@authup/server-core 1.0.0-beta.55 → 1.0.0-beta.57

package/dist/app/modules/http/modules/controller.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"controller.mjs","names":["decorators","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","IdentityProviderRepository","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyRepository","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRepository","UserRoleEntity","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","DatabaseInjectionKey","IdentityProviderRepositoryAdapter","IdentityProviderRoleMappingRepositoryAdapter","PermissionDatabaseProvider","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RoleAttributeRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","TrustAnchorRepositoryAdapter","UserAttributeRepositoryAdapter","UserAuthenticatorRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","ClientController","ClientPermissionController","ClientRoleController","ClientScopeController","ConsentController","EventController","IdentityProviderController","IdentityProviderRoleMappingController","KeyController","PermissionController","PermissionPolicyController","PolicyController","RealmController","RoleAttributeController","RoleController","RolePermissionController","ScopeController","SessionController","TrustAnchorController","UserAttributeController","UserAuthenticatorController","UserController","UserPermissionController","UserRoleController","useRequestEventContext","ActivateController","AuthenticatorChallengeController","AuthorizeController","JwkController","LogoutController","OpenIDController","PasswordForgotController","PasswordResetController","RegisterController","StatusController","TokenController","ClientCertificateValidator","ClientPermissionService","ClientRoleService","ClientScopeService","ClientService","ConsentService","CredentialsAuthenticator","IdentityProviderRoleMappingService","KeyProvisioner","KeyService","LoginThrottleService","OAuth2AccessPolicyEvaluator","OAuth2ClientAuthenticator","OAuth2EndSessionService","OAuth2MfaLoginService","PasswordRecoveryService","PermissionCheckerService","PermissionPolicyService","PermissionService","PolicyCheckerService","PolicyService","RealmCipher","RealmService","RegistrationService","RoleAttributeService","RolePermissionService","RoleService","ScopeService","SessionService","TrustAnchorService","UserAttributeService","UserAuthenticator","UserAuthenticatorService","UserPermissionService","UserRoleService","UserService","WebClientProvisioner","AuthenticationInjectionKey","OAuth2InjectionToken","IdentityInjectionKey","ConfigInjectionKey","getAppOrigins","CacheInjectionKey","LoggerInjectionKey","MailInjectionKey","MailTemplateRendererInjectionKey","MetricsInjectionKey","HTTPControllerModule","mount","router","container","eventController","createEventController","realmController","createRealmController","roleController","createRoleController","permissionController","createPermissionController","permissionPolicyController","createPermissionPolicyController","clientController","createClientController","clientPermissionController","createClientPermissionController","clientRoleController","createClientRoleController","clientScopeController","createClientScopeController","roleAttributeController","createRoleAttributeController","rolePermissionController","createRolePermissionController","scopeController","createScopeController","keyController","createKeyController","trustAnchorController","createTrustAnchorController","sessionController","createSessionController","consentController","createConsentController","userController","createUserController","userAttributeController","createUserAttributeController","userAuthenticatorController","createUserAuthenticatorController","userPermissionController","createUserPermissionController","userRoleController","createUserRoleController","policyController","createPolicyController","identityProviderRoleController","createIdentityProviderRoleController","use","controllers","createAuthorize","createToken","createJwkController","createOpenIDController","createActivateController","createPasswordForgotController","createPasswordResetController","createRegisterController","createLogoutController","createAuthenticatorChallengeController","createStatusController","createIdentityProvider","config","resolve","codeIssuer","AuthorizationCodeIssuer","codeRequestVerifier","AuthorizationCodeRequestVerifier","sessionManager","SessionManager","eventService","EventService","metrics","options","baseURL","publicUrl","features","buildUIFeatures","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","resolveUserAuthenticatorService","accessPolicyEvaluator","resolveAccessPolicyEvaluator","consentService","createConsentService","logger","dataSource","DataSource","codeVerifier","AuthorizationCodeVerifier","accessTokenIssuer","AccessTokenIssuer","refreshTokenIssuer","RefreshTokenIssuer","openIdTokenIssuer","OpenIDTokenIssuer","keyStore","KeyStore","tokenRevoker","TokenRevoker","tokenVerifier","TokenVerifier","tokenRepository","TokenRepository","sessionTokenRepository","SessionTokenRepository","identityResolver","Resolver","identityProviderLdapCollectionAuthenticator","ProviderLdapCollectionAuthenticator","identityPermissionProvider","PermissionProvider","userAuthenticator","oauth2ClientAuthenticator","certificateValidator","trustAnchorRepository","loginThrottleService","repository","EventRepository","enabled","loginAttemptThrottleEnabled","threshold","loginAttemptThreshold","windowSeconds","loginAttemptWindow","userAuthenticatorService","mfaLoginService","resolveMfaLoginService","tokenRefreshGracePeriod","certificateSource","realmRepository","service","createRegistrationService","createPasswordRecoveryService","mailClient","mailTemplateRenderer","passwordRecoveryEnabled","emailVerificationEnabled","passwordMinLength","clientRepository","ClientRepository","endSessionService","hintGracePeriod","endSessionHintGracePeriod","registration","registrationEnabled","passwordRecovery","emailVerification","accountManager","ProviderAccountManager","stateManager","AuthorizationStateManager","realmRepositoryAdapter","createPermissionRepository","createRoleRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","permissionProvider","checkerService","permissionRepository","reservedNames","Set","getMetadata","columns","map","c","propertyName","requestContext","SessionRepository","ConsentRepository","policyProvider","userRepository","issuer","webauthn","url","URL","hostname","rpId","rpName","origin","undefined","cache","cipher","mfaEnabled","required","mfaRequired","ticketIssuer","MfaTokenIssuer","getRepository","webClientProvisioner","appOrigins","keyProvisioner","keyRepository","mtlsBaseURL","mtlsPublicUrl","clientCertificatesEnabled"],"sources":["../../../../../src/app/modules/http/modules/controller.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { decorators } from '@routup/decorators';\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    Permission,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RoleAttribute,\n    RolePermission,\n    Scope,\n    UserAttribute,\n    UserAuthenticator as UserAuthenticatorModel,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    IdentityProviderRepository,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyRepository,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRepository,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    DatabaseInjectionKey,\n    IdentityProviderRepositoryAdapter,\n    IdentityProviderRoleMappingRepositoryAdapter,\n    PermissionDatabaseProvider,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RoleAttributeRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    TrustAnchorRepositoryAdapter,\n    UserAttributeRepositoryAdapter,\n    UserAuthenticatorRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter,\n    UserRoleRepositoryAdapter,\n} from '../../database/index.ts';\nimport {\n    ClientController,\n    ClientPermissionController,\n    ClientRoleController,\n    ClientScopeController,\n    ConsentController,\n    EventController,\n    IdentityProviderController,\n    IdentityProviderRoleMappingController,\n    KeyController,\n    PermissionController,\n    PermissionPolicyController,\n    PolicyController,\n    RealmController,\n    RoleAttributeController,\n    RoleController,\n    RolePermissionController,\n    ScopeController,\n    SessionController,\n    TrustAnchorController,\n    UserAttributeController,\n    UserAuthenticatorController,\n    UserController,\n    UserPermissionController,\n    UserRoleController,\n    useRequestEventContext,\n} from '../../../../adapters/http/index.ts';\nimport {\n    ActivateController,\n    AuthenticatorChallengeController,\n    AuthorizeController,\n    JwkController,\n    LogoutController,\n    OpenIDController,\n    PasswordForgotController,\n    PasswordResetController,\n    RegisterController,\n    StatusController,\n    TokenController,\n} from '../../../../adapters/http/controllers/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCertificateValidator,\n    ClientPermissionService,\n    ClientRoleService,\n    ClientScopeService,\n    ClientService,\n    ConsentService,\n    CredentialsAuthenticator,\n    IdentityProviderRoleMappingService,\n    KeyProvisioner,\n    KeyService,\n    LoginThrottleService,\n    OAuth2AccessPolicyEvaluator,\n    OAuth2ClientAuthenticator,\n    OAuth2EndSessionService,\n    OAuth2MfaLoginService,\n    PasswordRecoveryService,\n    PermissionCheckerService,\n    PermissionPolicyService,\n    PermissionService,\n    PolicyCheckerService,\n    PolicyService,\n    RealmCipher,\n    RealmService,\n    RegistrationService,\n    RoleAttributeService,\n    RolePermissionService,\n    RoleService,\n    ScopeService,\n    SessionService,\n    TrustAnchorService,\n    UserAttributeService,\n    UserAuthenticator,\n    UserAuthenticatorService,\n    UserPermissionService,\n    UserRoleService,\n    UserService,\n    WebClientProvisioner,\n} from '../../../../core/index.