@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/provisioning/synchronizer/user/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realm_id","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'user_id',\n            ownerRealmKey: 'user_realm_id',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realm_id: input.attributes.realm_id || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realm_id ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permission_id',\n                'permission_realm_id',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realm_id ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realm_id,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realm_id: attributes.realm_id,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realm_id,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'role_id',\n                'role_realm_id',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,UAAUN,MAAME,WAAWI,YAAY;EAC3C,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWI,WACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,iBACA,qBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWI,WACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,QAAQ,IAEvB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,UAAUJ,WAAWI;IACzB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,UACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,WACA,eAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Permission, \n    Role, \n    UserPermission, \n    UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n    IClientRepository,\n    IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n    protected userRepository: IUserRepository;\n\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n    constructor(ctx: UserProvisioningSynchronizerContext) {\n        super();\n\n        this.userRepository = ctx.userRepository;\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userPermissionRepository,\n            ownerKey: 'userId',\n            ownerRealmKey: 'userRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.userRoleRepository,\n            ownerKey: 'userId',\n            ownerRealmKey: 'userRealmId',\n        });\n    }\n\n    async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.userRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.userRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    if (\n                        strategy.attributes &&\n                        strategy.attributes.includes('email')\n                    ) {\n                        input.attributes.email = input.attributes.email ||\n                            attributes.email ||\n                            buildUserFakeEmail(input.attributes.name || attributes.name);\n                    }\n\n                    attributes = this.userRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.userRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.email = input.attributes.email ||\n                        attributes.email ||\n                        (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n                    input.attributes.id = attributes.id;\n                    attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            if (!input.attributes.email && input.attributes.name) {\n                input.attributes.email = buildUserFakeEmail(input.attributes.name);\n            }\n\n            attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n        }\n\n        // Permissions (Global, Realm & Client)\n        const permissions : Permission[] = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientPermissions) {\n            const clientKeys = Object.keys(input.relations.clientPermissions);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realmId: attributes.realmId,\n                });\n\n                if (client) {\n                    const entities = await this.permissionResolver.resolveClient(\n                        input.relations.clientPermissions[clientKey],\n                        attributes.realmId,\n                        client.id,\n                    );\n                    permissions.push(...entities);\n                }\n            }\n        }\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global, Realm & Client)\n        const roles : Role[] = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (input.relations && input.relations.clientRoles) {\n            const clientKeys = Object.keys(input.relations.clientRoles);\n            for (const clientKey of clientKeys) {\n                const client = await this.clientRepository.findOneBy({\n                    name: clientKey,\n                    realmId: attributes.realmId,\n                });\n\n                if (client) {\n                    const entities = await this.roleResolver.resolveClient(\n                        input.relations.clientRoles[clientKey],\n                        attributes.realmId,\n                        client.id,\n                    );\n                    roles.push(...entities);\n                }\n            }\n        }\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAAA,GAC5B,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAAA,GAEpDpB,WAAWI,UACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,OAAO,IAEtB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,gBACA,mBAAA;EAKR,MAAMgB,QAAiB,CAAA,GAChB,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAAA,GAE9ClC,WAAWI,UACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,OAAO,IAEtB,CAAA,CAAA;EAGR,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,UACA,aAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/query/index.d.ts

@@ -0,0 +1,4 @@
+export * from './module.ts';
+export * from './relations.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/query/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/query/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/core/query/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "./relations.mjs";
+import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./module.mjs";
+export { appendQueryConditions, createRelationsReadGate, decodeQuery, queryCodec, schemaRegistry };

