@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../../../../core/authentication/credential/entities/client/module.mjs";
-import { RobotCredentialsService } from "../../../../../core/authentication/credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "../../../../../core/authentication/credential/entities/user/module.mjs";
 import { ProvisioningEntityStrategyType } from "../../../../../core/provisioning/strategy/constants.mjs";
 import "../../../../../core/provisioning/strategy/index.mjs";
@@ -10,7 +9,7 @@ import "../../../../../core/index.mjs";
 import { ConfigInjectionKey } from "../../../config/constants.mjs";
 import "../../../config/index.mjs";
 import { DecisionStrategy } from "@authup/kit";
-import { PermissionName, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ScopeName, buildUserFakeEmail } from "@authup/core-kit";
+import { ClientAuthMethod, ClientTokenBindingMethod, PermissionName, REALM_MASTER_NAME, ROLE_ADMIN_NAME, ROLE_REALM_ADMIN_NAME, ScopeName, buildUserFakeEmail } from "@authup/core-kit";
 import { BuiltInPolicyType, RealmScope, SystemPolicyName } from "@authup/access";
 //#region src/app/modules/provisioning/sources/default/module.ts
 var DefaultProvisioningSource = class {
@@ -20,20 +19,20 @@ var DefaultProvisioningSource = class {
 				attributes: {
 					name: SystemPolicyName.DEFAULT,
 					type: BuiltInPolicyType.COMPOSITE,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				},
-				extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },
+				extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },
 				children: [{ attributes: {
 					name: SystemPolicyName.IDENTITY,
 					type: BuiltInPolicyType.IDENTITY,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				} }, { attributes: {
 					name: SystemPolicyName.PERMISSION_BINDING,
 					type: BuiltInPolicyType.PERMISSION_BINDING,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				} }]
 			},
 			{
@@ -41,29 +40,17 @@ var DefaultProvisioningSource = class {
 					name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,
 					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
 					invert: true,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				},
 				extraAttributes: { names: [
 					"active",
-					"realm_id",
-					"is_confidential",
-					"secret_hashed",
-					"secret_encrypted"
-				] }
-			},
-			{
-				attributes: {
-					name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,
-					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
-					invert: true,
-					built_in: true,
-					realm_id: null
-				},
-				extraAttributes: { names: [
-					"active",
-					"realm_id",
-					"user_id"
+					"realmId",
+					"authMethod",
+					"tokenBindingMethod",
+					"secretHashed",
+					"secretEncrypted",
+					"accessPolicyId"
 				] }
 			},
 			{
@@ -71,15 +58,15 @@ var DefaultProvisioningSource = class {
 					name: SystemPolicyName.USER_NAMES_SELF_MANAGE,
 					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
 					invert: true,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				},
 				extraAttributes: { names: [
 					"active",
-					"name_locked",
+					"nameLocked",
 					"status",
-					"status_message",
-					"realm_id"
+					"statusMessage",
+					"realmId"
 				] }
 			}
 		];
@@ -87,18 +74,17 @@ var DefaultProvisioningSource = class {
 	buildPermissions() {
 		const policiesByPermission = {
 			[PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],
-			[PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],
 			[PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE]
 		};
 		return Object.values(PermissionName).map((name) => {
 			const entity = {
 				strategy: {
 					type: ProvisioningEntityStrategyType.MERGE,
-					attributes: ["built_in"]
+					attributes: ["builtIn"]
 				},
 				attributes: {
 					name,
-					built_in: true
+					builtIn: true
 				}
 			};
 			const policies = policiesByPermission[name];
@@ -110,11 +96,11 @@ var DefaultProvisioningSource = class {
 		return Object.values(ScopeName).map((name) => ({
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name,
-				built_in: true
+				builtIn: true
 			}
 		}));
 	}
@@ -122,11 +108,11 @@ var DefaultProvisioningSource = class {
 		return [{
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name: ROLE_ADMIN_NAME,
-				built_in: true
+				builtIn: true
 			},
 			relations: {
 				globalPermissions: ["*"],
@@ -135,11 +121,11 @@ var DefaultProvisioningSource = class {
 		}, {
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name: ROLE_REALM_ADMIN_NAME,
-				built_in: true
+				builtIn: true
 			},
 			relations: {
 				globalPermissions: ["*"],
@@ -153,15 +139,16 @@ var DefaultProvisioningSource = class {
 					PermissionName.CLIENT_CREATE,
 					PermissionName.CLIENT_UPDATE,
 					PermissionName.CLIENT_DELETE,
+					PermissionName.CONSENT_DELETE,
 					PermissionName.IDENTITY_PROVIDER_CREATE,
 					PermissionName.IDENTITY_PROVIDER_UPDATE,
 					PermissionName.IDENTITY_PROVIDER_DELETE,
+					PermissionName.KEY_CREATE,
+					PermissionName.KEY_UPDATE,
+					PermissionName.KEY_DELETE,
 					PermissionName.PERMISSION_CREATE,
 					PermissionName.PERMISSION_UPDATE,
 					PermissionName.PERMISSION_DELETE,
-					PermissionName.ROBOT_CREATE,
-					PermissionName.ROBOT_UPDATE,
-					PermissionName.ROBOT_DELETE,
 					PermissionName.ROLE_CREATE,
 					PermissionName.ROLE_UPDATE,
 					PermissionName.ROLE_DELETE,
@@ -171,7 +158,10 @@ var DefaultProvisioningSource = class {
 					PermissionName.SESSION_DELETE,
 					PermissionName.USER_CREATE,
 					PermissionName.USER_UPDATE,
-					PermissionName.USER_DELETE
+					PermissionName.USER_DELETE,
+					PermissionName.USER_AUTHENTICATOR_CREATE,
+					PermissionName.USER_AUTHENTICATOR_UPDATE,
+					PermissionName.USER_AUTHENTICATOR_DELETE
 				] }
 			}
 		}];
@@ -180,11 +170,11 @@ var DefaultProvisioningSource = class {
 		const masterRealm = {
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name: REALM_MASTER_NAME,
-				built_in: true
+				builtIn: true
 			},
 			relations: {}
 		};
@@ -210,46 +200,36 @@ var DefaultProvisioningSource = class {
 		if (config.clientSystemSecretReset) clientStrategy = {
 			type: ProvisioningEntityStrategyType.MERGE,
 			attributes: [
-				"built_in",
-				"is_confidential",
+				"builtIn",
+				"authMethod",
+				"tokenBindingMethod",
 				"secret",
-				"secret_hashed",
-				"secret_encrypted"
+				"secretHashed",
+				"secretEncrypted"
 			]
 		};
 		else clientStrategy = {
 			type: ProvisioningEntityStrategyType.MERGE,
-			attributes: ["built_in", "is_confidential"]
+			attributes: [
+				"builtIn",
+				"authMethod",
+				"tokenBindingMethod"
+			]
 		};
 		masterRealm.relations = masterRealm.relations || {};
 		masterRealm.relations.clients = [{
 			strategy: clientStrategy,
 			attributes: {
-				built_in: true,
-				is_confidential: true,
+				builtIn: true,
+				authMethod: ClientAuthMethod.SECRET,
+				tokenBindingMethod: ClientTokenBindingMethod.NONE,
 				name: "system",
-				secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),
-				secret_hashed: false,
+				secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),
+				secretHashed: false,
 				active: config.clientSystemEnabled
 			},
 			relations: { globalRoles: [ROLE_ADMIN_NAME] }
 		}];
-		const robotCredentialsService = new RobotCredentialsService();
-		let robotStrategy;
-		if (config.robotAdminSecretReset) robotStrategy = {
-			type: ProvisioningEntityStrategyType.MERGE,
-			attributes: ["secret"]
-		};
-		masterRealm.relations = masterRealm.relations || {};
-		masterRealm.relations.robots = [{
-			strategy: robotStrategy,
-			attributes: {
-				name: "system",
-				secret: await robotCredentialsService.protect(config.robotAdminSecret),
-				active: config.robotAdminEnabled
-			},
-			relations: { globalRoles: [ROLE_ADMIN_NAME] }
-		}];
 		return [masterRealm];
 	}
 	async load(container) {