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport type { Config } from '../../config/index.ts';\nimport { ConfigInjectionKey, getAppOrigins } from '../../config/index.ts';\nimport { CacheInjectionKey } from '../../cache/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { MailInjectionKey, MailTemplateRendererInjectionKey } from '../../mail/index.ts';\nimport { MetricsInjectionKey } from '../../metrics/index.ts';\n\nexport class HTTPControllerModule {\n    async mount(router: App, container: IContainer): Promise<void> {\n        const eventController = this.createEventController(container);\n        const realmController = this.createRealmController(container);\n        const roleController = this.createRoleController(container);\n        const permissionController = await this.createPermissionController(container);\n        const permissionPolicyController = this.createPermissionPolicyController(container);\n        const clientController = this.createClientController(container);\n        const clientPermissionController = this.createClientPermissionController(container);\n        const clientRoleController = this.createClientRoleController(container);\n        const clientScopeController = this.createClientScopeController(container);\n        const roleAttributeController = this.createRoleAttributeController(container);\n        const rolePermissionController = this.createRolePermissionController(container);\n        const scopeController = this.createScopeController(container);\n        const keyController = this.createKeyController(container);\n        const trustAnchorController = this.createTrustAnchorController(container);\n        const sessionController = this.createSessionController(container);\n        const consentController = this.createConsentController(container);\n        const userController = this.createUserController(container);\n        const userAttributeController = this.createUserAttributeController(container);\n        const userAuthenticatorController = this.createUserAuthenticatorController(container);\n        const userPermissionController = this.createUserPermissionController(container);\n        const userRoleController = this.createUserRoleController(container);\n        const policyController = this.createPolicyController(container);\n        const identityProviderRoleController = this.createIdentityProviderRoleController(container);\n\n        router.use(decorators({\n            controllers: [\n                this.createAuthorize(container),\n                this.createToken(container),\n                this.createJwkController(container),\n                this.createOpenIDController(container),\n                this.createActivateController(container),\n                this.createPasswordForgotController(container),\n                this.createPasswordResetController(container),\n                this.createRegisterController(container),\n                this.createLogoutController(container),\n                this.createAuthenticatorChallengeController(container),\n\n                this.createStatusController(container),\n\n                clientController,\n                clientPermissionController,\n                clientRoleController,\n                clientScopeController,\n                consentController,\n                eventController,\n                identityProviderRoleController,\n                this.createIdentityProvider(container),\n                keyController,\n                trustAnchorController,\n                permissionController,\n                permissionPolicyController,\n                policyController,\n                realmController,\n                roleController,\n                roleAttributeController,\n                rolePermissionController,\n                scopeController,\n                sessionController,\n                userController,\n                userAttributeController,\n                userAuthenticatorController,\n                userPermissionController,\n                userRoleController,\n            ],\n        }));\n    }\n\n    // ----------------------------------------------------\n\n    createAuthorize(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);\n        const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);\n\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n\n        const eventService = container.resolve(DatabaseInjectionKey.EventService);\n        const metrics = container.resolve(MetricsInjectionKey);\n\n        return new AuthorizeController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n                promptLoginMaxAge: config.promptLoginMaxAge,\n                mfaFreshnessMaxAge: config.mfaFreshnessMaxAge,\n            },\n\n            codeIssuer,\n            codeRequestVerifier,\n\n            sessionManager,\n\n            eventService,\n            metrics,\n\n            mfaChallengeProvider: this.resolveUserAuthenticatorService(container),\n            accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),\n\n            consentService: this.createConsentService(container),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n    }\n\n    createToken(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n\n        const codeVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeVerifier);\n\n        const accessTokenIssuer = container.resolve(OAuth2InjectionToken.AccessTokenIssuer);\n        const refreshTokenIssuer = container.resolve(OAuth2InjectionToken.RefreshTokenIssuer);\n        const openIdTokenIssuer = container.resolve(OAuth2InjectionToken.OpenIDTokenIssuer);\n        const keyStore = container.resolve(OAuth2InjectionToken.KeyStore);\n\n        const tokenRevoker = container.resolve(OAuth2InjectionToken.TokenRevoker);\n        const tokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const tokenRepository = container.resolve(OAuth2InjectionToken.TokenRepository);\n        const sessionTokenRepository = container.