package/dist/core/query/module.d.ts

@@ -0,0 +1,60 @@
+import type { ICondition, IQuery, ObjectLiteral } from '@rapiq/core';
+import { Query, SchemaRegistry } from '@rapiq/core';
+import type { DecodeQueryOptions } from './types.ts';
+/**
+ * Registry of every entity schema — the server-side allow-list layer.
+ * Relation traversal (e.g. a `realm.name` filter) resolves through the
+ * `schemaMapping` of the owning schema into the related schema's own
+ * allow-lists.
+ *
+ * The registry deliberately lives in core (persistence-agnostic): the
+ * schemas are security policy over the domain types, and services
+ * consume them to decode wire queries into the rapiq IR. A repository
+ * layer MAY extend the registry with additional, storage-derived
+ * schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`
+ * with the `registry` option — already-registered schemas take
+ * precedence), but the allow-lists themselves stay explicit and are
+ * never auto-derived from entity metadata.
+ */
+export declare const schemaRegistry: SchemaRegistry<any>;
+/**
+ * URL transport codec bound to the schema registry: decodes both the
+ * v2 expression dialect (stamped or detected) and legacy v1 bracket
+ * payloads, so pre-v2 clients keep working.
+ */
+export declare const queryCodec: import("@rapiq/codec-url").URLCodec;
+/**
+ * Decode a raw wire query (routup `useRequestQuery` output or a raw
+ * query string) against a registered schema into the rapiq IR. The
+ * schema's allow-lists, defaults and pagination bounds are applied
+ * here — downstream consumers (repository adapters) only execute the
+ * returned query.
+ *
+ * Async because the schema validate hooks are: the relations read
+ * gate (`createRelationsReadGate`) awaits the actor's permission
+ * pre-gate per include, and rapiq refuses async validators on the
+ * synchronous decode path. Pass the acting identity via
+ * `options.actor` on every request-driven decode (authenticated or
+ * anonymous — the HTTP adapter always builds one); a decode without
+ * an actor is a system call and runs unrestricted.
+ */
+export declare function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(input: unknown, options: DecodeQueryOptions<RECORD>): Promise<Query>;
+/**
+ * Append server-derived conditions (a route realm, an owner scope, ...)
+ * onto a decoded query by AND-wrapping its filter tree. The wrap makes
+ * the appended scope non-displaceable: unlike a filters merge (per-field
+ * replace, flat-root-AND restriction), a client-sent condition on the
+ * same field intersects with the scope instead of replacing it, and
+ * compound client trees (`or(...)`) are preserved as-is. Same guarantee
+ * class as a mandatory `andWhere` at the repository — expressed once in
+ * the IR. Appended conditions do not pass through `decodeQuery`, so the
+ * schema allow-lists do not constrain them (server-derived context).
+ *
+ * Immutable: returns a new `Query` whose filters node is the
+ * AND-wrapped successor (`IFilters.and`); every other parameter node is
+ * carried over **by reference**, so the input query stays untouched and
+ * nothing is copied. The node enumeration mirrors rapiq's
+ * `QueryContext` — keep it in sync when the IR gains a parameter.
+ */
+export declare function appendQueryConditions(query: IQuery, ...conditions: ICondition[]): Query;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/query/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/query/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,aAAa,EAEhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAY,MAAM,aAAa,CAAC;AAyB9D,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,qBAAuB,CAAC;AAiCnD;;;;GAIG;AACH,eAAO,MAAM,UAAU,qCAAiC,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,EAC1E,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,GACnC,OAAO,CAAC,KAAK,CAAC,CAYjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAI,KAAK,CAQxF"}

