (await this.repository.delete({ expires_at: LessThan(before) })).affected ?? 0;
+	}
+};
+//#endregion
+export { SessionTokenRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","session_id","kind","parent_id","refresh_token_id","ip_address","user_agent","consumed_at","revoked_at","expires_at","insert","created_at","Date","toISOString","findOneById","findOne","where","findBySessionId","sessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","parentId","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            session_id: input.session_id,\n            kind: input.kind,\n            parent_id: input.parent_id ?? null,\n            refresh_token_id: input.refresh_token_id ?? null,\n            ip_address: input.ip_address,\n            user_agent: input.user_agent,\n            consumed_at: null,\n            revoked_at: null,\n            expires_at: input.expires_at,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined created_at.\n        entity.created_at = entity.created_at ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { session_id: sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumed_at: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumed_at IS NULL')\n            .andWhere('revoked_at IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder()\n            .where('parent_id = :parentId', { parentId })\n            .andWhere('consumed_at IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revoked_at: at })\n            .where('id = :id', { id })\n            .andWhere('revoked_at IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { session_id: sessionId },\n            select: ['id', 'expires_at'],\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expires_at: row.expires_at,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revoked_at: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revoked_at IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expires_at: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,YAAYH,MAAMG;GAClBC,MAAMJ,MAAMI;GACZC,WAAWL,MAAMK,aAAa;GAC9BC,kBAAkBN,MAAMM,oBAAoB;GAC5CC,YAAYP,MAAMO;GAClBC,YAAYR,MAAMQ;GAClBC,aAAa;GACbC,YAAY;GACZC,YAAYX,MAAMW;EACtB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,aAAaZ,OAAOY,+BAAc,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE/D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBC,WAA4C;EAC9D,OAAO,KAAKxB,WAAWyB,KAAK,EAAEH,OAAO,EAAEf,YAAYiB,UAAU,EAAE,CAAA;CACnE;CAEA,MAAME,oBAAoBpB,IAAYqB,IAA8B;EAUhE,SAAQC,MATa,KAAK5B,WAAW6B,mBAAkB,CAAA,CAClDC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAElB,aAAac,GAAG,CAAA,CAAA,CACtBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,qBAAA,CAAA,CACTA,SAAS,oBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBC,UAAoC;EAMvD,OAAOC,MALa,KAAKrC,WAAW6B,mBAAkB,CAAA,CACjDP,MAAM,yBAAyB,EAAEc,SAAS,CAAA,CAAA,CAC1CJ,SAAS,yBAAA,CAAA,CACTM,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYqB,IAA2B;EACpD,MAAM,KAAK3B,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,oBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMO,kBAAkBhB,WAAmBG,IAAwC;EAM/E,MAAMgB,QAA0BF,MALb,KAAKzC,WAAWyB,KAAK;GACpCH,OAAO,EAAEf,YAAYiB,UAAU;GAC/BkB,QAAQ,CAAC,MAAM,YAAA;EACnB,CAAA,EAAA,CAEqCE,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRS,YAAY8B,IAAI9B;EACpB,EAAA;EACA,IAAI4B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,EAAEhB,IAAIV,GAAG+C,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C0B,SAAS,oBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOU;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOrB,MAFc,KAAK5B,WAAWkD,OAAO,EAAEnC,YAAYlB,SAASoD,MAAAA,EAAQ,CAAA,EAAA,CAE7Df,YAAY;CAC9B;AACJ"}

package/dist/app/modules/oauth2/repositories/token/repository.d.ts

@@ -12,6 +12,7 @@ export declare class OAuth2TokenRepository implements IOAuth2TokenRepository {
     saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload>;
     isInactive(key: string): Promise<boolean>;
     setInactive(key: string, exp?: number): Promise<void>;
+    claimInactive(key: string, exp?: number): Promise<boolean>;
     /**
      * Transform timestamp in seconds to ttl in ms.
      *

package/dist/app/modules/oauth2/repositories/token/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAG3E,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAMnB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAW3D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrC,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAehE,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ9D,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiB3F,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB3D;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;CAUlC"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAG3E,qBAAa,qBAAsB,YAAW,sBAAsB;IAChE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAMnB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAW3D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBrC,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAehE,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ9D,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiB3F,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAerD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBhE;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;CAUlC"}

package/dist/app/modules/oauth2/repositories/token/repository.mjs

@@ -67,6 +67,14 @@ var OAuth2TokenRepository = class {
 		});
 		await this.cache.set(cacheKey, true, { ttl });
 	}
+	async claimInactive(key, exp) {
+		const ttl = this.buildTTL(exp);
+		const cacheKey = buildCacheKey({
+			prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,
+			key
+		});
+		return this.cache.add(cacheKey, true, { ttl });
+	}
 	/**
 	* Transform timestamp in seconds to ttl in ms.
