@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","session_id","kind","parent_id","refresh_token_id","ip_address","user_agent","consumed_at","revoked_at","expires_at","insert","created_at","Date","toISOString","findOneById","findOne","where","findBySessionId","sessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","parentId","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            session_id: input.session_id,\n            kind: input.kind,\n            parent_id: input.parent_id ?? null,\n            refresh_token_id: input.refresh_token_id ?? null,\n            ip_address: input.ip_address,\n            user_agent: input.user_agent,\n            consumed_at: null,\n            revoked_at: null,\n            expires_at: input.expires_at,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined created_at.\n        entity.created_at = entity.created_at ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { session_id: sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumed_at: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumed_at IS NULL')\n            .andWhere('revoked_at IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder()\n            .where('parent_id = :parentId', { parentId })\n            .andWhere('consumed_at IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revoked_at: at })\n            .where('id = :id', { id })\n            .andWhere('revoked_at IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { session_id: sessionId },\n            select: ['id', 'expires_at'],\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expires_at: row.expires_at,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revoked_at: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revoked_at IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expires_at: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,YAAYH,MAAMG;GAClBC,MAAMJ,MAAMI;GACZC,WAAWL,MAAMK,aAAa;GAC9BC,kBAAkBN,MAAMM,oBAAoB;GAC5CC,YAAYP,MAAMO;GAClBC,YAAYR,MAAMQ;GAClBC,aAAa;GACbC,YAAY;GACZC,YAAYX,MAAMW;EACtB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,aAAaZ,OAAOY,+BAAc,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE/D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBC,WAA4C;EAC9D,OAAO,KAAKxB,WAAWyB,KAAK,EAAEH,OAAO,EAAEf,YAAYiB,UAAU,EAAE,CAAA;CACnE;CAEA,MAAME,oBAAoBpB,IAAYqB,IAA8B;EAUhE,SAAQC,MATa,KAAK5B,WAAW6B,mBAAkB,CAAA,CAClDC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAElB,aAAac,GAAG,CAAA,CAAA,CACtBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,qBAAA,CAAA,CACTA,SAAS,oBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBC,UAAoC;EAMvD,OAAOC,MALa,KAAKrC,WAAW6B,mBAAkB,CAAA,CACjDP,MAAM,yBAAyB,EAAEc,SAAS,CAAA,CAAA,CAC1CJ,SAAS,yBAAA,CAAA,CACTM,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYqB,IAA2B;EACpD,MAAM,KAAK3B,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvB0B,SAAS,oBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMO,kBAAkBhB,WAAmBG,IAAwC;EAM/E,MAAMgB,QAA0BF,MALb,KAAKzC,WAAWyB,KAAK;GACpCH,OAAO,EAAEf,YAAYiB,UAAU;GAC/BkB,QAAQ,CAAC,MAAM,YAAA;EACnB,CAAA,EAAA,CAEqCE,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRS,YAAY8B,IAAI9B;EACpB,EAAA;EACA,IAAI4B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW6B,mBAAkB,CAAA,CACnCC,OAAOhC,kBAAAA,CAAAA,CACPiC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBL,MAAM,EAAEhB,IAAIV,GAAG+C,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C0B,SAAS,oBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOU;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOrB,MAFc,KAAK5B,WAAWkD,OAAO,EAAEnC,YAAYlB,SAASoD,MAAAA,EAAQ,CAAA,EAAA,CAE7Df,YAAY;CAC9B;AACJ"}
+{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,MAAMJ,MAAMI;GACZC,UAAUL,MAAMK,YAAY;GAC5BC,gBAAgBN,MAAMM,kBAAkB;GACxCC,WAAWP,MAAMO;GACjBC,WAAWR,MAAMQ;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWX,MAAMW;EACrB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,YAAYZ,OAAOY,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBhB,WAA4C;EAC9D,OAAO,KAAKP,WAAWwB,KAAK,EAAEF,OAAO,EAAEf,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMkB,oBAAoBnB,IAAYoB,IAA8B;EAUhE,SAAQC,MATa,KAAK3B,WAAW4B,mBAAkB,CAAA,CAClDC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,gBAAgB,EAAEvB,MAAM,UAAU,CAAA,CAAA,CAC3CuB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBzB,UAAoC;EAMvD,OAAO0B,MALa,KAAKnC,WAAW4B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEb,SAAS,CAAA,CAAA,CACtDsB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAW/B,IAAYoB,IAA2B;EACpD,MAAM,KAAK1B,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkB/B,WAAmBmB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKvC,WAAWwB,KAAK;GACpCF,OAAO,EAAEf,UAAU;GACnBiC,QAAQ;IAAElC,IAAI;IAAMS,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC2B,KAAKC,SAAS;GAC/CrC,IAAIqC,IAAIrC;GACRS,WAAW4B,IAAI5B;EACnB,EAAA;EACA,IAAI0B,KAAKG,SAAS,GACd,MAAM,KAAK5C,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAEhB,IAAIV,GAAG6C,KAAKC,KAAKG,QAAQA,IAAIvC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1CyB,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOpB,MAFc,KAAK3B,WAAWgD,OAAO,EAAEjC,WAAWlB,SAASkD,MAAAA,EAAQ,CAAA,EAAA,CAE5Dd,YAAY;CAC9B;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAsBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAYxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAOH,uBAAuB,EAW1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+KjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAmBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAOH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAiKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -10,10 +10,7 @@ import { PermissionEntity } from "../../../adapters/database/domains/permission/