package/dist/core/query/module.mjs

@@ -0,0 +1,128 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { clientSchema } from "../entities/client/schema.mjs";
+import { clientPermissionSchema } from "../entities/client-permission/schema.mjs";
+import { clientRoleSchema } from "../entities/client-role/schema.mjs";
+import { clientScopeSchema } from "../entities/client-scope/schema.mjs";
+import { consentSchema } from "../entities/consent/schema.mjs";
+import { eventSchema } from "../entities/event/schema.mjs";
+import { identityProviderSchema } from "../entities/identity-provider/schema.mjs";
+import { identityProviderRoleMappingSchema } from "../entities/identity-provider-role-mapping/schema.mjs";
+import { keySchema } from "../entities/key/schema.mjs";
+import { permissionSchema } from "../entities/permission/schema.mjs";
+import { permissionPolicySchema } from "../entities/permission-policy/schema.mjs";
+import { policySchema } from "../entities/policy/schema.mjs";
+import { realmSchema } from "../entities/realm/schema.mjs";
+import { roleSchema } from "../entities/role/schema.mjs";
+import { roleAttributeSchema } from "../entities/role-attribute/schema.mjs";
+import { rolePermissionSchema } from "../entities/role-permission/schema.mjs";
+import { scopeSchema } from "../entities/scope/schema.mjs";
+import { sessionSchema } from "../entities/session/schema.mjs";
+import { trustAnchorSchema } from "../entities/trust-anchor/schema.mjs";
+import { userSchema } from "../entities/user/schema.mjs";
+import { userAttributeSchema } from "../entities/user-attribute/schema.mjs";
+import { userAuthenticatorSchema } from "../entities/user-authenticator/schema.mjs";
+import { userPermissionSchema } from "../entities/user-permission/schema.mjs";
+import { userRoleSchema } from "../entities/user-role/schema.mjs";
+import { Query, SchemaRegistry, isObject } from "@rapiq/core";
+import { createURLCodec } from "@rapiq/codec-url";
+//#region src/core/query/module.ts
+/**
+* Registry of every entity schema — the server-side allow-list layer.
+* Relation traversal (e.g. a `realm.name` filter) resolves through the
+* `schemaMapping` of the owning schema into the related schema's own
+* allow-lists.
+*
+* The registry deliberately lives in core (persistence-agnostic): the
+* schemas are security policy over the domain types, and services
+* consume them to decode wire queries into the rapiq IR. A repository
+* layer MAY extend the registry with additional, storage-derived
+* schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`
+* with the `registry` option — already-registered schemas take
+* precedence), but the allow-lists themselves stay explicit and are
+* never auto-derived from entity metadata.
+*/ const schemaRegistry = new SchemaRegistry();
+const schemas = [
+	clientSchema,
+	clientPermissionSchema,
+	clientRoleSchema,
+	clientScopeSchema,
+	consentSchema,
+	eventSchema,
+	identityProviderSchema,
+	identityProviderRoleMappingSchema,
+	keySchema,
+	permissionSchema,
+	permissionPolicySchema,
+	policySchema,
+	realmSchema,
+	roleSchema,
+	roleAttributeSchema,
+	rolePermissionSchema,
+	scopeSchema,
+	sessionSchema,
+	trustAnchorSchema,
+	userSchema,
+	userAttributeSchema,
+	userAuthenticatorSchema,
+	userPermissionSchema,
+	userRoleSchema
+];
+for (const schema of schemas) schemaRegistry.add(schema);
+/**
+* URL transport codec bound to the schema registry: decodes both the
+* v2 expression dialect (stamped or detected) and legacy v1 bracket
+* payloads, so pre-v2 clients keep working.
+*/ const queryCodec = createURLCodec(schemaRegistry);
+/**
+* Decode a raw wire query (routup `useRequestQuery` output or a raw
+* query string) against a registered schema into the rapiq IR. The
+* schema's allow-lists, defaults and pagination bounds are applied
+* here — downstream consumers (repository adapters) only execute the
+* returned query.
+*
+* Async because the schema validate hooks are: the relations read
+* gate (`createRelationsReadGate`) awaits the actor's permission
+* pre-gate per include, and rapiq refuses async validators on the
+* synchronous decode path. Pass the acting identity via
+* `options.actor` on every request-driven decode (authenticated or
+* anonymous — the HTTP adapter always builds one); a decode without
+* an actor is a system call and runs unrestricted.
+*/ async function decodeQuery(input, options) {
+	const normalized = isObject(input) || typeof input === "string" ? input : {};
+	return await queryCodec.decodeAsync(normalized, {
+		schema: options.schema,
+		parameters: options.parameters,
+		context: { actor: options.actor }
+	}) ?? new Query({});
+}
+/**
+* Append server-derived conditions (a route realm, an owner scope, ...)
+* onto a decoded query by AND-wrapping its filter tree. The wrap makes
+* the appended scope non-displaceable: unlike a filters merge (per-field
+* replace, flat-root-AND restriction), a client-sent condition on the
+* same field intersects with the scope instead of replacing it, and
+* compound client trees (`or(...)`) are preserved as-is. Same guarantee
+* class as a mandatory `andWhere` at the repository — expressed once in
+* the IR. Appended conditions do not pass through `decodeQuery`, so the
+* schema allow-lists do not constrain them (server-derived context).
+*
+* Immutable: returns a new `Query` whose filters node is the
+* AND-wrapped successor (`IFilters.and`); every other parameter node is
+* carried over **by reference**, so the input query stays untouched and
+* nothing is copied. The node enumeration mirrors rapiq's
+* `QueryContext` — keep it in sync when the IR gains a parameter.
+*/ function appendQueryConditions(query, ...conditions) {
+	return new Query({
+		fields: query.fields,
+		filters: query.filters.and(...conditions),
+		relations: query.relations,
+		pagination: query.pagination,
+		sorts: query.sorts
+	});
+}
+//#endregion
+export { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/query/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition, \n    IQuery, \n    ObjectLiteral, \n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\nconst schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. The wrap makes\n * the appended scope non-displaceable: unlike a filters merge (per-field\n * replace, flat-root-AND restriction), a client-sent condition on the\n * same field intersects with the scope instead of replacing it, and\n * compound client trees (`or(...)`) are preserved as-is. Same guarantee\n * class as a mandatory `andWhere` at the repository — expressed once in\n * the IR. Appended conditions do not pass through `decodeQuery`, so the\n * schema allow-lists do not constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDA,MAAa4B,iBAAiB,IAAI1B,eAAAA;AAElC,MAAM2B,UAA0B;CAC5BzB;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;;AAGJ,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAahC,eAAe4B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAajC,SAAS+B,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAIxC,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;GAmBA,SAAgByC,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI3C,MAAM;EACb4C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}