 	*

package/dist/app/modules/oauth2/repositories/token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["buildCacheKey","randomUUID","CacheOAuth2Prefix","OAuth2TokenRepository","cache","findOneBySignature","signature","get","prefix","TOKEN_CLAIMS","key","findOneById","id","TOKEN","removeById","token","drop","setInactive","exp","insert","payload","jti","set","ttl","buildTTL","save","saveWithSignature","data","normalized","isInactive","cacheKey","TOKEN_INACTIVE","response","utc","Date","now"],"sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { randomUUID } from 'node:crypto';\nimport type { IOAuth2TokenRepository } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2TokenRepository implements IOAuth2TokenRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n        );\n    }\n\n    async findOneById(id: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: id, \n            }),\n        );\n    }\n\n    // -----------------------------------------------------\n\n    async removeById(id: string): Promise<void> {\n        const token = await this.findOneById(id);\n        if (!token) {\n            return;\n        }\n\n        const key = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN,\n            key: id, \n        });\n        await this.cache.drop(key);\n\n        await this.setInactive(id, token.exp);\n    }\n\n    // -----------------------------------------------------\n\n    async insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        payload.jti = randomUUID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: payload.jti, \n            }),\n            payload,\n            { ttl: this.buildTTL(payload.exp) },\n        );\n\n        return payload;\n    }\n\n    async save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        if (payload.jti) {\n            return payload;\n        }\n\n        return this.insert(payload);\n    }\n\n    async saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload> {\n        const normalized = await this.save(data);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n            normalized,\n            { ttl: this.buildTTL(data.exp) },\n        );\n\n        return normalized;\n    }\n\n    // -----------------------------------------------------\n\n    async isInactive(key: string): Promise<boolean> {\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        const response = await this.cache.get(cacheKey);\n\n        return !!response;\n    }\n\n    async setInactive(key: string, exp?: number): Promise<void> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        await this.cache.set(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Transform timestamp in seconds to ttl in ms.\n     *\n     * @param utc\n     * @protected\n     */\n    protected buildTTL(utc?: number) {\n        if (typeof utc === 'number') {\n            const ttl = (utc * 1000) - Date.now();\n            if (ttl > 0) {\n                return ttl;\n            }\n        }\n\n        return 3_600 * 1000;\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,wBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAIA,MAAMC,mBAAmBC,WAAuD;EAC5E,OAAO,KAAKF,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CAER;CAEA,MAAMK,YAAYC,IAAgD;EAC9D,OAAO,KAAKR,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA,CAAA;CAER;CAIA,MAAME,WAAWF,IAA2B;EACxC,MAAMG,QAAQ,MAAM,KAAKJ,YAAYC,EAAAA;EACrC,IAAI,CAACG,OACD;EAGJ,MAAML,MAAMV,cAAc;GACtBQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA;EACA,MAAM,KAAKR,MAAMY,KAAKN,GAAAA;EAEtB,MAAM,KAAKO,YAAYL,IAAIG,MAAMG,GAAG;CACxC;CAIA,MAAMC,OAAOC,SAA0D;EACnEA,QAAQC,MAAMpB,WAAAA;EAEd,MAAM,KAAKG,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKU,QAAQC;EACjB,CAAA,GACAD,SACA,EAAEG,KAAK,KAAKC,SAASJ,QAAQF,GAAG,EAAE,CAAA;EAGtC,OAAOE;CACX;CAEA,MAAMK,KAAKL,SAA0D;EACjE,IAAIA,QAAQC,KACR,OAAOD;EAGX,OAAO,KAAKD,OAAOC,OAAAA;CACvB;CAEA,MAAMM,kBAAkBC,MAA0BrB,WAAgD;EAC9F,MAAMsB,aAAa,MAAM,KAAKH,KAAKE,IAAAA;EAEnC,MAAM,KAAKvB,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,GACAsB,YACA,EAAEL,KAAK,KAAKC,SAASG,KAAKT,GAAG,EAAE,CAAA;EAGnC,OAAOU;CACX;CAIA,MAAMC,WAAWnB,KAA+B;EAC5C,MAAMoB,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAIA,OAAO,CAAC,CAACsB,MAFc,KAAK5B,MAAMG,IAAIuB,QAAAA;CAG1C;CAEA,MAAMb,YAAYP,KAAaQ,KAA6B;EACxD,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAEA,MAAM,KAAKN,MAAMkB,IACbQ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;;;;;;IAUA,SAAmBU,KAAc;EAC7B,IAAI,OAAOA,QAAQ,UAAU;GACzB,MAAMV,MAAM,MAAO,MAAQW,KAAKC,IAAG;GACnC,IAAIZ,MAAM,GACN,OAAOA;EAEf;EAEA,OAAO,OAAQ;CACnB;AACJ"}
+{"version":3,"file":"repository.mjs","names":["buildCacheKey","randomUUID","CacheOAuth2Prefix","OAuth2TokenRepository","cache","findOneBySignature","signature","get","prefix","TOKEN_CLAIMS","key","findOneById","id","TOKEN","removeById","token","drop","setInactive","exp","insert","payload","jti","set","ttl","buildTTL","save","saveWithSignature","data","normalized","isInactive","cacheKey","TOKEN_INACTIVE","response","claimInactive","add","utc","Date","now"],"sources":["../../../../../../src/app/modules/oauth2/repositories/token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2025-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { randomUUID } from 'node:crypto';\nimport type { IOAuth2TokenRepository } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\nexport class OAuth2TokenRepository implements IOAuth2TokenRepository {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    // -----------------------------------------------------\n\n    async findOneBySignature(signature: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n        );\n    }\n\n    async findOneById(id: string): Promise<OAuth2TokenPayload | null> {\n        return this.cache.get<OAuth2TokenPayload>(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: id, \n            }),\n        );\n    }\n\n    // -----------------------------------------------------\n\n    async removeById(id: string): Promise<void> {\n        const token = await this.findOneById(id);\n        if (!token) {\n            return;\n        }\n\n        const key = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN,\n            key: id, \n        });\n        await this.cache.drop(key);\n\n        await this.setInactive(id, token.exp);\n    }\n\n    // -----------------------------------------------------\n\n    async insert(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        payload.jti = randomUUID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN,\n                key: payload.jti, \n            }),\n            payload,\n            { ttl: this.buildTTL(payload.exp) },\n        );\n\n        return payload;\n    }\n\n    async