 import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
 import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
 import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
-import { RobotEntity } from "../../../adapters/database/domains/robot/entity.mjs";
 import { PermissionPolicyEntity } from "../../../adapters/database/domains/permission-policy/entity.mjs";
-import { RobotPermissionEntity } from "../../../adapters/database/domains/robot-permission/entity.mjs";
-import { RobotRoleEntity } from "../../../adapters/database/domains/robot-role/entity.mjs";
 import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
 import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
@@ -28,7 +25,6 @@ import { PolicyProvisioningSynchronizer } from "../../../core/provisioning/synch
 import { RealmProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/realm/module.mjs";
 import { RoleProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/role/module.mjs";
 import { GraphProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/root/module.mjs";
-import { RobotProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/robot/module.mjs";
 import { ScopeProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/user/module.mjs";
 import "../../../core/provisioning/synchronizer/index.mjs";
@@ -45,9 +41,6 @@ import { KeyRepositoryAdapter } from "../database/repositories/key/repository.mj
 import { PermissionRepositoryAdapter } from "../database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "../database/repositories/permission-policy/repository.mjs";
 import { PolicyRepositoryAdapter } from "../database/repositories/policy/repository.mjs";
-import { RobotRepositoryAdapter } from "../database/repositories/robot/repository.mjs";
-import { RobotPermissionRepositoryAdapter } from "../database/repositories/robot-permission/repository.mjs";
-import { RobotRoleRepositoryAdapter } from "../database/repositories/robot-role/repository.mjs";
 import { RoleRepositoryAdapter } from "../database/repositories/role/repository.mjs";
 import { RolePermissionRepositoryAdapter } from "../database/repositories/role-permission/repository.mjs";
 import { ScopeRepositoryAdapter } from "../database/repositories/scope/repository.mjs";
@@ -80,7 +73,10 @@ var ProvisionerModule = class {
 		const sources = [...this.sources];
 		const config = container.resolve(ConfigInjectionKey);
 		const provisioningDir = path.join(config.writableDirectoryPath, "provisioning");
-		if (fs.existsSync(provisioningDir)) sources.push(new FileProvisioningSource({ cwd: provisioningDir }));
+		if (fs.existsSync(provisioningDir)) sources.push(new FileProvisioningSource({
+			cwd: provisioningDir,
+			logger: container.resolve(LoggerInjectionKey)
+		}));
 		const data = await new CompositeProvisioningSource(sources).load(container);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const realmRepository = container.resolve(RealmEntity);
@@ -135,16 +131,6 @@ var ProvisionerModule = class {
 			roleRepository,
 			permissionRepository
 		});
-		const robotSynchronizer = new RobotProvisioningSynchronizer({
-			robotRepository: new RobotRepositoryAdapter({
-				repository: container.resolve(RobotEntity),
-				realmRepository
-			}),
-			robotRoleRepository: new RobotRoleRepositoryAdapter(container.resolve(RobotRoleEntity)),
-			robotPermissionRepository: new RobotPermissionRepositoryAdapter(container.resolve(RobotPermissionEntity)),
-			roleRepository,
-			permissionRepository
-		});
 		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: new ScopeRepositoryAdapter({
 			repository: container.resolve(ScopeEntity),
 			realmRepository
@@ -159,7 +145,6 @@ var ProvisionerModule = class {
 				roleSynchronizer,
 				permissionSynchronizer,
 				userSynchronizer,
-				robotSynchronizer,
 				scopeSynchronizer
 			}),
 			scopeSynchronizer
@@ -186,11 +171,11 @@ var ProvisionerModule = class {
 		const permissionRepo = dataSource.getRepository(PermissionEntity);
 		const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);
 		const permissions = await permissionRepo.find();
-		for (const permission of permissions) if (!await junctionRepo.findOneBy({ permission_id: permission.id })) await junctionRepo.save(junctionRepo.create({
-			permission_id: permission.id,
-			permission_realm_id: permission.realm_id,
-			policy_id: defaultPolicy.id,
-			policy_realm_id: defaultPolicy.realm_id
+		for (const permission of permissions) if (!await junctionRepo.findOneBy({ permissionId: permission.id })) await junctionRepo.save(junctionRepo.create({
+			permissionId: permission.id,