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","RobotCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","built_in","realm_id","extraAttributes","decision_strategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","ROBOT_NAMES_SELF_MANAGE","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","ROBOT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROBOT_CREATE","ROBOT_UPDATE","ROBOT_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","is_confidential","secret","clientSystemSecret","secret_hashed","clientSystemEnabled","robotCredentialsService","robotStrategy","robotAdminSecretReset","robots","robotAdminSecret","robotAdminEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Robot, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    RobotCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            built_in: true,\n                            realm_id: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realm_id',\n                        // Security-critical: a self-edit must not change the\n                        // client's confidentiality (toggling this clears the\n                        // secret) or downgrade the secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'is_confidential',\n                        'secret_hashed',\n                        'secret_encrypted',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'realm_id',\n                        'user_id',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    built_in: true,\n                    realm_id: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'name_locked',\n                        'status',\n                        'status_message',\n                        'realm_id',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['built_in'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        built_in: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    built_in: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['built_in'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    built_in: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROBOT_CREATE,\n                            PermissionName.ROBOT_UPDATE,\n                            PermissionName.ROBOT_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                built_in: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential', 'secret', 'secret_hashed', 'secret_encrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['built_in', 'is_confidential'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    built_in: true,\n                    is_confidential: true,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),\n                    secret_hashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const robotCredentialsService = new RobotCredentialsService();\n\n        let robotStrategy : ProvisioningEntityStrategy<Robot> | undefined;\n        if (config.robotAdminSecretReset) {\n            robotStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['secret'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.robots = [\n            {\n                strategy: robotStrategy,\n                attributes: {\n                    name: 'system',\n                    secret: await robotCredentialsService.protect(config.robotAdminSecret),\n                    active: config.robotAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAae,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMhB,iBAAiBiB;KACvBC,MAAMpB,kBAAkBqB;KACxBC,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EAAEC,mBAAmBtB,iBAAiBuB,UAAU;IACjEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMhB,iBAAiB0B;KACvBR,MAAMpB,kBAAkB4B;KACxBN,UAAU;KACVC,UAAU;IACd,EACJ,GACA,EACIN,YAAY;KACRC,MAAMhB,iBAAiB2B;KACvBT,MAAMpB,kBAAkB6B;KACxBP,UAAU;KACVC,UAAU;IACd,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMhB,iBAAiB4B;KACvBV,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAKA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBgC;KACvBd,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMhB,iBAAiBiC;KACvBf,MAAMpB,kBAAkB+B;KACxBC,QAAQ;KACRV,UAAU;KACVC,UAAU;IACd;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAG,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3DjC,eAAekC,qBAAqB,CAACpC,iBAAiBiB,SAASjB,iBAAiB4B,wBAAAA;IAChF1B,eAAemC,oBAAoB,CAACrC,iBAAiBiB,SAASjB,iBAAiBgC,uBAAAA;IAC/E9B,eAAeoC,mBAAmB,CAACtC,iBAAiBiB,SAASjB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOM,OAAOC,OAAOtC,cAAAA,CAAAA,CAChBuC,KAAKzB,SAAAA;GACF,MAAM0B,SAAuC;IACzCC,UAAU;KACNzB,MAAMN,+BAA+BgC;KACrC7B,YAAY,CAAC,UAAA;IACjB;IACAA,YAAY;KACRC;KACAI,UAAU;IACd;GACJ;GAEA,MAAMyB,WAAWV,qBAAqBnB;GACtC,IAAI6B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAOlC,SAAAA,CAAAA,CAChBmC,KAAKzB,UAAU;GACZ2B,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC;IACAI,UAAU;GACd;EACJ,EAAA;CACR;CAEA4B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BnD,WAAWoD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,UAAU;GACd;GACA0B,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtBlD,eAAemD;KACfnD,eAAeoD;KACfpD,eAAeqD;;IAKnBL,6BAA6BnD,WAAWyD;IACxCC,sCAAsC,GACjC1D,WAAW2D,MAAM;KACdxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1CxC,UAAU;IACNzB,MAAMN,+BAA+BgC;IACrC7B,YAAY,CAAC,UAAA;GACjB;GACAA,YAAY;IACRC,MAAMb;IACNiB,UAAU;GACd;GACA0B,WAAW,CAAC;EAChB;EAEA,MAAMsC,yBAAyB,IAAI1E,uBAAAA;EAEnC,IAAI2E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXnE,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,UAAA;EACjB;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAUyC,QAAQ,CAC1B;GACI5C,UAAU0C;GACVtE,YAAY;IACRC,MAAM;IACNwE,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOpF,mBAAmB,OAAA;IAC1BqF,QAAQV,OAAOW;GACnB;GACA/C,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM2F,2BAA2B,IAAIvF,yBAAAA;EAErC,IAAIwF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACb9E,MAAMN,+BAA+BgC;GACrC7B,YAAY;IAAC;IAAY;IAAmB;IAAU;IAAiB;;EAC3E;OAEAiF,iBAAiB;GACb9E,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,YAAY,iBAAA;EAC7B;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAUoD,UAAU,CAC5B;GACIvD,UAAUqD;GACVjF,YAAY;IACRK,UAAU;IACV+E,iBAAiB;IACjBnF,MAAM;IACNoF,QAAQ,MAAML,yBAAyBN,QAAQP,OAAOmB,oBAAoB,EAAEC,eAAe,MAAM,CAAA;IACjGA,eAAe;IACfV,QAAQV,OAAOqB;GACnB;GACAzD,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAMoG,0BAA0B,IAAI/F,wBAAAA;EAEpC,IAAIgG;EACJ,IAAIvB,OAAOwB,uBACPD,gBAAgB;GACZvF,MAAMN,+BAA+BgC;GACrC7B,YAAY,CAAC,QAAA;EACjB;EAGJoE,YAAYrC,YAAYqC,YAAYrC,aAAa,CAAC;EAClDqC,YAAYrC,UAAU6D,SAAS,CAC3B;GACIhE,UAAU8D;GACV1F,YAAY;IACRC,MAAM;IACNoF,QAAQ,MAAMI,wBAAwBf,QAAQP,OAAO0B,gBAAgB;IACrEhB,QAAQV,OAAO2B;GACnB;GACA/D,WAAW,EAAEgD,aAAa,CAAC1F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAAC+E,WAAAA;CACZ;CAEA,MAAM2B,KAAKC,WAAwD;EAC/D,MAAM7B,SAAS6B,UAAUC,QAAQrG,kBAAAA;EAEjC,OAAO;GACHkC,UAAU,KAAK/B,cAAa;GAC5BmG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKnE,YAAW;GACxBoE,OAAO,KAAKnE,WAAU;GACtBoE,QAAQ,MAAM,KAAKnC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CAAA;GAER;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;MAER;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;MAER;GACJ;;CAER;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAAA;IAChFzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAAA;EACnF;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAA;IACjB;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAA;IAEpBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAA;IACpBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;;IAKnBL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;MAEvB;GACJ;EACJ,CAAA;CAER;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C5C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAA;GACjB;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM0C,yBAAyB,IAAI5E,uBAAAA;EAEnC,IAAI6E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXrE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAA;EACjB;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAU6C,QAAQ,CAC1B;GACIhD,UAAU8C;GACVxE,YAAY;IACRC,MAAM;IACN0E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOrF,mBAAmB,OAAA;IAC1BsF,QAAQV,OAAOW;GACnB;GACAnD,WAAW,EAAEoD,aAAa,CAAC3F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,MAAM4F,2BAA2B,IAAIxF,yBAAAA;EAErC,IAAIyF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;;EAC1F;OAEAmF,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;;EAC1C;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAUwD,UAAU,CAC5B;GACI3D,UAAUyD;GACVnF,YAAY;IACRK,SAAS;IACTiF,YAAYpG,iBAAiBqG;IAC7BC,oBAAoBrG,yBAAyBsG;IAC7CxF,MAAM;IACNyF,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAhE,WAAW,EAAEoD,aAAa,CAAC3F,eAAAA,EAAiB;EAChD,CAAA;EAGJ,OAAO,CAACgF,WAAAA;CACZ;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BkG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKpE,YAAW;GACxBqE,OAAO,KAAKpE,WAAU;GACtBqE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/app/modules/provisioning/sources/file/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CAmBhD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAOlE,qBAAa,sBAAuB,YAAW,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAEnD,SAAS,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAEvC,OAAO,EAAE,+BAA+B;IAM9C,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;CA4ChD"}