save(payload: OAuth2TokenPayload): Promise<OAuth2TokenPayload> {\n        if (payload.jti) {\n            return payload;\n        }\n\n        return this.insert(payload);\n    }\n\n    async saveWithSignature(data: OAuth2TokenPayload, signature: string): Promise<OAuth2TokenPayload> {\n        const normalized = await this.save(data);\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.TOKEN_CLAIMS,\n                key: signature, \n            }),\n            normalized,\n            { ttl: this.buildTTL(data.exp) },\n        );\n\n        return normalized;\n    }\n\n    // -----------------------------------------------------\n\n    async isInactive(key: string): Promise<boolean> {\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        const response = await this.cache.get(cacheKey);\n\n        return !!response;\n    }\n\n    async setInactive(key: string, exp?: number): Promise<void> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        await this.cache.set(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    async claimInactive(key: string, exp?: number): Promise<boolean> {\n        const ttl = this.buildTTL(exp);\n\n        const cacheKey = buildCacheKey({\n            prefix: CacheOAuth2Prefix.TOKEN_INACTIVE,\n            key,\n        });\n\n        // set-if-absent (Redis SET NX / single-tick memory adapter) — returns\n        // true only for the caller that actually transitioned the token to\n        // inactive, so concurrent single-use claims cannot both succeed.\n        return this.cache.add(\n            cacheKey,\n            true,\n            { ttl },\n        );\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Transform timestamp in seconds to ttl in ms.\n     *\n     * @param utc\n     * @protected\n     */\n    protected buildTTL(utc?: number) {\n        if (typeof utc === 'number') {\n            const ttl = (utc * 1000) - Date.now();\n            if (ttl > 0) {\n                return ttl;\n            }\n        }\n\n        return 3_600 * 1000;\n    }\n}\n"],"mappings":";;;;;;;AAcA,IAAaG,wBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAIA,MAAMC,mBAAmBC,WAAuD;EAC5E,OAAO,KAAKF,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CAER;CAEA,MAAMK,YAAYC,IAAgD;EAC9D,OAAO,KAAKR,MAAMG,IACdP,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA,CAAA;CAER;CAIA,MAAME,WAAWF,IAA2B;EACxC,MAAMG,QAAQ,MAAM,KAAKJ,YAAYC,EAAAA;EACrC,IAAI,CAACG,OACD;EAGJ,MAAML,MAAMV,cAAc;GACtBQ,QAAQN,kBAAkBW;GAC1BH,KAAKE;EACT,CAAA;EACA,MAAM,KAAKR,MAAMY,KAAKN,GAAAA;EAEtB,MAAM,KAAKO,YAAYL,IAAIG,MAAMG,GAAG;CACxC;CAIA,MAAMC,OAAOC,SAA0D;EACnEA,QAAQC,MAAMpB,WAAAA;EAEd,MAAM,KAAKG,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBW;GAC1BH,KAAKU,QAAQC;EACjB,CAAA,GACAD,SACA,EAAEG,KAAK,KAAKC,SAASJ,QAAQF,GAAG,EAAE,CAAA;EAGtC,OAAOE;CACX;CAEA,MAAMK,KAAKL,SAA0D;EACjE,IAAIA,QAAQC,KACR,OAAOD;EAGX,OAAO,KAAKD,OAAOC,OAAAA;CACvB;CAEA,MAAMM,kBAAkBC,MAA0BrB,WAAgD;EAC9F,MAAMsB,aAAa,MAAM,KAAKH,KAAKE,IAAAA;EAEnC,MAAM,KAAKvB,MAAMkB,IACbtB,cAAc;GACVQ,QAAQN,kBAAkBO;GAC1BC,KAAKJ;EACT,CAAA,GACAsB,YACA,EAAEL,KAAK,KAAKC,SAASG,KAAKT,GAAG,EAAE,CAAA;EAGnC,OAAOU;CACX;CAIA,MAAMC,WAAWnB,KAA+B;EAC5C,MAAMoB,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAIA,OAAO,CAAC,CAACsB,MAFc,KAAK5B,MAAMG,IAAIuB,QAAAA;CAG1C;CAEA,MAAMb,YAAYP,KAAaQ,KAA6B;EACxD,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAEA,MAAM,KAAKN,MAAMkB,IACbQ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;CAEA,MAAMU,cAAcvB,KAAaQ,KAAgC;EAC7D,MAAMK,MAAM,KAAKC,SAASN,GAAAA;EAE1B,MAAMY,WAAW9B,cAAc;GAC3BQ,QAAQN,kBAAkB6B;GAC1BrB;EACJ,CAAA;EAKA,OAAO,KAAKN,MAAM8B,IACdJ,UACA,MACA,EAAEP,IAAI,CAAA;CAEd;;;;;;IAUA,SAAmBY,KAAc;EAC7B,IAAI,OAAOA,QAAQ,UAAU;GACzB,MAAMZ,MAAM,MAAO,MAAQa,KAAKC,IAAG;GACnC,IAAId,MAAM,GACN,OAAOA;EAEf;EAEA,OAAO,OAAQ;CACnB;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAMH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AASrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+JjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAOH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+KjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -2,11 +2,11 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { RealmEntity } from "../../../adapters/database/domains/realm/entity.mjs";
+import { PolicyRepository } from "../../../adapters/database/domains/policy/repository.mjs";
 import { ClientEntity } from "../../../adapters/database/domains/client/entity.mjs";
 import { RoleEntity } from "../../../adapters/database/domains/role/entity.mjs";
 import { ClientRoleEntity } from "../../../adapters/database/domains/client-role/entity.mjs";
 import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
-import { PolicyRepository } from "../../../adapters/database/domains/policy/repository.mjs";
 import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
 import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
 import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
@@ -20,6 +20,8 @@ import { UserRoleEntity } from "../../../adapters/database/domains/user-role/ent
 import "../../../adapters/database/domains/index.mjs";
 import { WebClientProvisioner } from "../../../core/entities/client/web-client.mjs";
 import "../../../core/entities/client/index.mjs";
+import { KeyProvisioner } from "../../../core/key/provisioner.mjs";
+import "../../../core/key/index.mjs";
 import { ClientProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/client/module.mjs";
 import { PermissionProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/permission/module.mjs";
 import { PolicyProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/policy/module.mjs";
@@ -34,14 +36,12 @@ import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import { getAppOrigins } from "../config/origins.mjs";
 import "../config/index.mjs";
-import { DatabaseInjectionKey } from "../database/constants.mjs";
 import "../../../adapters/database/index.mjs";
-import { LoggerInjectionKey } from "../logger/constants.mjs";
-import "../logger/index.mjs";
 import { RealmRepositoryAdapter } from "../database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "../database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "../database/repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "../database/repositories/client-role/repository.mjs";
+import { KeyRepositoryAdapter } from "../database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "../database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "../database/repositories/permission-policy/repository.mjs";
 import { PolicyRepositoryAdapter } from "../database/repositories/policy/repository.mjs";
@@ -55,10 +55,14 @@ import { UserRepositoryAdapter } from "../database/repositories/user/repository.