+			permissionRealmId: permission.realmId,
+			policyId: defaultPolicy.id,
+			policyRealmId: defaultPolicy.realmId
 		}));
 	}
 };

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RobotEntity","RobotPermissionEntity","RobotRoleEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RobotProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RobotPermissionRepositoryAdapter","RobotRepositoryAdapter","RobotRoleRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","robotSynchronizer","robotRepository","robotRoleRepository","robotPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","logger","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permission_id","id","save","create","permission_realm_id","realm_id","policy_id","policy_realm_id"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Robot,\n    RobotPermission,\n    RobotRole,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RobotEntity,\n    RobotPermissionEntity,\n    RobotRoleEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RobotProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RobotPermissionRepositoryAdapter,\n    RobotRepositoryAdapter,\n    RobotRoleRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({ cwd: provisioningDir }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const robotSynchronizer = new RobotProvisioningSynchronizer({\n            robotRepository: new RobotRepositoryAdapter({\n                repository: container.resolve<Repository<Robot>>(RobotEntity),\n                realmRepository,\n            }),\n            robotRoleRepository: new RobotRoleRepositoryAdapter(\n                container.resolve<Repository<RobotRole>>(RobotRoleEntity),\n            ),\n            robotPermissionRepository: new RobotPermissionRepositoryAdapter(\n                container.resolve<Repository<RobotPermission>>(RobotPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            robotSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on built_in inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permission_id: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permission_id: permission.id,\n                    permission_realm_id: permission.realm_id,\n                    policy_id: defaultPolicy.id,\n                    policy_realm_id: defaultPolicy.realm_id,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,IAAauD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB,EAAEiB,KAAKL,gBAAgB,CAAA,CAAA;EAInE,MAAMO,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAElC,MAAMY,aAAaZ,UAAUE,QAAQtB,qBAAqBiC,UAAU;EACpE,MAAMC,kBAAkBd,UAAUE,QAA2B7D,WAAAA;EAE7D,MAAM0E,uBAAuB,IAAI/C,4BAA4B;GACzDgD,YAAYhB,UAAUE,QAAsC9D,gBAAAA;GAC5D0E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIhD,wBAAwB;GACjD+C,YAAY,IAAIhE,iBAAiB4D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAInD,kCACnCiC,UAAUE,QAAsCnD,sBAAAA,CAAAA;EAGpD,MAAMoE,qBAAqB,IAAI9D,+BAA+B;GAC1D2D,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI7C,sBAAsB;GAC7CyC,YAAYhB,UAAUE,QAA0BzD,UAAAA;GAChDqE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIzD,wBAAwB;GACjDoD,YAAYhB,UAAUE,QAA4BjE,YAAAA;GAClD6E;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAIlE,mCAAmC;GAClE4D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI/D,6BAA6B;GACtDwD,YAAYI;GACZL;GACAS,0BAA0B,IAAIlD,gCAC1B0B,UAAUE,QAAoCxD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DmE;GACAK,sBAAsB,IAAI7D,4BACtBmC,UAAUE,QAAgC/D,gBAAAA,CAAAA;GAE9CwF,4BAA4B,IAAIhE,kCAC5BqC,UAAUE,QAAsChE,sBAAAA,CAAAA;GAGpDkF;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIlE,6BAA6B;GACtDmE,gBAAgB,IAAInD,sBAAsB;IACtCsC,YAAY,IAAI/D,eAAe2D,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAInD,0BACpBqB,UAAUE,QAA8BrD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAItD,gCAC1BuB,UAAUE,QAAoCtD,oBAAAA,CAAAA;GAGlDyE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMiB,oBAAoB,IAAIzE,8BAA8B;GACxD0E,iBAAiB,IAAI7D,uBAAuB;IACxC4C,YAAYhB,UAAUE,QAA2B5D,WAAAA;IACjDwE;GACJ,CAAA;GACAoB,qBAAqB,IAAI7D,2BACrB2B,UAAUE,QAA+B1D,eAAAA,CAAAA;GAE7C2F,2BAA2B,IAAIhE,iCAC3B6B,UAAUE,QAAqC3D,qBAAAA,CAAAA;GAGnD6E;GACAL;EACJ,CAAA;EAOA,MAAMsB,oBAAoB,IAAI5E,8BAA8B,EAAEuD,YAAYoB,IAL9C5D,uBAAuB;GAC/CwC,YAAYhB,UAAUE,QAA2BvD,WAAAA;GACjDmE;EACJ,CAE0EsB,EAAgB,CAAA;EAqB1F,MAAMG,IARuBpF,8BAA8B;GACvDgE;GACAG;GACAC;GACAe,mBAAAA,IAf0BhF,8BAA8B;IACxD0D,YAAY,IAAI9C,uBAAuB4C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAI;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY9B,IAAAA;EAOnC,MAAM+B,uBAAuB,IAAIrD,qBAAqB;GAClDiC;GACAqB,YAAYzD,cAAcgB,MAAAA;GAC1B0C,QAAQ3C,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMyD,iBAAiB,IAAIvD,eAAe;GACtCwD,UAAU,IAAI/E,qBAAqB8C,YAAY,EAC3CkC,eAAe7C,OAAO8C,uBAClB,IAAI7D,gBAAgBe,OAAO8C,oBAAoB,IAC/C,KACR,CAAA;GACAJ,QAAQ3C,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM6D,SAAS,MAAMlC,gBAAgBmC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMP,qBAAqBU,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAIjD,OAAOmD,oCACP,MAAM,KAAKC,oBAAoBzC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBoC,oBACZzC,YACAK,kBACa;EACb,MAAMqC,gBAAgB,MAAMrC,iBAAiBsC,cAAczG,iBAAiB0G,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiB7C,WAAW8C,cAActH,gBAAAA;EAChD,MAAMuH,eAAe/C,WAAW8C,cAAc3G,sBAAAA;EAE9C,MAAM6G,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,eAAeH,WAAWI,GAAG,CAAA,GAG7E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,eAAeH,WAAWI;GAC1BG,qBAAqBP,WAAWQ;GAChCC,WAAWhB,cAAcW;GACzBM,iBAAiBjB,cAAce;EACnC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAagD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAAA;EACnD,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAA,GAAI,KAAKA,OAAAA;EAEzB,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BtD,WAAAA;EAE7D,MAAMoE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCvD,gBAAAA;GAC5DoE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsC/C,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BrD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIvD,wBAAwB;GACjDkD,YAAYjB,UAAUE,QAA4B1D,YAAAA;GAClDuE;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI7D,6BAA6B;GACtDsD,YAAYI;GACZL;GACAS,0BAA0B,IAAInD,gCAC1B0B,UAAUE,QAAoCpD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI3D,4BACtBgC,UAAUE,QAAgCxD,gBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI9D,kCAC5BkC,UAAUE,QAAsCzD,sBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIhE,6BAA6B;GACtDiE,gBAAgB,IAAIpD,sBAAsB;IACtCuC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIpD,0BACpBqB,UAAUE,QAA8BjD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIvD,gCAC1BuB,UAAUE,QAAoClD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAOA,MAAMkB,oBAAoB,IAAItE,8BAA8B,EAAEqD,YAAYgB,IAL9CzD,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BnD,WAAAA;GACjDgE;EACJ,CAE0EkB,EAAgB,CAAA;EAoB1F,MAAMG,IARuB7E,8BAA8B;GACvD6D;GACAG;GACAC;GACAW,mBAAAA,IAd0BzE,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY1B,IAAAA;EAOnC,MAAM2B,uBAAuB,IAAIlD,qBAAqB;GAClDkC;GACAiB,YAAYtD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMqD,iBAAiB,IAAInD,eAAe;GACtCoD,UAAU,IAAIxE,qBAAqB4C,YAAY,EAC3C6B,eAAezC,OAAO0C,uBAClB,IAAIzD,gBAAgBe,OAAO0C,oBAAoB,IAC/C,KACR,CAAA;GACAlC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAMyD,SAAS,MAAM7B,gBAAgB8B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBpC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB+B,oBACZpC,YACAK,kBACa;EACb,MAAMgC,gBAAgB,MAAMhC,iBAAiBiC,cAAcjG,iBAAiBkG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBxC,WAAWyC,cAAc3G,gBAAAA;EAChD,MAAM4G,eAAe1C,WAAWyC,cAAcnG,sBAAAA;EAE9C,MAAMqG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/module.d.ts

@@ -8,5 +8,22 @@ export declare class CompositeProvisioningSource implements IProvisioningSource
     merge(target: RootProvisioningEntity, source: RootProvisioningEntity): void;
     private buildEntityKey;
     private mergeEntities;
+    /**
+     * Deep-merge two entries sharing a composite key. The later source wins
+     * per attribute, but relations are UNIONED — a later source (e.g. a
+     * mounted provisioning file) extending a built-in entry (the default
+     * source's master realm) must not silently drop the built-in relations
+     * (admin user, system client).
+     *
+     * Policy extraAttributes merge per key with the later source winning —
+     * like attributes, NOT like relations: an EA value (a names denylist,
+     * an ATTRIBUTES query tree) is policy configuration, and unioning would
+     * make shrinking a list impossible and fabricate predicates neither
+     * source authored.
+     */
+    private mergeEntity;
+    private mergeRecord;
+    private mergeValue;
+    private isEntityArray;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/provisioning/sources/composite/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;IAQpE,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,aAAa;CAgCxB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAmBxC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;IAQpE,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;CAKxB"}

package/dist/app/modules/provisioning/sources/composite/module.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { isObject } from "@authup/kit";
 //#region src/app/modules/provisioning/sources/composite/module.ts
 var CompositeProvisioningSource = class {
 	sources;
@@ -21,7 +22,7 @@ var CompositeProvisioningSource = class {
 	}
 	buildEntityKey(attributes) {
 		if (!attributes.name) return void 0;
-		return `${attributes.name}:${attributes.realm_id || ""}:${attributes.client_id || ""}`;
+		return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
 	}
 	mergeEntities(target, source) {
 		if (!source) return target;
@@ -34,11 +35,62 @@ var CompositeProvisioningSource = class {
 				return;
 			}
 			const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);
-			if (idx !== -1) result[idx] = item;
+			if (idx !== -1) result[idx] = this.mergeEntity(result[idx], item);
 			else result.push(item);
 		});
 		return result;
 	}
+	/**
+	* Deep-merge two entries sharing a composite key. The later source wins
+	* per attribute, but relations are UNIONED — a later source (e.g. a
+	* mounted provisioning file) extending a built-in entry (the default
+	* source's master realm) must not silently drop the built-in relations
+	* (admin user, system client).