package/dist/app/modules/provisioning/sources/file/module.mjs

@@ -4,10 +4,19 @@ import.meta.url;
 import { RootProvisioningValidator } from "../../../../../core/provisioning/entities/root/validator.mjs";
 import "../../../../../core/provisioning/entities/index.mjs";
 import { CompositeProvisioningSource } from "../composite/module.mjs";
-import { ValidatorGroup } from "@authup/kit";
+import "../composite/index.mjs";
+import { ValidatorGroup, isObject } from "@authup/kit";
 import path from "node:path";
-import { load, locateMany } from "locter";
+import { locateMany, read } from "locter";
 //#region src/app/modules/provisioning/sources/file/module.ts
+const MODULE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".mts",
+	".cts",
+	".js",
+	".mjs",
+	".cjs"
+]);
 var FileProvisioningSource = class {
 	options;
 	rootValidator;
@@ -16,12 +25,14 @@ var FileProvisioningSource = class {
 		this.rootValidator = new RootProvisioningValidator();
 	}
 	async load() {
-		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { path: path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd) });
+		const locations = await locateMany("*.{json,yaml,yml,ts,mts,mjs,js}", { cwd: path.isAbsolute(this.options.cwd) ? this.options.cwd : path.join(process.cwd(), this.options.cwd) });
 		const compositeSource = new CompositeProvisioningSource([]);
 		const output = {};
 		for (const location of locations) {
-			const raw = await load(location);
-			const data = await this.rootValidator.run(raw.default, { group: ValidatorGroup.PROVISIONING });
+			const raw = await read(location);
+			const entity = typeof location.extension === "string" && MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase()) && isObject(raw) && "default" in raw ? raw.default : raw;
+			if (!isObject(entity)) throw new Error(`The provisioning file "${location.path}" must contain an object at its root.`);
+			const data = await this.rootValidator.run(entity, { group: ValidatorGroup.PROVISIONING });
 			compositeSource.merge(output, data);
 		}
 		return output;