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n        const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n        const identityProviderLdapCollectionAuthenticator = container.resolve(IdentityInjectionKey.ProviderLdapCollectionAuthenticator);\n\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n        const userAuthenticator = new CredentialsAuthenticator([\n            identityProviderLdapCollectionAuthenticator,\n            new UserAuthenticator(identityResolver),\n        ]);\n\n        const oauth2ClientAuthenticator = new OAuth2ClientAuthenticator({\n            identityResolver,\n            certificateValidator: new ClientCertificateValidator({ trustAnchorRepository: new TrustAnchorRepositoryAdapter(dataSource) }),\n        });\n\n        const eventService = container.resolve(DatabaseInjectionKey.EventService);\n        const metrics = container.resolve(MetricsInjectionKey);\n\n        const loginThrottleService = new LoginThrottleService({\n            repository: container.resolve(DatabaseInjectionKey.EventRepository),\n            options: {\n                enabled: config.loginAttemptThrottleEnabled,\n                threshold: config.loginAttemptThreshold,\n                windowSeconds: config.loginAttemptWindow,\n            },\n        });\n\n        return new TokenController({\n            codeVerifier,\n\n            accessTokenIssuer,\n            refreshTokenIssuer,\n            openIdTokenIssuer,\n            keyStore,\n\n            tokenVerifier,\n            tokenRevoker,\n            tokenRepository,\n            sessionTokenRepository,\n\n            eventService,\n            metrics,\n            loginThrottleService,\n            userAuthenticatorService: this.resolveUserAuthenticatorService(container),\n            mfaLoginService: this.resolveMfaLoginService(container),\n            accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),\n\n            tokenRefreshGracePeriod: config.tokenRefreshGracePeriod,\n            logger,\n\n            identityResolver,\n            identityPermissionProvider,\n\n            userAuthenticator,\n\n            oauth2ClientAuthenticator,\n            certificateSource: config.certificateSource,\n\n            realmRepository: new RealmRepositoryAdapter(container.resolve<Repository<Realm>>(RealmEntity)),\n\n            sessionManager,\n        });\n    }\n\n    createOpenIDController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new OpenIDController({ baseURL: config.publicUrl });\n    }\n\n    createActivateController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new ActivateController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createRegistrationService(container),\n        });\n    }\n\n    createPasswordForgotController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new PasswordForgotController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createPasswordRecoveryService(container),\n        });\n    }\n\n    createPasswordResetController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new PasswordResetController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createPasswordRecoveryService(container),\n        });\n    }\n\n    createPasswordRecoveryService(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const mailClient = container.resolve(MailInjectionKey);\n        const mailTemplateRenderer = container.resolve(MailTemplateRendererInjectionKey);\n\n        return new PasswordRecoveryService({\n            mailClient,\n            mailTemplateRenderer,\n            repository,\n            realmRepository: new RealmRepositoryAdapter(realmRepository),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            options: {\n                passwordRecoveryEnabled: config.passwordRecoveryEnabled,\n                emailVerificationEnabled: config.emailVerificationEnabled,\n                publicUrl: config.publicUrl,\n                passwordMinLength: config.passwordMinLength,\n            },\n        });\n    }\n\n    createRegisterController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new RegisterController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createRegistrationService(container),\n        });\n    }\n\n    createLogoutController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const tokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n        const clientRepository = container.resolve(OAuth2InjectionToken.ClientRepository);\n        const realmRepository = new RealmRepositoryAdapter(container.resolve<Repository<Realm>>(RealmEntity));\n\n        const endSessionService = new OAuth2EndSessionService({\n            tokenVerifier,\n            sessionManager,\n            clientRepository,\n            