+	*
+	* Policy extraAttributes merge per key with the later source winning —
+	* like attributes, NOT like relations: an EA value (a names denylist,
+	* an ATTRIBUTES query tree) is policy configuration, and unioning would
+	* make shrinking a list impossible and fabricate predicates neither
+	* source authored.
+	*/ mergeEntity(target, source) {
+		const output = {
+			...target,
+			...source
+		};
+		output.attributes = {
+			...target.attributes,
+			...source.attributes
+		};
+		if (target.strategy && !source.strategy) output.strategy = target.strategy;
+		if (target.relations && source.relations) output.relations = this.mergeRecord(target.relations, source.relations);
+		else if (target.relations && !source.relations) output.relations = target.relations;
+		if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
+			...target.extraAttributes,
+			...source.extraAttributes
+		};
+		else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
+		if (target.children && source.children) output.children = this.mergeEntities(target.children, source.children);
+		else if (target.children && !source.children) output.children = target.children;
+		return output;
+	}
+	mergeRecord(target, source) {
+		const output = { ...target };
+		for (const key of Object.keys(source)) output[key] = key in target ? this.mergeValue(target[key], source[key]) : source[key];
+		return output;
+	}
+	mergeValue(target, source) {
+		if (typeof target === "undefined") return source;
+		if (typeof source === "undefined") return target;
+		if (Array.isArray(target) && Array.isArray(source)) {
+			if (this.isEntityArray(target) || this.isEntityArray(source)) return this.mergeEntities(target, source);
+			return [.../* @__PURE__ */ new Set([...target, ...source])];
+		}
+		if (isObject(target) && isObject(source)) return this.mergeRecord(target, source);
+		return source;
+	}
+	isEntityArray(value) {
+		return value.some((item) => isObject(item) && "attributes" in item);
+	}
 };
 //#endregion
 export { CompositeProvisioningSource };

package/dist/app/modules/provisioning/sources/composite/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realm_id","client_id","result","forEach","item","key","push","idx","findIndex","r"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = this.mergeEntities(target.policies, source.policies);\n        target.permissions = this.mergeEntities(target.permissions, source.permissions);\n        target.roles = this.mergeEntities(target.roles, source.roles);\n        target.scopes = this.mergeEntities(target.scopes, source.scopes);\n        target.realms = this.mergeEntities(target.realms, source.realms);\n    }\n\n    private buildEntityKey(\n        attributes: {\n            name?: string,\n            realm_id?: string | null,\n            client_id?: string | null\n        },\n    ): string | undefined {\n        if (!attributes.name) return undefined;\n        return `${attributes.name}:${attributes.realm_id || ''}:${attributes.client_id || ''}`;\n    }\n\n    private mergeEntities<\n        T extends {\n            attributes: {\n                name?: string,\n                realm_id?: string | null,\n                client_id?: string | null\n            }\n        },\n    >(\n        target: T[] | undefined,\n        source: T[] | undefined,\n    ): T[] | undefined {\n        if (!source) return target;\n        if (!target) return [...source];\n\n        const result = [...target];\n        source.forEach((item) => {\n            const key = this.buildEntityKey(item.attributes);\n            if (!key) {\n                result.push(item);\n                return;\n            }\n\n            const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n            if (idx !== -1) {\n                result[idx] = item;\n            } else {\n                result.push(item);\n            }\n        });\n        return result;\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YAKkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,YAAY,GAAG,GAAGH,WAAWI,aAAa;CACtF;CAEQV,cASJF,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,CAAA,GAAIH,MAAAA;EAExB,MAAMgB,SAAS,CAAA,GAAIb,MAAAA;EACnBH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,OAAOH;QAEdF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["isObject","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realmId","clientId","result","forEach","item","key","push","idx","findIndex","r","mergeEntity","strategy","relations","mergeRecord","extraAttributes","children","Object","keys","mergeValue","Array","isArray","isEntityArray","Set","value","some"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\n/**\n * Structural view of a provisioning entity used by the composite merge.