package/dist/app/modules/provisioning/sources/file/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ValidatorGroup","load","locateMany","path","RootProvisioningValidator","CompositeProvisioningSource","FileProvisioningSource","options","rootValidator","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","data","run","default","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup } from '@authup/kit';\nimport { load, locateMany } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { path: cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await load(location);\n            const data = await this.rootValidator.run(raw.default, { group: ValidatorGroup.PROVISIONING });\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;AAgBA,IAAaM,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIJ,0BAAAA;CAC7B;CAEA,MAAMH,OAAwC;EAK1C,MAAMY,YAAY,MAAMX,WAAW,mCAAmC,EAAEC,MAJ5DA,KAAKO,WAAW,KAAKH,QAAQE,GAAG,IACxC,KAAKF,QAAQE,MACbN,KAAKQ,KAAKC,QAAQH,IAAG,GAAI,KAAKF,QAAQE,GAAG,EAEqC,CAAA;EAElF,MAAMK,kBAAkB,IAAIT,4BAA4B,CAAA,CAAE;EAE1D,MAAMU,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMhB,KAAKe,QAAAA;GACvB,MAAME,OAAO,MAAM,KAAKV,cAAcW,IAAIF,IAAIG,SAAS,EAAEC,OAAOrB,eAAesB,aAAa,CAAA;GAE5FR,gBAAgBS,MAAMR,QAAQG,IAAAA;EAClC;EAEA,OAAOH;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["ValidatorGroup","isObject","locateMany","read","path","RootProvisioningValidator","CompositeProvisioningSource","MODULE_FILE_EXTENSIONS","Set","FileProvisioningSource","options","rootValidator","load","cwd","isAbsolute","join","process","locations","compositeSource","output","location","raw","isModule","extension","has","toLowerCase","entity","default","Error","data","run","group","PROVISIONING","merge"],"sources":["../../../../../../src/app/modules/provisioning/sources/file/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { ValidatorGroup, isObject } from '@authup/kit';\nimport { locateMany, read } from 'locter';\nimport path from 'node:path';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/index.ts';\nimport { RootProvisioningValidator } from '../../../../../core/provisioning/entities/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport { CompositeProvisioningSource } from '../composite/index.ts';\nimport type { FileEntitySchemaImporterOptions } from './types.ts';\n\n// Extensions locter loads as an ES module namespace ({ default, ...named }),\n// as opposed to data files (json/yaml/yml) whose parsed value is returned\n// directly. Only the former should have their `default` export unwrapped.\nconst MODULE_FILE_EXTENSIONS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);\n\nexport class FileProvisioningSource implements IProvisioningSource {\n    protected options: FileEntitySchemaImporterOptions;\n\n    protected rootValidator: RootProvisioningValidator;\n\n    constructor(options: FileEntitySchemaImporterOptions) {\n        this.options = options;\n\n        this.rootValidator = new RootProvisioningValidator();\n    }\n\n    async load(): Promise<RootProvisioningEntity> {\n        const cwd = path.isAbsolute(this.options.cwd) ?\n            this.options.cwd :\n            path.join(process.cwd(), this.options.cwd);\n\n        const locations = await locateMany('*.{json,yaml,yml,ts,mts,mjs,js}', { cwd });\n\n        const compositeSource = new CompositeProvisioningSource([]);\n\n        const output : RootProvisioningEntity = {};\n        for (const location of locations) {\n            const raw = await read(location);\n            // Unwrap the default export only for module files; a data file\n            // (json/yaml) whose root legitimately carries a `default` key must\n            // keep all of its keys.\n            const isModule = typeof location.extension === 'string' &&\n                MODULE_FILE_EXTENSIONS.has(location.extension.toLowerCase());\n            const entity = isModule && isObject(raw) && 'default' in raw ?\n                raw.default :\n                raw;\n\n            // Fail closed on a malformed root (top-level list/scalar, or an\n            // empty file parsing to null) instead of silently provisioning\n            // nothing — the same silent-skip class the loader otherwise avoids.\n            if (!isObject(entity)) {\n                throw new Error(`The provisioning file \"${location.path}\" must contain an object at its root.`);\n            }\n\n            // Provisioning files use the camelCase management vocabulary\n            // (plan 073). Keys are NOT rewritten here: a blanket snake->camel\n            // pass cannot tell a schema property from a data-identifier map key\n            // (`clientPermissions`/`clientRoles` are keyed by client name, and\n            // client names may contain underscores), so it would silently\n            // corrupt those keys. Unmounted keys are stripped by the validator.\n            const data = await this.rootValidator.run(\n                entity as Record<string, any>,\n                { group: ValidatorGroup.PROVISIONING },\n            );\n\n            compositeSource.merge(output, data);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;AAmBA,MAAMO,yCAAyB,IAAIC,IAAI;CAAC;CAAO;CAAQ;CAAQ;CAAO;CAAQ;CAAO;AAErF,IAAaC,yBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,SAA0C;EAClD,KAAKA,UAAUA;EAEf,KAAKC,gBAAgB,IAAIN,0BAAAA;CAC7B;CAEA,MAAMO,OAAwC;EAK1C,MAAMK,YAAY,MAAMf,WAAW,mCAAmC,EAAEW,KAJ5DT,KAAKU,WAAW,KAAKJ,QAAQG,GAAG,IACxC,KAAKH,QAAQG,MACbT,KAAKW,KAAKC,QAAQH,IAAG,GAAI,KAAKH,QAAQG,GAAG,EAE+B,CAAA;EAE5E,MAAMK,kBAAkB,IAAIZ,4BAA4B,CAAA,CAAE;EAE1D,MAAMa,SAAkC,CAAC;EACzC,KAAK,MAAMC,YAAYH,WAAW;GAC9B,MAAMI,MAAM,MAAMlB,KAAKiB,QAAAA;GAMvB,MAAMM,SAFW,OAAON,SAASG,cAAc,YAC3ChB,uBAAuBiB,IAAIJ,SAASG,UAAUE,YAAW,CAAA,KAClCxB,SAASoB,GAAAA,KAAQ,aAAaA,MACrDA,IAAIM,UACJN;GAKJ,IAAI,CAACpB,SAASyB,MAAAA,GACV,MAAM,IAAIE,MAAM,0BAA0BR,SAAShB,KAAK,sCAAsC;GASlG,MAAMyB,OAAO,MAAM,KAAKlB,cAAcmB,IAClCJ,QACA,EAAEK,OAAO/B,eAAegC,aAAa,CAAA;GAGzCd,gBAAgBe,MAAMd,QAAQU,IAAAA;EAClC;EAEA,OAAOV;CACX;AACJ"}

package/dist/app/modules/provisioning/sources/file/types.d.ts

@@ -1,4 +1,6 @@
+import type { Logger } from '@authup/server-kit';
 export type FileEntitySchemaImporterOptions = {
     cwd: string;
+    logger?: Logger;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/app/modules/provisioning/sources/file/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,+BAA+B,GAAG;IAC1C,GAAG,EAAE,MAAM,CAAA;CACd,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/file/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,+BAA+B,GAAG;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC"}

package/dist/app/modules/provisioning/sources/index.mjs

@@ -4,6 +4,7 @@ import.meta.url;
 import { DefaultProvisioningSource } from "./default/module.mjs";
 import "./default/index.mjs";
 import { CompositeProvisioningSource } from "./composite/module.mjs";
+import "./composite/index.mjs";
 import { FileProvisioningSource } from "./file/module.mjs";
 import "./file/index.mjs";
 export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource };

package/dist/components/database/unique-entries/module.mjs

@@ -20,12 +20,12 @@ var DatabaseUniqueEntriesComponent = class {
 	async enforceUniqueRoles() {
 		const repository = this.dataSource.getRepository(RoleEntity);
 		const queryBuilder = repository.createQueryBuilder("role");
-		queryBuilder.orderBy("role.created_at", "ASC");
+		queryBuilder.orderBy("role.createdAt", "ASC");
 		const aggregated = (await queryBuilder.getMany()).reduce((prev, curr) => {
 			const key = this.buildKey({
 				name: curr.name,
-				client_id: curr.client_id,
-				realm_id: curr.realm_id
+				clientId: curr.clientId,
+				realmId: curr.realmId
 			});
 			if (Array.isArray(prev[key])) prev[key].push(curr);
 			else prev[key] = [curr];
@@ -41,12 +41,12 @@ var DatabaseUniqueEntriesComponent = class {
 	async enforceUniquePermissions() {
 		const repository = this.dataSource.getRepository(PermissionEntity);
 		const queryBuilder = repository.createQueryBuilder("permission");
-		queryBuilder.orderBy("permission.created_at", "ASC");
+		queryBuilder.orderBy("permission.createdAt", "ASC");
 		const aggregated = (await queryBuilder.getMany()).reduce((prev, curr) => {
 			const key = this.buildKey({
 				name: curr.name,
-				client_id: curr.client_id,
-				realm_id: curr.realm_id
+				clientId: curr.clientId,
+				realmId: curr.realmId
 			});
 			if (Array.isArray(prev[key])) prev[key].push(curr);
 			else prev[key] = [curr];