 import { UserPermissionRepositoryAdapter } from "../database/repositories/user-permission/repository.mjs";
 import { UserRoleRepositoryAdapter } from "../database/repositories/user-role/repository.mjs";
 import "../database/repositories/index.mjs";
+import { DatabaseInjectionKey } from "../database/constants.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
 import "../database/index.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
+import { SymmetricCipher } from "@authup/server-kit";
 import { SystemPolicyName } from "@authup/access";
 import path from "node:path";
 import fs from "node:fs";
@@ -165,8 +169,15 @@ var ProvisionerModule = class {
 			appOrigins: getAppOrigins(config),
 			logger: container.resolve(LoggerInjectionKey)
 		});
+		const keyProvisioner = new KeyProvisioner({
+			keyStore: new KeyRepositoryAdapter(dataSource, { secretsCipher: config.secretsEncryptionKey ? new SymmetricCipher(config.secretsEncryptionKey) : null }),
+			logger: container.resolve(LoggerInjectionKey)
+		});
 		const realms = await realmRepository.find();
-		for (const realm of realms) await webClientProvisioner.ensureForRealm(realm);
+		for (const realm of realms) {
+			await webClientProvisioner.ensureForRealm(realm);
+			await keyProvisioner.ensureForRealm(realm);
+		}
 		if (config.permissionsDefaultPolicyAssignment) await this.assignDefaultPolicy(dataSource, policyRepository);
 	}
 	async assignDefaultPolicy(dataSource, policyRepository) {

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","LoggerInjectionKey","WebClientProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Robot,\n    RobotPermission,\n    RobotRole,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RobotEntity,\n    RobotPermissionEntity,\n    RobotRoleEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RobotProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RobotPermissionRepositoryAdapter,\n    RobotRepositoryAdapter,\n    RobotRoleRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter,\n    UserRoleRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const robotSynchronizer = new RobotProvisioningSynchronizer({\n            robotRepository: new RobotRepositoryAdapter({\n                repository: container.resolve<Repository<Robot>>(RobotEntity),\n                realmRepository,\n            }),\n            robotRoleRepository: new RobotRoleRepositoryAdapter(\n                container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n            ),\n            robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n                container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            robotSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on built_in inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permission_id: permission.id,\n                    permission_realm_id: permission.realm_id,\n                    policy_id: defaultPolicy.id,\n                    policy_realm_id: defaultPolicy.realm_id,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,IAAaoD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOV,WAAWa;EACvB,KAAKF,eAAe,CAACX,WAAWc,QAAQd,WAAWe,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQhB,kBAAAA;EACjC,MAAMiB,kBAAkBlB,KAAKmB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIrB,GAAGsB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQpB,qBAAqB+B,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B1D,WAAAA;EAE7D,MAAMuE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYhB,UAAUE,QAAsC3D,gBAAAA;GAC5DuE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC+B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI3C,sBAAsB;GAC7CuC,YAAYhB,UAAUE,QAA0BtD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAItD,wBAAwB;GACjDiD,YAAYhB,UAAUE,QAA4B9D,YAAAA;GAClD0E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI5D,6BAA6B;GACtDqD,YAAYI;GACZL;GACAS,0BAA0B,IAAIhD,gCAC1BwB,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI1D,4BACtBgC,UAAUE,QAAgC5D,gBAAAA,CAAAA;GAE9CqF,4BAA4B,IAAI7D,kCAC5BkC,UAAUE,QAAsC7D,sBAAAA,CAAAA;GAGpD+E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI/D,6BAA6B;GACtDgE,gBAAgB,IAAIjD,sBAAsB;IACtCoC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIjD,0BACpBmB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIpD,gCAC1BqB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAItE,8BAA8B;GACxDuE,iBAAiB,IAAI3D,uBAAuB;IACxC0C,YAAYhB,UAAUE,QAA2BzD,WAAAA;IACjDqE;GACJ,CAAA;GACAoB,qBAAqB,IAAI3D,2BACrByB,UAAUE,QAA+BvD,eAAAA,CAAAA;GAE7CwF,2BAA2B,IAAI9D,iCAC3B2B,UAAUE,QAAqCxD,qBAAAA,CAAAA;GAGnD0E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAIzE,8BAA8B,EAAEoD,YAAYoB,IAL9C1D,uBAAuB;GAC/CsC,YAAYhB,UAAUE,QAA2BpD,WAAAA;GACjDgE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBjF,8BAA8B;GACvD6D;GACAG;GACAC;GACAe,mBAAAA,IAf0B7E,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIpD,qBAAqB;GAClDgC;GACAqB,YAAYvD,cAAcc,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQd,kBAAAA;EAC9B,CAAA;EAEA,MAAMwD,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAChB,MAAMH,qBAAqBM,eAAeD,KAAAA;EAG9C,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAclG,iBAAiBmG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc/G,gBAAAA;EAChD,MAAMgH,eAAe3C,WAAW0C,cAAcpG,sBAAAA;EAE9C,MAAMsG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Robot,\n    RobotPermission,\n    RobotRole,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RobotEntity,\n    RobotPermissionEntity,\n    RobotRoleEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RobotProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RobotPermissionRepositoryAdapter,\n    RobotRepositoryAdapter,\n    RobotRoleRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const robotSynchronizer = new