package/dist/core/query/relations.d.ts

@@ -0,0 +1,39 @@
+import type { KeyValidator } from '@rapiq/core';
+import { EntityType } from '@authup/core-kit';
+import type { QueryDecodeContext } from './types.ts';
+/**
+ * Build a rapiq `relations.validate` hook gating each include on the
+ * TARGET entity type's read permission (issue #3295): the actor must
+ * pass the derived pre-gate (`preEvaluateOneOf`, #3290) for the
+ * relation's mapped entity type — row data is unknown at decode time,
+ * so only a settled-false (the actor can never read that entity type)
+ * denies. A denial STRIPS the relation silently — the explicit
+ * `include=`, and (since rapiq beta.7, tada5hi/rapiq#815) every dotted
+ * `filter`/`sort`/`field` key that traverses the denied relation,
+ * whether or not it was explicitly included. rapiq records one
+ * authorization obligation per distinct relation reached by any
+ * parameter, evaluates this hook once for it, and prunes the dependent
+ * keys — the same fail-soft flavor as the allow-lists, so a scoped
+ * reader degrades to the un-joined / un-filtered row shape instead of
+ * a 403.
+ *
+ * `mapping` is the schema's own relation → entity-type `schemaMapping`;
+ * rapiq invokes the hook per include segment against the schema
+ * governing it, so nested paths (`include=user.realm`) are gated hop
+ * by hop by each governing schema's own hook. Unmapped relations and
+ * ungated targets neutral-pass.
+ *
+ * Caller classes: a SYSTEM call (no actor in the decode context) is
+ * unrestricted — the gate neutral-passes. A REQUEST call always
+ * carries an actor (`buildActorContext` supplies one even for an
+ * anonymous request), so restriction attaches at the request
+ * boundary: an authenticated actor is gated by its grants, an
+ * anonymous actor holds none and every gated include strips. A gate
+ * evaluation failure fails closed (strip).
+ *
+ * NOTE: schemas import this file DIRECTLY (never the `core/query`
+ * barrel) — the barrel reaches `module.ts`, which imports every
+ * schema; importing it from a schema would create a TDZ cycle.
+ */
+export declare function createRelationsReadGate(mapping: Record<string, `${EntityType}`>): KeyValidator<QueryDecodeContext | undefined>;
+//# sourceMappingURL=relations.d.ts.map

package/dist/core/query/relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../../../src/core/query/relations.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,UAAU,EAAkB,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkDrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,uBAAuB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC,GACxC,YAAY,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAuB/C"}