package/dist/components/database/unique-entries/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["PermissionEntity","RoleEntity","DatabaseUniqueEntriesComponent","dataSource","start","enforceUniqueRoles","enforceUniquePermissions","repository","getRepository","queryBuilder","createQueryBuilder","orderBy","entities","getMany","aggregated","reduce","prev","curr","key","buildKey","name","client_id","realm_id","Array","isArray","push","keys","Object","rest","length","remove","props","map","join"],"sources":["../../../../src/components/database/unique-entries/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { DataSource } from 'typeorm';\nimport { PermissionEntity, RoleEntity } from '../../../adapters/database/domains/index.ts';\nimport type { Component } from '../../types.ts';\n\nexport class DatabaseUniqueEntriesComponent implements Component {\n    protected dataSource: DataSource;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n    }\n\n    /**\n     * Thus a unique check failed for mysql driver,\n     * existing duplicate entries must be removed.\n     */\n    async start() {\n        await this.enforceUniqueRoles();\n        await this.enforceUniquePermissions();\n    }\n\n    async enforceUniqueRoles() {\n        const repository = this.dataSource.getRepository(RoleEntity);\n        const queryBuilder = repository.createQueryBuilder('role');\n\n        queryBuilder.orderBy('role.created_at', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                client_id: curr.client_id,\n                realm_id: curr.realm_id,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, RoleEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    async enforceUniquePermissions() {\n        const repository = this.dataSource.getRepository(PermissionEntity);\n        const queryBuilder = repository.createQueryBuilder('permission');\n\n        queryBuilder.orderBy('permission.created_at', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                client_id: curr.client_id,\n                realm_id: curr.realm_id,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, PermissionEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    protected buildKey(props: Record<string, string | null>) {\n        const keys = Object.keys(props);\n\n        return keys\n            .map((key) => (typeof props[key] === 'string' ? props[key] : `${props[key]}`))\n            .join(':');\n    }\n}\n"],"mappings":";;;;;;;AAWA,IAAaE,iCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAwB;EAChC,KAAKA,aAAaA;CACtB;;;;IAMA,MAAMC,QAAQ;EACV,MAAM,KAAKC,mBAAkB;EAC7B,MAAM,KAAKC,yBAAwB;CACvC;CAEA,MAAMD,qBAAqB;EACvB,MAAME,aAAa,KAAKJ,WAAWK,cAAcP,UAAAA;EACjD,MAAMQ,eAAeF,WAAWG,mBAAmB,MAAA;EAEnDD,aAAaE,QAAQ,mBAAmB,KAAA;EAGxC,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,WAAWJ,KAAKI;IAChBC,UAAUL,KAAKK;GACnB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEA,MAAMtB,2BAA2B;EAC7B,MAAMC,aAAa,KAAKJ,WAAWK,cAAcR,gBAAAA;EACjD,MAAMS,eAAeF,WAAWG,mBAAmB,YAAA;EAEnDD,aAAaE,QAAQ,yBAAyB,KAAA;EAG9C,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,WAAWJ,KAAKI;IAChBC,UAAUL,KAAKK;GACnB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEUT,SAASY,OAAsC;EAGrD,OAFaJ,OAAOD,KAAKK,KAElBL,CAAAA,CACFM,KAAKd,QAAS,OAAOa,MAAMb,SAAS,WAAWa,MAAMb,OAAO,GAAGa,MAAMb,MAAM,CAAA,CAC3Ee,KAAK,GAAA;CACd;AACJ"}