RobotProvisioningSynchronizer({\n            robotRepository: new RobotRepositoryAdapter({\n                repository: container.resolve<Repository<Robot>>(RobotEntity),\n                realmRepository,\n            }),\n            robotRoleRepository: new RobotRoleRepositoryAdapter(\n                container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n            ),\n            robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n                container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            robotSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on built_in inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permission_id: permission.id,\n                    permission_realm_id: permission.realm_id,\n                    policy_id: defaultPolicy.id,\n                    policy_realm_id: defaultPolicy.realm_id,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,IAAauD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQtB,qBAAqBiC,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B7D,WAAAA;EAE7D,MAAM0E,uBAAuB,IAAI/C,4BAA4B;GACzDgD,YAAYhB,UAAUE,QAAsC9D,gBAAAA;GAC5D0E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIhD,wBAAwB;GACjD+C,YAAY,IAAIhE,iBAAiB4D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAInD,kCACnCiC,UAAUE,QAAsCnD,sBAAAA,CAAAA;EAGpD,MAAMoE,qBAAqB,IAAI9D,+BAA+B;GAC1D2D,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI7C,sBAAsB;GAC7CyC,YAAYhB,UAAUE,QAA0BzD,UAAAA;GAChDqE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIzD,wBAAwB;GACjDoD,YAAYhB,UAAUE,QAA4BjE,YAAAA;GAClD6E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAIlE,mCAAmC;GAClE4D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI/D,6BAA6B;GACtDwD,YAAYI;GACZL;GACAS,0BAA0B,IAAIlD,gCAC1B0B,UAAUE,QAAoCxD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DmE;GACAK,sBAAsB,IAAI7D,4BACtBmC,UAAUE,QAAgC/D,gBAAAA,CAAAA;GAE9CwF,4BAA4B,IAAIhE,kCAC5BqC,UAAUE,QAAsChE,sBAAAA,CAAAA;GAGpDkF;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIlE,6BAA6B;GACtDmE,gBAAgB,IAAInD,sBAAsB;IACtCsC,YAAY,IAAI/D,eAAe2D,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAInD,0BACpBqB,UAAUE,QAA8BrD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAItD,gCAC1BuB,UAAUE,QAAoCtD,oBAAAA,CAAAA;GAGlDyE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAIzE,8BAA8B;GACxD0E,iBAAiB,IAAI7D,uBAAuB;IACxC4C,YAAYhB,UAAUE,QAA2B5D,WAAAA;IACjDwE;GACJ,CAAA;GACAoB,qBAAqB,IAAI7D,2BACrB2B,UAAUE,QAA+B1D,eAAAA,CAAAA;GAE7C2F,2BAA2B,IAAIhE,iCAC3B6B,UAAUE,QAAqC3D,qBAAAA,CAAAA;GAGnD6E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAI5E,8BAA8B,EAAEuD,YAAYoB,IAL9C5D,uBAAuB;GAC/CwC,YAAYhB,UAAUE,QAA2BvD,WAAAA;GACjDmE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBpF,8BAA8B;GACvDgE;GACAG;GACAC;GACAe,mBAAAA,IAf0BhF,8BAA8B;IACxD0D,YAAY,IAAI9C,uBAAuB4C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIrD,qBAAqB;GAClDiC;GACAqB,YAAYzD,cAAcgB,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMyD,iBAAiB,IAAIvD,eAAe;GACtCwD,UAAU,IAAI/E,qBAAqB8C,YAAY,EAC3CkC,eAAe7C,OAAO8C,uBAClB,IAAI7D,gBAAgBe,OAAO8C,oBAAoB,IAC/C,KACR,CAAA;GACAJ,QAAQ3C,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM6D,SAAS,MAAMlC,gBAAgBmC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMP,qBAAqBU,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAIjD,OAAOmD,oCACP,MAAM,KAAKC,oBAAoBzC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBoC,oBACZzC,YACAK,kBACa;EACb,MAAMqC,gBAAgB,MAAMrC,iBAAiBsC,cAAczG,iBAAiB0G,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiB7C,WAAW8C,cAActH,gBAAAA;EAChD,MAAMuH,eAAe/C,WAAW8C,cAAc3G,sBAAAA;EAE9C,MAAM6G,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IA6F3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAmEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA8F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgG3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA2EhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA+F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -10,7 +10,7 @@ import "../../../../../core/index.mjs";
 import { ConfigInjectionKey } from "../../../config/constants.mjs";
 import "../../../config/index.mjs";
 import { DecisionStrategy } from "@authup/kit";
-import { PermissionName, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ScopeName, buildUserFakeEmail } from "@authup/core-kit";
+import { ClientAuthMethod, ClientTokenBindingMethod, PermissionName, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ScopeName, buildUserFakeEmail } from "@authup/core-kit";
 import { BuiltInPolicyType, RealmScope, SystemPolicyName } from "@authup/access";
 //#region src/app/modules/provisioning/sources/default/module.ts
 var DefaultProvisioningSource = class {
@@ -47,9 +47,11 @@ var DefaultProvisioningSource = class {
 				extraAttributes: { names: [
 					"active",
 					"realm_id",
-					"is_confidential",
+					"auth_method",
+					"token_binding_method",
 					"secret_hashed",
-					"secret_encrypted"
+					"secret_encrypted",
+					"access_policy_id"
 				] }
 			},
 			{
@@ -153,9 +155,13 @@ var DefaultProvisioningSource = class {
 					PermissionName.CLIENT_CREATE,
 					PermissionName.CLIENT_UPDATE,
 					PermissionName.CLIENT_DELETE,
+					PermissionName.CONSENT_DELETE,
 					PermissionName.IDENTITY_PROVIDER_CREATE,
 					PermissionName.IDENTITY_PROVIDER_UPDATE,
 					PermissionName.IDENTITY_PROVIDER_DELETE,
+					PermissionName.KEY_CREATE,
+					PermissionName.KEY_UPDATE,
+					PermissionName.KEY_DELETE,
 					PermissionName.PERMISSION_CREATE,
 					PermissionName.PERMISSION_UPDATE,
 					PermissionName.PERMISSION_DELETE,
@@ -168,9 +174,13 @@ var DefaultProvisioningSource = class {
 					PermissionName.SCOPE_CREATE,
 					PermissionName.SCOPE_UPDATE,
 					PermissionName.SCOPE_DELETE,
+					PermissionName.SESSION_DELETE,