\n * Covers every entity shape (realm, client, user, role, permission, scope,\n * policy): the composite-key attribute bag plus the deep-mergeable groups.\n */\ntype MergeableProvisioningEntity = {\n    attributes: {\n        name?: string,\n        realmId?: string | null,\n        clientId?: string | null,\n    },\n    strategy?: unknown,\n    relations?: Record<string, unknown>,\n    children?: MergeableProvisioningEntity[],\n    extraAttributes?: Record<string, unknown>,\n};\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = this.mergeEntities(target.policies, source.policies);\n        target.permissions = this.mergeEntities(target.permissions, source.permissions);\n        target.roles = this.mergeEntities(target.roles, source.roles);\n        target.scopes = this.mergeEntities(target.scopes, source.scopes);\n        target.realms = this.mergeEntities(target.realms, source.realms);\n    }\n\n    private buildEntityKey(\n        attributes: MergeableProvisioningEntity['attributes'],\n    ): string | undefined {\n        if (!attributes.name) return undefined;\n        return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n    }\n\n    private mergeEntities<T extends MergeableProvisioningEntity>(\n        target: T[] | undefined,\n        source: T[] | undefined,\n    ): T[] | undefined {\n        if (!source) return target;\n        if (!target) return [...source];\n\n        const result = [...target];\n        source.forEach((item) => {\n            const key = this.buildEntityKey(item.attributes);\n            if (!key) {\n                result.push(item);\n                return;\n            }\n\n            const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n            if (idx !== -1) {\n                result[idx] = this.mergeEntity(result[idx], item) as T;\n            } else {\n                result.push(item);\n            }\n        });\n        return result;\n    }\n\n    /**\n     * Deep-merge two entries sharing a composite key. The later source wins\n     * per attribute, but relations are UNIONED — a later source (e.g. a\n     * mounted provisioning file) extending a built-in entry (the default\n     * source's master realm) must not silently drop the built-in relations\n     * (admin user, system client).\n     *\n     * Policy extraAttributes merge per key with the later source winning —\n     * like attributes, NOT like relations: an EA value (a names denylist,\n     * an ATTRIBUTES query tree) is policy configuration, and unioning would\n     * make shrinking a list impossible and fabricate predicates neither\n     * source authored.\n     */\n    private mergeEntity(\n        target: MergeableProvisioningEntity,\n        source: MergeableProvisioningEntity,\n    ): MergeableProvisioningEntity {\n        const output = { ...target, ...source };\n\n        output.attributes = { ...target.attributes, ...source.attributes };\n\n        if (target.strategy && !source.strategy) {\n            output.strategy = target.strategy;\n        }\n\n        if (target.relations && source.relations) {\n            output.relations = this.mergeRecord(target.relations, source.relations);\n        } else if (target.relations && !source.relations) {\n            output.relations = target.relations;\n        }\n\n        if (target.extraAttributes && source.extraAttributes) {\n            output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n        } else if (target.extraAttributes && !source.extraAttributes) {\n            output.extraAttributes = target.extraAttributes;\n        }\n\n        if (target.children && source.children) {\n            output.children = this.mergeEntities(target.children, source.children);\n        } else if (target.children && !source.children) {\n            output.children = target.children;\n        }\n\n        return output;\n    }\n\n    private mergeRecord(\n        target: Record<string, unknown>,\n        source: Record<string, unknown>,\n    ): Record<string, unknown> {\n        const output : Record<string, unknown> = { ...target };\n        for (const key of Object.keys(source)) {\n            output[key] = key in target ?