+{"version":3,"file":"module.mjs","names":["PermissionEntity","RoleEntity","DatabaseUniqueEntriesComponent","dataSource","start","enforceUniqueRoles","enforceUniquePermissions","repository","getRepository","queryBuilder","createQueryBuilder","orderBy","entities","getMany","aggregated","reduce","prev","curr","key","buildKey","name","clientId","realmId","Array","isArray","push","keys","Object","rest","length","remove","props","map","join"],"sources":["../../../../src/components/database/unique-entries/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { DataSource } from 'typeorm';\nimport { PermissionEntity, RoleEntity } from '../../../adapters/database/domains/index.ts';\nimport type { Component } from '../../types.ts';\n\nexport class DatabaseUniqueEntriesComponent implements Component {\n    protected dataSource: DataSource;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n    }\n\n    /**\n     * Thus a unique check failed for mysql driver,\n     * existing duplicate entries must be removed.\n     */\n    async start() {\n        await this.enforceUniqueRoles();\n        await this.enforceUniquePermissions();\n    }\n\n    async enforceUniqueRoles() {\n        const repository = this.dataSource.getRepository(RoleEntity);\n        const queryBuilder = repository.createQueryBuilder('role');\n\n        queryBuilder.orderBy('role.createdAt', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                clientId: curr.clientId,\n                realmId: curr.realmId,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, RoleEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    async enforceUniquePermissions() {\n        const repository = this.dataSource.getRepository(PermissionEntity);\n        const queryBuilder = repository.createQueryBuilder('permission');\n\n        queryBuilder.orderBy('permission.createdAt', 'ASC');\n\n        const entities = await queryBuilder.getMany();\n        const aggregated = entities.reduce((prev, curr) => {\n            const key = this.buildKey({\n                name: curr.name,\n                clientId: curr.clientId,\n                realmId: curr.realmId,\n            });\n\n            if (Array.isArray(prev[key])) {\n                prev[key].push(curr);\n            } else {\n                prev[key] = [curr];\n            }\n\n            return prev;\n        }, {} as Record<string, PermissionEntity[]>);\n\n        const keys = Object.keys(aggregated);\n        for (const key of keys) {\n            const [, ...rest] = aggregated[key];\n            if (rest.length === 0) {\n                continue;\n            }\n\n            await repository.remove(rest);\n        }\n    }\n\n    protected buildKey(props: Record<string, string | null>) {\n        const keys = Object.keys(props);\n\n        return keys\n            .map((key) => (typeof props[key] === 'string' ? props[key] : `${props[key]}`))\n            .join(':');\n    }\n}\n"],"mappings":";;;;;;;AAWA,IAAaE,iCAAb,MAAaA;CACCC;CAEV,YAAYA,YAAwB;EAChC,KAAKA,aAAaA;CACtB;;;;IAMA,MAAMC,QAAQ;EACV,MAAM,KAAKC,mBAAkB;EAC7B,MAAM,KAAKC,yBAAwB;CACvC;CAEA,MAAMD,qBAAqB;EACvB,MAAME,aAAa,KAAKJ,WAAWK,cAAcP,UAAAA;EACjD,MAAMQ,eAAeF,WAAWG,mBAAmB,MAAA;EAEnDD,aAAaE,QAAQ,kBAAkB,KAAA;EAGvC,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEA,MAAMtB,2BAA2B;EAC7B,MAAMC,aAAa,KAAKJ,WAAWK,cAAcR,gBAAAA;EACjD,MAAMS,eAAeF,WAAWG,mBAAmB,YAAA;EAEnDD,aAAaE,QAAQ,wBAAwB,KAAA;EAG7C,MAAMG,cAAaF,MADIH,aAAaI,QAAO,EAAA,CACfE,QAAQC,MAAMC,SAAAA;GACtC,MAAMC,MAAM,KAAKC,SAAS;IACtBC,MAAMH,KAAKG;IACXC,UAAUJ,KAAKI;IACfC,SAASL,KAAKK;GAClB,CAAA;GAEA,IAAIC,MAAMC,QAAQR,KAAKE,IAAI,GACvBF,KAAKE,IAAI,CAACO,KAAKR,IAAAA;QAEfD,KAAKE,OAAO,CAACD,IAAAA;GAGjB,OAAOD;EACX,GAAG,CAAC,CAAA;EAEJ,MAAMU,OAAOC,OAAOD,KAAKZ,UAAAA;EACzB,KAAK,MAAMI,OAAOQ,MAAM;GACpB,MAAM,GAAG,GAAGE,QAAQd,WAAWI;GAC/B,IAAIU,KAAKC,WAAW,GAChB;GAGJ,MAAMtB,WAAWuB,OAAOF,IAAAA;EAC5B;CACJ;CAEUT,SAASY,OAAsC;EAGrD,OAFaJ,OAAOD,KAAKK,KAElBL,CAAAA,CACFM,KAAKd,QAAS,OAAOa,MAAMb,SAAS,WAAWa,MAAMb,OAAO,GAAGa,MAAMb,MAAM,CAAA,CAC3Ee,KAAK,GAAA;CACd;AACJ"}

package/dist/components/event-cleaner/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/event-cleaner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/event-cleaner/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/components/event-cleaner/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createEventCleanerComponent } from "./module.mjs";
+export { createEventCleanerComponent };