 					PermissionName.USER_CREATE,
 					PermissionName.USER_UPDATE,
-					PermissionName.USER_DELETE
+					PermissionName.USER_DELETE,
+					PermissionName.USER_AUTHENTICATOR_CREATE,
+					PermissionName.USER_AUTHENTICATOR_UPDATE,
+					PermissionName.USER_AUTHENTICATOR_DELETE
 				] }
 			}
 		}];
@@ -210,7 +220,8 @@ var DefaultProvisioningSource = class {
 			type: ProvisioningEntityStrategyType.MERGE,
 			attributes: [
 				"built_in",
-				"is_confidential",
+				"auth_method",
+				"token_binding_method",
 				"secret",
 				"secret_hashed",
 				"secret_encrypted"
@@ -218,14 +229,19 @@ var DefaultProvisioningSource = class {
 		};
 		else clientStrategy = {
 			type: ProvisioningEntityStrategyType.MERGE,
-			attributes: ["built_in", "is_confidential"]
+			attributes: [
+				"built_in",
+				"auth_method",
+				"token_binding_method"
+			]
 		};
 		masterRealm.relations = masterRealm.relations || {};
 		masterRealm.relations.clients = [{
 			strategy: clientStrategy,
 			attributes: {
 				built_in: true,
-				is_confidential: true,
+				auth_method: ClientAuthMethod.SECRET,
+				token_binding_method: ClientTokenBindingMethod.NONE,
 				name: "system",
 				secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),
 				secret_hashed: false,

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Robot, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    RobotCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realm_id',\n                        // Security-critical: a self-edit must not change the\n                        // client's confidentiality (toggling this clears the\n                        // secret) or downgrade the secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'is_confidential',\n                        'secret_hashed',\n                        'secret_encrypted',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'realm_id',\n                        'user_id',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'name_locked',\n                        'status',\n                        'status_message',\n                        'realm_id',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['built_in'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        built_in: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROBOT_CREATE,\n                            PermissionName.ROBOT_UPDATE,\n                            PermissionName.ROBOT_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                built_in: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    built_in: true,\n                    is_confidential: true,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n                    secret_hashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const robotCredentialsService = new RobotCredentialsService();\n\n        let robotStrategy : ProvisioningEntityStrategy<Robot> | undefined;\n        if (config.robotAdminSecretReset) {\n            robotStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['secret'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.robots = [\n            {\n                strategy: robotStrategy,\n                attributes: {\n                    name: 'system',\n                    secret: await robotCredentialsService.protect(config.robotAdminSecret),\n                    active: config.robotAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAae,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMhB,iBAAiBiB;KACvBC,MAAMpB,kBAAkBqB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBtB,iBAAiBuB,UAAU;IACjEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMhB,iBAAiB0B;KACvBR,MAAMpB,kBAAkB4B;KACxBN,UAAU;KACVC,UAAU;IACd,EACJ,GACA,EACIN,YAAY;KACRC,MAAMhB,iBAAiB2B;KACvBT,MAAMpB,kBAAkB6B;KACxBP,UAAU;KACVC,UAAU;IACd,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMhB,iBAAiB4B;KACvBV,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBgC;KACvBd,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBiC;KACvBf,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DjC,eAAekC,qBAAqB,CAACpC,iBAAiBiB,SAASjB,iBAAiB4B,wBAAAA;IAChF1B,eAAemC,oBAAoB,CAACrC,iBAAiBiB,SAASjB,iBAAiBgC,uBAAAA;IAC/E9B,eAAeoC,mBAAmB,CAACtC,iBAAiBiB,SAASjB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAOtC,cAAAA,CAAAA,CAChBuC,KAAKzB,SAAAA;GACF,MAAM0B,SAAuC;IACzCC,UAAU;KACNzB,MAAMN,+BAA+BgC;KACrC7B,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMyB,WAAWV,qBAAqBnB;GACtC,IAAI6B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOlC,SAAAA,CAAAA,CAChBmC,KAAKzB,UAAU;GACZ2B,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEA4B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BnD,WAAWoD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtBlD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;;IAKnBL,6BAA6BnD,WAAWyD;IACxCC,sCAAsC,GACjC1D,WAAW2D,MAAM;KACdxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CvC,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACA0B,WAAW,CAAC;EAChB;EAEA,MAAMqC,yBAAyB,IAAIzE,uBAAAA;EAEnC,IAAI0E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXlE,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,UAAA;EACjB;EAGJmE,YAAYpC,YAAYoC,YAAYpC,aAAa,CAAC;EAClDoC,YAAYpC,UAAUwC,QAAQ,CAC1B;GACI3C,UAAUyC;GACVrE,YAAY;IACRC,MAAM;IACNuE,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOnF,mBAAmB,OAAA;IAC1BoF,QAAQV,OAAOW;GACnB;GACA9C,WAAW,EAAE+C,aAAa,CAACzF,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM0F,2BAA2B,IAAItF,yBAAAA;EAErC,IAAIuF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACb7E,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAgF,iBAAiB;GACb7E,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJmE,YAAYpC,YAAYoC,YAAYpC,aAAa,CAAC;EAClDoC,YAAYpC,UAAUmD,UAAU,CAC5B;GACItD,UAAUoD;GACVhF,YAAY;IACRK,UAAU