\n                this.mergeValue(target[key], source[key]) :\n                source[key];\n        }\n        return output;\n    }\n\n    private mergeValue(target: unknown, source: unknown): unknown {\n        if (typeof target === 'undefined') return source;\n        if (typeof source === 'undefined') return target;\n\n        if (Array.isArray(target) && Array.isArray(source)) {\n            if (this.isEntityArray(target) || this.isEntityArray(source)) {\n                return this.mergeEntities(\n                    target as MergeableProvisioningEntity[],\n                    source as MergeableProvisioningEntity[],\n                );\n            }\n            return [...new Set([...target, ...source])];\n        }\n\n        if (isObject(target) && isObject(source)) {\n            return this.mergeRecord(target, source);\n        }\n\n        return source;\n    }\n\n    private isEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n        return value.some(\n            (item) => isObject(item) && 'attributes' in item,\n        );\n    }\n}\n"],"mappings":";;;;;AA6BA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YACkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;CACpF;CAEQV,cACJF,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,CAAA,GAAIH,MAAAA;EAExB,MAAMgB,SAAS,CAAA,GAAIb,MAAAA;EACnBH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,OAAO,KAAKG,YAAYR,OAAOK,MAAMH,IAAAA;QAE5CF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;;;;;;;;;;;;;IAeA,YACIb,QACAH,QAC2B;EAC3B,MAAML,SAAS;GAAE,GAAGQ;GAAQ,GAAGH;EAAO;EAEtCL,OAAOgB,aAAa;GAAE,GAAGR,OAAOQ;GAAY,GAAGX,OAAOW;EAAW;EAEjE,IAAIR,OAAOsB,YAAY,CAACzB,OAAOyB,UAC3B9B,OAAO8B,WAAWtB,OAAOsB;EAG7B,IAAItB,OAAOuB,aAAa1B,OAAO0B,WAC3B/B,OAAO+B,YAAY,KAAKC,YAAYxB,OAAOuB,WAAW1B,OAAO0B,SAAS;OACnE,IAAIvB,OAAOuB,aAAa,CAAC1B,OAAO0B,WACnC/B,OAAO+B,YAAYvB,OAAOuB;EAG9B,IAAIvB,OAAOyB,mBAAmB5B,OAAO4B,iBACjCjC,OAAOiC,kBAAkB;GAAE,GAAGzB,OAAOyB;GAAiB,GAAG5B,OAAO4B;EAAgB;OAC7E,IAAIzB,OAAOyB,mBAAmB,CAAC5B,OAAO4B,iBACzCjC,OAAOiC,kBAAkBzB,OAAOyB;EAGpC,IAAIzB,OAAO0B,YAAY7B,OAAO6B,UAC1BlC,OAAOkC,WAAW,KAAKxB,cAAcF,OAAO0B,UAAU7B,OAAO6B,QAAQ;OAClE,IAAI1B,OAAO0B,YAAY,CAAC7B,OAAO6B,UAClClC,OAAOkC,WAAW1B,OAAO0B;EAG7B,OAAOlC;CACX;CAEQgC,YACJxB,QACAH,QACuB;EACvB,MAAML,SAAmC,EAAE,GAAGQ,OAAO;EACrD,KAAK,MAAMgB,OAAOW,OAAOC,KAAK/B,MAAAA,GAC1BL,OAAOwB,OAAOA,OAAOhB,SACjB,KAAK6B,WAAW7B,OAAOgB,MAAMnB,OAAOmB,IAAI,IACxCnB,OAAOmB;EAEf,OAAOxB;CACX;CAEQqC,WAAW7B,QAAiBH,QAA0B;EAC1D,IAAI,OAAOG,WAAW,aAAa,OAAOH;EAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOG;EAE1C,IAAI8B,MAAMC,QAAQ/B,MAAAA,KAAW8B,MAAMC,QAAQlC,MAAAA,GAAS;GAChD,IAAI,KAAKmC,cAAchC,MAAAA,KAAW,KAAKgC,cAAcnC,MAAAA,GACjD,OAAO,KAAKK,cACRF,QACAH,MAAAA;GAGR,OAAO,CAAA,mBAAI,IAAIoC,IAAI,CAAA,GAAIjC,QAAAA,GAAWH,MAAAA,CAAO,CAAA;EAC7C;EAEA,IAAIV,SAASa,MAAAA,KAAWb,SAASU,MAAAA,GAC7B,OAAO,KAAK2B,YAAYxB,QAAQH,MAAAA;EAGpC,OAAOA;CACX;CAEQmC,cAAcE,OAA0D;EAC5E,OAAOA,MAAMC,MACRpB,SAAS5B,SAAS4B,IAAAA,KAAS,gBAAgBA,IAAAA;CAEpD;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAMxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgG3C,gBAAgB,IAAI,4BAA4B,EAAE;IA6BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IA2EhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IA+F/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAwEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { ClientCredentialsService } from "../../../../../core/authentication/credential/entities/client/module.mjs";
-import { RobotCredentialsService } from "../../../../../core/authentication/credential/entities/robot/module.mjs";
 import { UserCredentialsService } from "../../../../../core/authentication/credential/entities/user/module.mjs";
 import { ProvisioningEntityStrategyType } from "../../../../../core/provisioning/strategy/constants.mjs";
 import "../../../../../core/provisioning/strategy/index.mjs";
@@ -20,20 +19,20 @@ var DefaultProvisioningSource = class {
 				attributes: {
 					name: SystemPolicyName.DEFAULT,
 					type: BuiltInPolicyType.COMPOSITE,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				},
-				extraAttributes: { decision_strategy: DecisionStrategy.UNANIMOUS },
+				extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },
 				children: [{ attributes: {
 					name: SystemPolicyName.IDENTITY,
 					type: BuiltInPolicyType.IDENTITY,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				} }, { attributes: {
 					name: SystemPolicyName.PERMISSION_BINDING,
 					type: BuiltInPolicyType.PERMISSION_BINDING,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				} }]
 			},
 			{
@@ -41,31 +40,17 @@ var DefaultProvisioningSource = class {
 					name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,
 					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
 					invert: true,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				},
 				extraAttributes: { names: [
 					"active",
-					"realm_id",
-					"auth_method",
-					"token_binding_method",
-					"secret_hashed",
-					"secret_encrypted",
-					"access_policy_id"
-				] }
-			},
-			{
-				attributes: {
-					name: SystemPolicyName.ROBOT_NAMES_SELF_MANAGE,
-					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
-					invert: true,
-					built_in: true,
-					realm_id: null
-				},
-				extraAttributes: { names: [
-					"active",
-					"realm_id",
-					"user_id"
+					"realmId",
+					"authMethod",