package/dist/components/event-cleaner/module.d.ts

@@ -0,0 +1,5 @@
+import type { Logger } from '@authup/server-kit';
+import type { DataSource } from 'typeorm';
+import type { Component } from '../types.ts';
+export declare function createEventCleanerComponent(dataSource: DataSource, logger?: Logger): Component;
+//# sourceMappingURL=module.d.ts.map

package/dist/components/event-cleaner/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/event-cleaner/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,2BAA2B,CACvC,UAAU,EAAE,UAAU,EACtB,MAAM,CAAC,EAAE,MAAM,GACf,SAAS,CA4BZ"}

package/dist/components/event-cleaner/module.mjs

@@ -0,0 +1,30 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EventEntity } from "../../adapters/database/domains/event/entity.mjs";
+import "../../adapters/database/domains/index.mjs";
+import { EventRepositoryAdapter } from "../../app/modules/database/repositories/event/repository.mjs";
+import "../../app/modules/database/repositories/index.mjs";
+import cron from "node-cron";
+//#region src/components/event-cleaner/module.ts
+function createEventCleanerComponent(dataSource, logger) {
+	return { async start() {
+		const repository = new EventRepositoryAdapter(dataSource.getRepository(EventEntity));
+		const execute = async () => {
+			try {
+				await repository.deleteExpired((/* @__PURE__ */ new Date()).toISOString());
+			} catch (e) {
+				logger?.warn("Sweeping expired audit events failed.");
+				logger?.warn(e);
+			}
+		};
+		await execute();
+		cron.schedule("* * * * *", async () => {
+			await execute();
+		});
+	} };
+}
+//#endregion
+export { createEventCleanerComponent };
+
+//# sourceMappingURL=module.mjs.map

package/dist/components/event-cleaner/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["cron","EventEntity","EventRepositoryAdapter","createEventCleanerComponent","dataSource","logger","start","repository","getRepository","execute","deleteExpired","Date","toISOString","e","warn","schedule"],"sources":["../../../src/components/event-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport cron from 'node-cron';\nimport type { Event } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { EventEntity } from '../../adapters/database/domains/index.ts';\nimport { EventRepositoryAdapter } from '../../app/modules/database/repositories/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createEventCleanerComponent(\n    dataSource: DataSource,\n    logger?: Logger,\n) : Component {\n    return {\n        async start() {\n            const repository = new EventRepositoryAdapter(\n                dataSource.getRepository<Event>(EventEntity),\n            );\n\n            // A failed sweep must never take the process down (start() is\n            // fire-and-forget → an uncaught rejection is fatal on modern\n            // node); the next tick simply retries.\n            const execute = async () => {\n                try {\n                    // Rows carry a per-row expires_at stamped at write time from\n                    // eventLogRetentionDays; null = keep forever.\n                    await repository.deleteExpired(new Date().toISOString());\n                } catch (e) {\n                    logger?.warn('Sweeping expired audit events failed.');\n                    logger?.warn(e);\n                }\n            };\n\n            await execute();\n\n            cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAeA,SAAgBG,4BACZC,YACAC,QAAe;CAEf,OAAO,EACH,MAAMC,QAAAA;EACF,MAAMC,aAAa,IAAIL,uBACnBE,WAAWI,cAAqBP,WAAAA,CAAAA;EAMpC,MAAMQ,UAAU,YAAA;GACZ,IAAI;IAGA,MAAMF,WAAWG,+BAAc,IAAIC,KAAAA,EAAAA,CAAOC,YAAW,CAAA;GACzD,SAASC,GAAG;IACRR,QAAQS,KAAK,uCAAA;IACbT,QAAQS,KAAKD,CAAAA;GACjB;EACJ;EAEA,MAAMJ,QAAAA;EAENT,KAAKe,SAAS,aAAa,YAAA;GACvB,MAAMN,QAAAA;EACV,CAAA;CACJ,EACJ;AACJ"}

package/dist/components/index.d.ts

@@ -1,4 +1,5 @@
 export * from './database/index.ts';
+export * from './event-cleaner/index.ts';
 export * from './oauth2-cleaner/index.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC"}

package/dist/components/index.mjs

@@ -4,6 +4,8 @@ import.meta.url;
 import { DatabaseUniqueEntriesComponent } from "./database/unique-entries/module.mjs";
 import { createDatabaseUniqueEntriesComponent } from "./database/unique-entries/factory.mjs";
 import "./database/index.mjs";
+import { createEventCleanerComponent } from "./event-cleaner/module.mjs";
+import "./event-cleaner/index.mjs";
 import { createOAuth2CleanerComponent } from "./oauth2-cleaner/module.mjs";
 import "./oauth2-cleaner/index.mjs";
-export { DatabaseUniqueEntriesComponent, createDatabaseUniqueEntriesComponent, createOAuth2CleanerComponent };
+export { DatabaseUniqueEntriesComponent, createDatabaseUniqueEntriesComponent, createEventCleanerComponent, createOAuth2CleanerComponent };

package/dist/components/oauth2-cleaner/module.d.ts

@@ -1,4 +1,5 @@
+import type { Logger } from '@authup/server-kit';
 import type { DataSource } from 'typeorm';
 import type { Component } from '../types.ts';
-export declare function createOAuth2CleanerComponent(dataSource: DataSource): Component;
+export declare function createOAuth2CleanerComponent(dataSource: DataSource, logger?: Logger): Component;
 //# sourceMappingURL=module.d.ts.map