package/dist/core/query/relations.mjs

@@ -0,0 +1,103 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EntityType, PermissionName } from "@authup/core-kit";
+//#region src/core/query/relations.ts
+/**
+* Read gate per include target: the permission disjunction an actor
+* must hold (data-availability-derived pre-gate, issue #3290) for the
+* target entity type to be joinable via `include=` OR reachable via a
+* dotted `filter`/`sort`/`field` key. Mirrors each target service's own
+* `getMany` read pre-gate, so "may list the entity type" and "may join
+* it onto another list" stay one predicate.
+* Policies are deliberately gated under the PERMISSION family — they
+* are managed under the permission domain.
+*
+* Absent entries are ungated: `realm` (the realm list is public — the
+* login realm chooser reads it anonymously) and `identityProvider`
+* (the anonymous login page lists providers; its schema field
+* allow-list is the safe-DTO layer).
+*/ const RELATION_TARGET_READ_GATES = {
+	[EntityType.CLIENT]: [
+		PermissionName.CLIENT_READ,
+		PermissionName.CLIENT_UPDATE,
+		PermissionName.CLIENT_DELETE
+	],
+	[EntityType.USER]: [
+		PermissionName.USER_READ,
+		PermissionName.USER_UPDATE,
+		PermissionName.USER_DELETE
+	],
+	[EntityType.ROLE]: [
+		PermissionName.ROLE_READ,
+		PermissionName.ROLE_UPDATE,
+		PermissionName.ROLE_DELETE
+	],
+	[EntityType.SCOPE]: [
+		PermissionName.SCOPE_READ,
+		PermissionName.SCOPE_UPDATE,
+		PermissionName.SCOPE_DELETE
+	],
+	[EntityType.PERMISSION]: [
+		PermissionName.PERMISSION_READ,
+		PermissionName.PERMISSION_UPDATE,
+		PermissionName.PERMISSION_DELETE
+	],
+	[EntityType.POLICY]: [
+		PermissionName.PERMISSION_READ,
+		PermissionName.PERMISSION_UPDATE,
+		PermissionName.PERMISSION_DELETE
+	]
+};
+/**
+* Build a rapiq `relations.validate` hook gating each include on the
+* TARGET entity type's read permission (issue #3295): the actor must
+* pass the derived pre-gate (`preEvaluateOneOf`, #3290) for the
+* relation's mapped entity type — row data is unknown at decode time,
+* so only a settled-false (the actor can never read that entity type)
+* denies. A denial STRIPS the relation silently — the explicit
+* `include=`, and (since rapiq beta.7, tada5hi/rapiq#815) every dotted
+* `filter`/`sort`/`field` key that traverses the denied relation,
+* whether or not it was explicitly included. rapiq records one
+* authorization obligation per distinct relation reached by any
+* parameter, evaluates this hook once for it, and prunes the dependent
+* keys — the same fail-soft flavor as the allow-lists, so a scoped
+* reader degrades to the un-joined / un-filtered row shape instead of
+* a 403.
+*
+* `mapping` is the schema's own relation → entity-type `schemaMapping`;
+* rapiq invokes the hook per include segment against the schema
+* governing it, so nested paths (`include=user.realm`) are gated hop
+* by hop by each governing schema's own hook. Unmapped relations and
+* ungated targets neutral-pass.
+*
+* Caller classes: a SYSTEM call (no actor in the decode context) is
+* unrestricted — the gate neutral-passes. A REQUEST call always
+* carries an actor (`buildActorContext` supplies one even for an
+* anonymous request), so restriction attaches at the request
+* boundary: an authenticated actor is gated by its grants, an
+* anonymous actor holds none and every gated include strips. A gate
+* evaluation failure fails closed (strip).
+*
+* NOTE: schemas import this file DIRECTLY (never the `core/query`
+* barrel) — the barrel reaches `module.ts`, which imports every
+* schema; importing it from a schema would create a TDZ cycle.
+*/ function createRelationsReadGate(mapping) {
+	return async (name, context) => {
+		const target = mapping[name];
+		if (!target) return true;
+		const permissions = RELATION_TARGET_READ_GATES[target];
+		if (!permissions) return true;
+		if (!context || !context.actor) return true;
+		try {
+			await context.actor.permissionEvaluator.preEvaluateOneOf({ name: permissions });
+			return true;
+		} catch {
+			return false;
+		}
+	};
+}
+//#endregion
+export { createRelationsReadGate };
+
+//# sourceMappingURL=relations.mjs.map