+					"tokenBindingMethod",
+					"secretHashed",
+					"secretEncrypted",
+					"accessPolicyId"
 				] }
 			},
 			{
@@ -73,15 +58,15 @@ var DefaultProvisioningSource = class {
 					name: SystemPolicyName.USER_NAMES_SELF_MANAGE,
 					type: BuiltInPolicyType.ATTRIBUTE_NAMES,
 					invert: true,
-					built_in: true,
-					realm_id: null
+					builtIn: true,
+					realmId: null
 				},
 				extraAttributes: { names: [
 					"active",
-					"name_locked",
+					"nameLocked",
 					"status",
-					"status_message",
-					"realm_id"
+					"statusMessage",
+					"realmId"
 				] }
 			}
 		];
@@ -89,18 +74,17 @@ var DefaultProvisioningSource = class {
 	buildPermissions() {
 		const policiesByPermission = {
 			[PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],
-			[PermissionName.ROBOT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.ROBOT_NAMES_SELF_MANAGE],
 			[PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE]
 		};
 		return Object.values(PermissionName).map((name) => {
 			const entity = {
 				strategy: {
 					type: ProvisioningEntityStrategyType.MERGE,
-					attributes: ["built_in"]
+					attributes: ["builtIn"]
 				},
 				attributes: {
 					name,
-					built_in: true
+					builtIn: true
 				}
 			};
 			const policies = policiesByPermission[name];
@@ -112,11 +96,11 @@ var DefaultProvisioningSource = class {
 		return Object.values(ScopeName).map((name) => ({
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name,
-				built_in: true
+				builtIn: true
 			}
 		}));
 	}
@@ -124,11 +108,11 @@ var DefaultProvisioningSource = class {
 		return [{
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name: ROLE_ADMIN_NAME,
-				built_in: true
+				builtIn: true
 			},
 			relations: {
 				globalPermissions: ["*"],
@@ -137,11 +121,11 @@ var DefaultProvisioningSource = class {
 		}, {
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name: ROLE_REALM_ADMIN_NAME,
-				built_in: true
+				builtIn: true
 			},
 			relations: {
 				globalPermissions: ["*"],
@@ -165,9 +149,6 @@ var DefaultProvisioningSource = class {
 					PermissionName.PERMISSION_CREATE,
 					PermissionName.PERMISSION_UPDATE,
 					PermissionName.PERMISSION_DELETE,
-					PermissionName.ROBOT_CREATE,
-					PermissionName.ROBOT_UPDATE,
-					PermissionName.ROBOT_DELETE,
 					PermissionName.ROLE_CREATE,
 					PermissionName.ROLE_UPDATE,
 					PermissionName.ROLE_DELETE,
@@ -189,11 +170,11 @@ var DefaultProvisioningSource = class {
 		const masterRealm = {
 			strategy: {
 				type: ProvisioningEntityStrategyType.MERGE,
-				attributes: ["built_in"]
+				attributes: ["builtIn"]
 			},
 			attributes: {
 				name: REALM_MASTER_NAME,
-				built_in: true
+				builtIn: true
 			},
 			relations: {}
 		};
@@ -219,52 +200,36 @@ var DefaultProvisioningSource = class {
 		if (config.clientSystemSecretReset) clientStrategy = {
 			type: ProvisioningEntityStrategyType.MERGE,
 			attributes: [
-				"built_in",
-				"auth_method",
-				"token_binding_method",
+				"builtIn",
+				"authMethod",
+				"tokenBindingMethod",
 				"secret",
-				"secret_hashed",
-				"secret_encrypted"
+				"secretHashed",
+				"secretEncrypted"
 			]
 		};
 		else clientStrategy = {
 			type: ProvisioningEntityStrategyType.MERGE,
 			attributes: [
-				"built_in",
-				"auth_method",
-				"token_binding_method"
+				"builtIn",
+				"authMethod",
+				"tokenBindingMethod"
 			]
 		};
 		masterRealm.relations = masterRealm.relations || {};
 		masterRealm.relations.clients = [{
 			strategy: clientStrategy,
 			attributes: {
-				built_in: true,
-				auth_method: ClientAuthMethod.SECRET,
-				token_binding_method: ClientTokenBindingMethod.NONE,
+				builtIn: true,
+				authMethod: ClientAuthMethod.SECRET,
+				tokenBindingMethod: ClientTokenBindingMethod.NONE,
 				name: "system",
-				secret: await clientCredentialsService.protect(config.clientSystemSecret, { secret_hashed: false }),
-				secret_hashed: false,
+				secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),
+				secretHashed: false,
 				active: config.clientSystemEnabled
 			},
 			relations: { globalRoles: [ROLE_ADMIN_NAME] }
 		}];
-		const robotCredentialsService = new RobotCredentialsService();
-		let robotStrategy;
-		if (config.robotAdminSecretReset) robotStrategy = {
-			type: ProvisioningEntityStrategyType.MERGE,
-			attributes: ["secret"]
-		};
-		masterRealm.relations = masterRealm.relations || {};
-		masterRealm.relations.robots = [{
-			strategy: robotStrategy,
-			attributes: {
-				name: "system",
-				secret: await robotCredentialsService.protect(config.robotAdminSecret),
-				active: config.robotAdminEnabled
-			},
-			relations: { globalRoles: [ROLE_ADMIN_NAME] }
-		}];
 		return [masterRealm];
 	}
 	async load(container) {