realmRepository,\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            hintGracePeriod: config.endSessionHintGracePeriod,\n        });\n\n        return new LogoutController({\n            options: { baseURL: config.publicUrl },\n            endSessionService,\n        });\n    }\n\n    createStatusController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new StatusController({ options: { features: this.buildUIFeatures(config) } });\n    }\n\n    buildUIFeatures(config: Config) : StatusResponseFeatures {\n        return {\n            registration: config.registrationEnabled,\n            passwordRecovery: config.passwordRecoveryEnabled,\n            emailVerification: config.emailVerificationEnabled,\n        };\n    }\n\n    createRegistrationService(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const mailClient = container.resolve(MailInjectionKey);\n        const mailTemplateRenderer = container.resolve(MailTemplateRendererInjectionKey);\n\n        return new RegistrationService({\n            mailClient,\n            mailTemplateRenderer,\n            repository,\n            realmRepository: new RealmRepositoryAdapter(realmRepository),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            options: {\n                registrationEnabled: config.registrationEnabled,\n                emailVerificationEnabled: config.emailVerificationEnabled,\n                publicUrl: config.publicUrl,\n                passwordMinLength: config.passwordMinLength,\n            },\n        });\n    }\n\n    createIdentityProvider(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const accountManager = container.resolve(IdentityInjectionKey.ProviderAccountManager);\n\n        const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);\n\n        const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);\n\n        const stateManager = container.resolve(OAuth2InjectionToken.AuthorizationStateManager);\n\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const repository = new IdentityProviderRepositoryAdapter({\n            repository: new IdentityProviderRepository(dataSource),\n            realmRepository,\n        });\n\n        return new IdentityProviderController({\n            options: { baseURL: config.publicUrl },\n\n            repository,\n            realmRepository: new RealmRepositoryAdapter(realmRepository),\n            clientRepository: container.resolve(OAuth2InjectionToken.ClientRepository),\n\n            accountManager,\n\n            codeIssuer,\n            codeRequestVerifier,\n            stateManager,\n\n            accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),\n        });\n    }\n\n    createClientController(container: IContainer) {\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        const service = new ClientService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n        });\n        return new ClientController({\n            service,\n            repository,\n        });\n    }\n\n    private createPermissionRepository(container: IContainer): PermissionRepositoryAdapter {\n        return new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<Permission>>(PermissionEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n    }\n\n    private createRoleRepository(container: IContainer): RoleRepositoryAdapter {\n        return new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n    }\n\n    async createPermissionController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<Permission>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const rolePermissionRepository = new RolePermissionRepositoryAdapter(\n            container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n        );\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const service = new PermissionService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            roleRepository,\n            rolePermissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n        const checkerService = new PermissionCheckerService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            permissionProvider,\n            identityPermissionProvider,\n        });\n\n        return new PermissionController({\n            service,\n            checkerService,\n        });\n    }\n\n    createRoleController(container: IContainer) {\n        const realmRepository = new RealmRepositoryAdapter(\n            container.resolve<Repository<Realm>>(RealmEntity),\n        );\n        const repository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n        const service = new RoleService({\n            repository,\n            realmRepository,\n        });\n        return new RoleController({ service });\n    }\n\n    createClientPermissionController(container: IContainer) {\n        const repository = new ClientPermissionRepositoryAdapter(\n            container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n        );\n        const permissionRepository = this.createPermissionRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new ClientPermissionService({\n            repository,\n            permissionRepository,\n            identityPermissionProvider,\n        });\n        return new ClientPermissionController({ service });\n    }\n\n    createClientRoleController(container: IContainer) {\n        const repository = new ClientRoleRepositoryAdapter(\n            container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n        );\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new ClientRoleService({ repository, identityPermissionProvider });\n        return new ClientRoleController({ service });\n    }\n\n    createClientScopeController(container: IContainer) {\n        const repository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n        const service = new ClientScopeService({ repository });\n        return new ClientScopeController({ service });\n    }\n\n    createRoleAttributeController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const repository = new RoleAttributeRepositoryAdapter(\n            container.resolve<Repository<RoleAttribute>>(RoleAttributeEntity),\n        );\n        const reservedNames = new Set(\n            dataSource.getMetadata(RoleEntity).columns.map((c) => c.propertyName),\n        );\n        const service = new RoleAttributeService({ repository, reservedNames });\n        return new RoleAttributeController({ service });\n    }\n\n    createRolePermissionController(container: IContainer) {\n        const repository = new RolePermissionRepositoryAdapter(\n            container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n        );\n        const permissionRepository = this.createPermissionRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new RolePermissionService({\n            repository,\n            permissionRepository,\n            identityPermissionProvider,\n        });\n        return new RolePermissionController({ service });\n    }\n\n    createPermissionPolicyController(container: IContainer) {\n        const repository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n        const service = new PermissionPolicyService({ repository });\n        return new PermissionPolicyController({ service });\n    }\n\n    createScopeController(container: IContainer) {\n        const realmRepository = new RealmRepositoryAdapter(\n            container.resolve<Repository<Realm>>(RealmEntity),\n        );\n        const repository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n        const service = new ScopeService({\n            repository,\n            realmRepository,\n        });\n        return new ScopeController({ service });\n    }\n\n    createKeyController(container: IContainer) {\n        // the DI singleton carries the optional KEK cipher — never construct\n        // a fresh adapter here.\n        const service = new KeyService({\n            repository: container.resolve(OAuth2InjectionToken.KeyStore),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            requestContext: useRequestEventContext,\n        });\n        return new KeyController({ service });\n    }\n\n    createTrustAnchorController(container: IContainer) {\n        const repository = new TrustAnchorRepositoryAdapter(\n            container.resolve(DatabaseInjectionKey.DataSource),\n        );\n        const service = new TrustAnchorService({\n            repository,\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            requestContext: useRequestEventContext,\n        });\n        return new TrustAnchorController({ service });\n    }\n\n    createSessionController(container: IContainer) {\n        const repository = container.resolve(AuthenticationInjectionKey.SessionRepository);\n        const service = new SessionService({ repository });\n        return new SessionController({ service });\n    }\n\n    protected createConsentService(container: IContainer) : ConsentService {\n        const repository = container.resolve(OAuth2InjectionToken.ConsentRepository);\n        return new ConsentService({ repository });\n    }\n\n    createConsentController(container: IContainer) {\n        return new ConsentController({ service: this.createConsentService(container) });\n    }\n\n    private accessPolicyEvaluator? : OAuth2AccessPolicyEvaluator;\n\n    protected resolveAccessPolicyEvaluator(container: IContainer) : OAuth2AccessPolicyEvaluator {\n        if (this.accessPolicyEvaluator) {\n            return this.accessPolicyEvaluator;\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        this.accessPolicyEvaluator = new OAuth2AccessPolicyEvaluator({\n            policyProvider: new PolicyRepository(dataSource),\n            identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        return this.accessPolicyEvaluator;\n    }\n\n    private userAuthenticatorService? : UserAuthenticatorService;\n\n    protected resolveUserAuthenticatorService(container: IContainer) : UserAuthenticatorService {\n        if (this.userAuthenticatorService) {\n            return this.userAuthenticatorService;\n        }\n\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const repository = new UserAuthenticatorRepositoryAdapter(\n            container.resolve<Repository<UserAuthenticatorModel>>(UserAuthenticatorEntity),\n        );\n        const userRepository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n\n        