package/dist/core/query/relations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.mjs","names":["EntityType","PermissionName","RELATION_TARGET_READ_GATES","CLIENT","CLIENT_READ","CLIENT_UPDATE","CLIENT_DELETE","USER","USER_READ","USER_UPDATE","USER_DELETE","ROLE","ROLE_READ","ROLE_UPDATE","ROLE_DELETE","SCOPE","SCOPE_READ","SCOPE_UPDATE","SCOPE_DELETE","PERMISSION","PERMISSION_READ","PERMISSION_UPDATE","PERMISSION_DELETE","POLICY","createRelationsReadGate","mapping","name","context","target","permissions","actor","permissionEvaluator","preEvaluateOneOf"],"sources":["../../../src/core/query/relations.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { KeyValidator } from '@rapiq/core';\nimport { EntityType, PermissionName } from '@authup/core-kit';\nimport type { QueryDecodeContext } from './types.ts';\n\n/**\n * Read gate per include target: the permission disjunction an actor\n * must hold (data-availability-derived pre-gate, issue #3290) for the\n * target entity type to be joinable via `include=` OR reachable via a\n * dotted `filter`/`sort`/`field` key. Mirrors each target service's own\n * `getMany` read pre-gate, so \"may list the entity type\" and \"may join\n * it onto another list\" stay one predicate.\n * Policies are deliberately gated under the PERMISSION family — they\n * are managed under the permission domain.\n *\n * Absent entries are ungated: `realm` (the realm list is public — the\n * login realm chooser reads it anonymously) and `identityProvider`\n * (the anonymous login page lists providers; its schema field\n * allow-list is the safe-DTO layer).\n */\nconst RELATION_TARGET_READ_GATES : Partial<Record<`${EntityType}`, PermissionName[]>> = {\n    [EntityType.CLIENT]: [\n        PermissionName.CLIENT_READ,\n        PermissionName.CLIENT_UPDATE,\n        PermissionName.CLIENT_DELETE,\n    ],\n    [EntityType.USER]: [\n        PermissionName.USER_READ,\n        PermissionName.USER_UPDATE,\n        PermissionName.USER_DELETE,\n    ],\n    [EntityType.ROLE]: [\n        PermissionName.ROLE_READ,\n        PermissionName.ROLE_UPDATE,\n        PermissionName.ROLE_DELETE,\n    ],\n    [EntityType.SCOPE]: [\n        PermissionName.SCOPE_READ,\n        PermissionName.SCOPE_UPDATE,\n        PermissionName.SCOPE_DELETE,\n    ],\n    [EntityType.PERMISSION]: [\n        PermissionName.PERMISSION_READ,\n        PermissionName.PERMISSION_UPDATE,\n        PermissionName.PERMISSION_DELETE,\n    ],\n    [EntityType.POLICY]: [\n        PermissionName.PERMISSION_READ,\n        PermissionName.PERMISSION_UPDATE,\n        PermissionName.PERMISSION_DELETE,\n    ],\n};\n\n/**\n * Build a rapiq `relations.validate` hook gating each include on the\n * TARGET entity type's read permission (issue #3295): the actor must\n * pass the derived pre-gate (`preEvaluateOneOf`, #3290) for the\n * relation's mapped entity type — row data is unknown at decode time,\n * so only a settled-false (the actor can never read that entity type)\n * denies. A denial STRIPS the relation silently — the explicit\n * `include=`, and (since rapiq beta.7, tada5hi/rapiq#815) every dotted\n * `filter`/`sort`/`field` key that traverses the denied relation,\n * whether or not it was explicitly included. rapiq records one\n * authorization obligation per distinct relation reached by any\n * parameter, evaluates this hook once for it, and prunes the dependent\n * keys — the same fail-soft flavor as the allow-lists, so a scoped\n * reader degrades to the un-joined / un-filtered row shape instead of\n * a 403.\n *\n * `mapping` is the schema's own relation → entity-type `schemaMapping`;\n * rapiq invokes the hook per include segment against the schema\n * governing it, so nested paths (`include=user.realm`) are gated hop\n * by hop by each governing schema's own hook. Unmapped relations and\n * ungated targets neutral-pass.\n *\n * Caller classes: a SYSTEM call (no actor in the decode context) is\n * unrestricted — the gate neutral-passes. A REQUEST call always\n * carries an actor (`buildActorContext` supplies one even for an\n * anonymous request), so restriction attaches at the request\n * boundary: an authenticated actor is gated by its grants, an\n * anonymous actor holds none and every gated include strips. A gate\n * evaluation failure fails closed (strip).\n *\n * NOTE: schemas import this file DIRECTLY (never the `core/query`\n * barrel) — the barrel reaches `module.ts`, which imports every\n * schema; importing it from a schema would create a TDZ cycle.\n */\nexport function createRelationsReadGate(\n    mapping: Record<string, `${EntityType}`>,\n) : KeyValidator<QueryDecodeContext | undefined> {\n    return async (name, context) => {\n        const target = mapping[name];\n        if (!target) {\n            return true;\n        }\n\n        const permissions = RELATION_TARGET_READ_GATES[target];\n        if (!permissions) {\n            return true;\n        }\n\n        if (!context || !context.actor) {\n            return true;\n        }\n\n        try {\n            await context.actor.permissionEvaluator.preEvaluateOneOf({ name: permissions });\n            return true;\n        } catch {\n            return false;\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GA0BA,MAAME,6BAAkF;EACnFF,WAAWG,SAAS;EACjBF,eAAeG;EACfH,eAAeI;EACfJ,eAAeK;;EAElBN,WAAWO,OAAO;EACfN,eAAeO;EACfP,eAAeQ;EACfR,eAAeS;;EAElBV,WAAWW,OAAO;EACfV,eAAeW;EACfX,eAAeY;EACfZ,eAAea;;EAElBd,WAAWe,QAAQ;EAChBd,eAAee;EACff,eAAegB;EACfhB,eAAeiB;;EAElBlB,WAAWmB,aAAa;EACrBlB,eAAemB;EACfnB,eAAeoB;EACfpB,eAAeqB;;EAElBtB,WAAWuB,SAAS;EACjBtB,eAAemB;EACfnB,eAAeoB;EACfpB,eAAeqB;;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCA,SAAgBE,wBACZC,SAAwC;CAExC,OAAO,OAAOC,MAAMC,YAAAA;EAChB,MAAMC,SAASH,QAAQC;EACvB,IAAI,CAACE,QACD,OAAO;EAGX,MAAMC,cAAc3B,2BAA2B0B;EAC/C,IAAI,CAACC,aACD,OAAO;EAGX,IAAI,CAACF,WAAW,CAACA,QAAQG,OACrB,OAAO;EAGX,IAAI;GACA,MAAMH,QAAQG,MAAMC,oBAAoBC,iBAAiB,EAAEN,MAAMG,YAAY,CAAA;GAC7E,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ"}