;IACV8E,iBAAiB;IACjBlF,MAAM;IACNmF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACAxD,WAAW,EAAE+C,aAAa,CAACzF,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMmG,0BAA0B,IAAI9F,wBAAAA;EAEpC,IAAI+F;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZtF,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,QAAA;EACjB;EAGJmE,YAAYpC,YAAYoC,YAAYpC,aAAa,CAAC;EAClDoC,YAAYpC,UAAU4D,SAAS,CAC3B;GACI/D,UAAU6D;GACVzF,YAAY;IACRC,MAAM;IACNmF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA9D,WAAW,EAAE+C,aAAa,CAACzF,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAAC8E,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHkC,UAAU,KAAK/B,cAAa;GAC5BkG,aAAa,KAAK9E,iBAAgB;GAClC+E,QAAQ,KAAKlE,YAAW;GACxBmE,OAAO,KAAKlE,WAAU;GACtBmE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","auth_method","SECRET","token_binding_method","NONE","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Robot, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    RobotCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realm_id',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'auth_method',\n                        'token_binding_method',\n                        'secret_hashed',\n                        'secret_encrypted',\n                        'access_policy_id',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'realm_id',\n                        'user_id',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'name_locked',\n                        'status',\n                        'status_message',\n                        'realm_id',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['built_in'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        built_in: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROBOT_CREATE,\n                            PermissionName.ROBOT_UPDATE,\n                            PermissionName.ROBOT_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                built_in: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'auth_method', 'token_binding_method', 'secret', 'secret_hashed', 'secret_encrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'auth_method', 'token_binding_method'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    built_in: true,\n                    auth_method: ClientAuthMethod.SECRET,\n                    token_binding_method: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n                    secret_hashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const robotCredentialsService = new RobotCredentialsService();\n\n        let robotStrategy : ProvisioningEntityStrategy<Robot> | undefined;\n        if (config.robotAdminSecretReset) {\n            robotStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['secret'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.robots = [\n            {\n                strategy: robotStrategy,\n                attributes: {\n                    name: 'system',\n                    secret: await robotCredentialsService.protect(config.robotAdminSecret),\n                    active: config.robotAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA6CA,IAAaiB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMlB,iBAAiBmB;KACvBC,MAAMtB,kBAAkBuB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBxB,iBAAiByB,UAAU;IACjEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMlB,iBAAiB4B;KACvBR,MAAMtB,kBAAkB8B;KACxBN,UAAU;KACVC,UAAU;IACd,EACJ,GACA,EACIN,YAAY;KACRC,MAAMlB,iBAAiB6B;KACvBT,MAAMtB,kBAAkB+B;KACxBP,UAAU;KACVC,UAAU;IACd,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMlB,iBAAiB8B;KACvBV,MAAMtB,kBAAkBiC;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMlB,iBAAiBkC;KACvBd,MAAMtB,kBAAkBiC;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMlB,iBAAiBmC;KACvBf,MAAMtB,kBAAkBiC;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DjC,eAAekC,qBAAqB,CAACtC,iBAAiBmB,SAASnB,iBAAiB8B,wBAAAA;IAChF1B,eAAemC,oBAAoB,CAACvC,iBAAiBmB,SAASnB,iBAAiBkC,uBAAAA;IAC/E9B,eAAeoC,mBAAmB,CAACxC,iBAAiBmB,SAASnB,iBAAiBmC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAOtC,cAAAA,CAAAA,CAChBuC,KAAKzB,SAAAA;GACF,MAAM0B,SAAuC;IACzCC,UAAU;KACNzB,MAAMN,+BAA+BgC;KACrC7B,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMyB,WAAWV,qBAAqBnB;GACtC,IAAI6B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOlC,SAAAA,CAAAA,CAChBmC,KAAKzB,UAAU;GACZ2B,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEA4B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BrD,WAAWsD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtBlD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;;IAKnBL,6BAA6BrD,WAAW2D;IACxCC,sCAAsC,GACjC5D,WAAW6D,MAAM;KACdxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;KACfhF,eAAeiF;KACfjF,eAAekF;KACflF,eAAemF;KACfnF,eAAeoF;KACfpF,eAAeqF;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C/C,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACA0B,WAAW,CAAC;EAChB;EAEA,MAAM6C,yBAAyB,IAAIjF,uBAAAA;EAEnC,IAAIkF;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACX1E,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,UAAA;EACjB;EAGJ2E,YAAY5C,YAAY4C,YAAY5C,aAAa,CAAC;EAClD4C,YAAY5C,UAAUgD,QAAQ,CAC1B;GACInD,UAAUiD;GACV7E,YAAY;IACRC,MAAM;IACN+E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAO3F,mBAAmB,OAAA;IAC1B4F,QAAQV,OAAOW;GACnB;GACAtD,WAAW,EAAEuD,aAAa,CAACjG,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMkG,2BAA2B,IAAI9F,yBAAAA;EAErC,IAAI+F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbrF,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAe;IAAwB;IAAU;IAAiB;;EAC/F;OAEAwF,iBAAiB;GACbrF,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAe;;EAC5C;EAGJ2E,YAAY5C,YAAY4C,YAAY5C,aAAa,CAAC;EAClD4C,YAAY5C,UAAU2D,UAAU,CAC5B;GACI9D,UAAU4D;GACVxF,YAAY;IACRK,UAAU;IACVsF,aAAa1G,iBAAiB2G;IAC9BC,sBAAsB3G,yBAAyB4G;IAC/C7F,MAAM;IACN8F,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfb,QAAQV,OAAOwB;GACnB;GACAnE,WAAW,EAAEuD,aAAa,CAACjG,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM8G,0BAA0B,IAAIzG,wBAAAA;EAEpC,IAAI0G;EACJ,IAAI1B,OAAO2B,uBACPD,gBAAgB;GACZjG,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,QAAA;EACjB;EAGJ2E,YAAY5C,YAAY4C,YAAY5C,aAAa,CAAC;EAClD4C,YAAY5C,UAAUuE,SAAS,CAC3B;GACI1E,UAAUwE;GACVpG,YAAY;IACRC,MAAM;IACN8F,QAAQ,MAAMI,wBAAwBlB,QAAQP,OAAO6B,gBAAgB;IACrEnB,QAAQV,OAAO8B;GACnB;GACAzE,WAAW,EAAEuD,aAAa,CAACjG,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACsF,WAAAA;CACZ;CAEA,MAAM8B,KAAKC,WAAwD;EAC/D,MAAMhC,SAASgC,UAAUC,QAAQ/G,kBAAAA;EAEjC,OAAO;GACHkC,UAAU,KAAK/B,cAAa;GAC5B6G,aAAa,KAAKzF,iBAAgB;GAClC0F,QAAQ,KAAK7E,YAAW;GACxB8E,OAAO,KAAK7E,WAAU;GACtB8E,QAAQ,MAAM,KAAKtC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAmBhD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAmChD"}

package/dist/app/modules/provisioning/sources/file/module.mjs

@@ -4,9 +4,18 @@ import.meta.url;
 import { RootProvisioningValidator } from "../../../../../core/provisioning/entities/root/validator.mjs";
 import "../../../../../core/provisioning/entities/index.mjs";
 import { CompositeProvisioningSource } from "../composite/module.mjs";
+import { ValidatorGroup, isObject } from "@authup/kit";
 import path from "node:path";
 import { load, locateMany } from "locter";
 //#region src/app/modules/provisioning/sources/file/module.ts
+const MODULE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".cts",
+	".js",
+	".mjs",
+	".cjs"
+]);
 var FileProvisioningSource = class {
 	options;
 	rootValidator;
@@ -20,7 +29,9 @@ var FileProvisioningSource = class {
 		const output = {};
 		for (const location of locations) {
 			const raw = await load(location);
-			const data = await this.rootValidator.run(raw.default);
+			const entity = typeof location.extension === "string" && MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase()) && isObject(raw) && "default" in raw ? raw.default : raw;
+			if (!isObject(entity)) throw new Error(`The provisioning file "${location.path}" must contain an object at its root.`);
+			const data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });
 			compositeSource.merge(output, data);
 		}
 		return output;

package/dist/app/modules/provisioning/sources/file/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["load","locateMany","path","RootProvisioningValidator","CompositeProvisioningSource","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","data","run","default","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { load, locateMany } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { path: cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await load(location);\n            const data = await this.rootValidator.run(raw.default);\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;AAeA,IAAaK,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIJ,0BAAAA;CAC7B;CAEA,MAAMH,OAAwC;EAK1C,MAAMY,YAAY,MAAMX,WAAW,mCAAmC,EAAEC,MAJ5DA,KAAKO,WAAW,KAAKH,QAAQE,GAAG,IACxC,KAAKF,QAAQE,MACbN,KAAKQ,KAAKC,QAAQH,IAAG,GAAI,KAAKF,QAAQE,GAAG,EAEqC,CAAA;EAElF,MAAMK,kBAAkB,IAAIT,4BAA4B,CAAA,CAAE;EAE1D,MAAMU,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMhB,KAAKe,QAAAA;GACvB,MAAME,OAAO,MAAM,KAAKV,cAAcW,IAAIF,IAAIG,OAAO;GAErDN,gBAAgBO,MAAMN,QAAQG,IAAAA;EAClC;EAEA,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","load","locateMany","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { load, locateMany } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { path: cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await load(location);\n            // Unwrap the default export only for module files; a data file\n            // (json/yaml) whose root legitimately carries a `default` key must\n            // keep all of its keys.\n            const isModule = typeof location.extension === 'string' &&\n                MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n            const entity = isModule && isObject(raw) && 'default' in raw ?\n                raw.default :\n                raw;\n\n            // Fail closed on a malformed root (top-level list/scalar, or an\n            // empty file parsing to null) instead of silently provisioning\n            // nothing — the same silent-skip class the loader otherwise avoids.\n            if (!isObject(entity)) {\n                throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n            }\n\n            const data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;AAmBA,MAAMO,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;CAAO;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMH,OAAwC;EAK1C,MAAMc,YAAY,MAAMb,WAAW,mCAAmC,EAAEC,MAJ5DA,KAAKS,WAAW,KAAKH,QAAQE,GAAG,IACxC,KAAKF,QAAQE,MACbR,KAAKU,KAAKC,QAAQH,IAAG,GAAI,KAAKF,QAAQE,GAAG,EAEqC,CAAA;EAElF,MAAMK,kBAAkB,IAAIX,4BAA4B,CAAA,CAAE;EAE1D,MAAMY,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMlB,KAAKiB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3Cf,uBAAuBgB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClCvB,SAASmB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACnB,SAASwB,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAASf,KAAK,sCAAsC;GAGlG,MAAMwB,OAAO,MAAM,KAAKjB,cAAckB,IAAIJ,QAAQ,EAAEK,OAAO9B,eAAe+B,aAAa,CAAA;GAEvFd,gBAAgBe,MAAMd,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}

package/dist/cli/commands/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AA4BA,aAAK,kBAAkB;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAuHD,wBAAgB,yBAAyB;;;;;;;GAyCxC"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AA4BA,aAAK,kBAAkB;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAsID,wBAAgB,yBAAyB;;;;;;;GAyCxC"}