package/dist/core/query/types.d.ts

@@ -0,0 +1,39 @@
+import type { ObjectLiteral, Parameter, Schema } from '@rapiq/core';
+import type { ActorContext } from '@authup/server-kit';
+export type QueryParameter = `${Parameter}`;
+/**
+ * Caller context threaded through the decode into every schema
+ * validate hook (rapiq `ParseQueryOptions['context']`). Carries the
+ * acting identity so per-key gates — the relations read gate — can
+ * consult its permissions. An actor-less context is a SYSTEM call
+ * and passes ungated; request surfaces always supply an actor (an
+ * anonymous one holds no grants, so gated includes strip).
+ */
+export type QueryDecodeContext = {
+    actor?: ActorContext;
+};
+export type DecodeQueryOptions<RECORD extends ObjectLiteral = ObjectLiteral> = {
+    /**
+     * The schema (or name of the registered schema) to validate
+     * against.
+     */
+    schema: Schema<RECORD> | string;
+    /**
+     * Restrict which parameters are processed (default: all). A
+     * parameter that is not listed is neither parsed nor defaulted.
+     * E.g. a bulk-delete selection processes `['filters']` only, so a
+     * schema `pagination.maxLimit` can never silently truncate the
+     * affected row set.
+     */
+    parameters?: QueryParameter[];
+    /**
+     * The acting identity, forwarded to the schema validate hooks as
+     * the decode context. Every REQUEST decode must pass it — the
+     * HTTP adapter builds an actor for authenticated and anonymous
+     * requests alike, so restriction attaches at the request
+     * boundary. Omitting it marks a SYSTEM decode, which runs
+     * unrestricted.
+     */
+    actor?: ActorContext;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/query/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/query/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG,GAAG,SAAS,EAAE,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC7B,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,IAAI;IAC3E;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC"}

package/dist/core/query/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/security/policy/evaluator.d.ts

@@ -7,6 +7,7 @@ export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluato
     protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
     protected identityPermissionProvider: IIdentityPermissionProvider;
     constructor(identityPermissionProvider: IIdentityPermissionProvider);
+    requires(): string[];
     accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }

package/dist/core/security/policy/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,gBAAgB,EAChB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEH,uBAAuB,EACvB,gCAAgC,EAGhC,yBAAyB,EAI5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAO7D,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA2G5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/security/policy/evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACR,gBAAgB,EAChB,iCAAiC,EACjC,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEH,uBAAuB,EACvB,gCAAgC,EAGhC,yBAAyB,EAM5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEtF,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,2BAA2B,CAAC;gBAEtD,0BAA0B,EAAE,2BAA2B;IAOnE,QAAQ,IAAK,MAAM,EAAE;IAQf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA+L5G"}

package/dist/core/security/policy/evaluator.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, RealmMatchPolicyEvaluator, aggregatePermissionPolicyBindings, definePolicyIssueItem, maybeInvertPolicyOutcome } from "@authup/access";
+import { BuiltInPolicyType, IdentityPolicyEvaluator, PermissionBindingPolicyValidator, PolicyEngine, PolicyIssueCode, RealmMatchPolicyEvaluator, RealmScope, aggregatePermissionPolicyBindings, definePolicyIssueItem, maybeInvertPolicyOutcome, normalizeRealmScope } from "@authup/access";
+import { and, or } from "@rapiq/core";
 //#region src/core/security/policy/evaluator.ts
 var PermissionBindingPolicyEvaluator = class {
 	validator;
@@ -14,6 +15,9 @@ var PermissionBindingPolicyEvaluator = class {
 		this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
 		this.identityPermissionProvider = identityPermissionProvider;
 	}
+	requires() {
+		return [BuiltInPolicyType.PERMISSION_BINDING];
+	}
 	async accessData(ctx) {
 		if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) return null;
 		if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);
@@ -44,22 +48,65 @@ var PermissionBindingPolicyEvaluator = class {
 		};
 		const identityBindings = await this.identityPermissionProvider.getFor(identity).then((bindings) => bindings.filter((item) => {
 			if (item.permission.name !== binding.permission.name) return false;
-			return (binding.permission.realm_id ?? null) === (item.permission.realm_id ?? null) && (binding.permission.client_id ?? null) === (item.permission.client_id ?? null);
+			return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) && (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);
 		}));
 		if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 		const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
 		if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 		const issues = [];
+		const pendingIssues = [];
+		const conditions = [];
+		let pending = false;
+		let lowerable = true;
 		for (const grant of aggr.grants) {
-			if (!(await this.realmMatchEvaluator.evaluate({ scope: grant.realm_scope }, ctx)).success) continue;
-			if (!grant.policy) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			let reachCondition = null;
+			const realmOutcome = await this.realmMatchEvaluator.evaluate({ scope: grant.realmScope }, ctx);
+			if (realmOutcome.pending) {
+				const scope = normalizeRealmScope(grant.realmScope);
+				if (scope === RealmScope.NONE) continue;
+				if (scope !== RealmScope.ANY) {
+					if (!realmOutcome.condition) {
+						pending = true;
+						lowerable = false;
+						continue;
+					}
+					reachCondition = realmOutcome.condition;
+				}
+			} else if (!realmOutcome.success) continue;
+			if (!grant.policy) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
 			const outcome = await new PolicyEngine(ctx.evaluators).evaluate(grant.policy, {
 				...ctx,
 				path: [...ctx.path || []]
 			});
-			if (outcome.success) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+			if (outcome.success) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
+			if (outcome.pending) {
+				pending = true;
+				if (ctx.withConditions && outcome.condition) conditions.push(reachCondition ? and(reachCondition, outcome.condition) : outcome.condition);
+				else lowerable = false;
+				if (outcome.issues) pendingIssues.push(...outcome.issues);
+				continue;
+			}
 			if (outcome.issues) issues.push(...outcome.issues);
 		}
+		if (pending) {
+			const result = {
+				success: false,
+				pending: true,
+				issues: pendingIssues
+			};
+			if (ctx.withConditions && lowerable && conditions.length > 0) result.condition = conditions.length === 1 ? conditions[0] : or(...conditions);
+			return result;
+		}
 		const success = maybeInvertPolicyOutcome(false, policy.invert);
 		return {
 			success,