let issuer : string | undefined;\n        let webauthn : {\n            rpId: string, \n            rpName: string, \n            origin: string \n        } | undefined;\n        try {\n            const url = new URL(config.publicUrl);\n            issuer = url.hostname;\n            webauthn = {\n                rpId: url.hostname,\n                rpName: issuer,\n                origin: url.origin,\n            };\n        } catch {\n            issuer = undefined;\n            webauthn = undefined;\n        }\n\n        this.userAuthenticatorService = new UserAuthenticatorService({\n            repository,\n            userRepository,\n            cache: container.resolve(CacheInjectionKey),\n            cipher: new RealmCipher({ keyStore: container.resolve(OAuth2InjectionToken.KeyStore) }),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            mailClient: container.resolve(MailInjectionKey),\n            mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),\n            options: {\n                enabled: config.mfaEnabled,\n                required: config.mfaRequired,\n                issuer,\n                webauthn,\n            },\n        });\n\n        return this.userAuthenticatorService;\n    }\n\n    createUserAuthenticatorController(container: IContainer) {\n        return new UserAuthenticatorController({ service: this.resolveUserAuthenticatorService(container) });\n    }\n\n    private mfaLoginService? : OAuth2MfaLoginService;\n\n    protected resolveMfaLoginService(container: IContainer) : OAuth2MfaLoginService {\n        if (this.mfaLoginService) {\n            return this.mfaLoginService;\n        }\n\n        this.mfaLoginService = new OAuth2MfaLoginService({\n            sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),\n            ticketIssuer: container.resolve(OAuth2InjectionToken.MfaTokenIssuer),\n            accessTokenIssuer: container.resolve(OAuth2InjectionToken.AccessTokenIssuer),\n            refreshTokenIssuer: container.resolve(OAuth2InjectionToken.RefreshTokenIssuer),\n            tokenRepository: container.resolve(OAuth2InjectionToken.TokenRepository),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            metrics: container.resolve(MetricsInjectionKey),\n        });\n\n        return this.mfaLoginService;\n    }\n\n    createAuthenticatorChallengeController(container: IContainer) {\n        return new AuthenticatorChallengeController({\n            service: this.resolveUserAuthenticatorService(container),\n            sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),\n            mfaLoginService: this.resolveMfaLoginService(container),\n        });\n    }\n\n    createEventController(container: IContainer) {\n        const service = container.resolve(DatabaseInjectionKey.EventService);\n        return new EventController({ service });\n    }\n\n    createUserController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        const service = new UserService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            passwordMinLength: config.passwordMinLength,\n        });\n        return new UserController({ service });\n    }\n\n    createUserAttributeController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const repository = new UserAttributeRepositoryAdapter(\n            container.resolve<Repository<UserAttribute>>(UserAttributeEntity),\n        );\n        const reservedNames = new Set(\n            dataSource.getMetadata(UserEntity).columns.map((c) => c.propertyName),\n        );\n        const service = new UserAttributeService({ repository, reservedNames });\n        return new UserAttributeController({ service });\n    }\n\n    createUserPermissionController(container: IContainer) {\n        const repository = new UserPermissionRepositoryAdapter(\n            container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n        );\n        const permissionRepository = this.createPermissionRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new UserPermissionService({\n            repository,\n            permissionRepository,\n            identityPermissionProvider,\n        });\n        return new UserPermissionController({ service });\n    }\n\n    createUserRoleController(container: IContainer) {\n        const repository = new UserRoleRepositoryAdapter(\n            container.resolve<Repository<UserRole>>(UserRoleEntity),\n        );\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new UserRoleService({ repository, identityPermissionProvider });\n        return new UserRoleController({ service });\n    }\n\n    createPolicyController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        const service = new PolicyService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n        });\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const checkerService = new PolicyCheckerService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            identityPermissionProvider,\n        });\n\n        return new PolicyController({\n            service,\n            checkerService,\n        });\n    }\n\n    createIdentityProviderRoleController(container: IContainer) {\n        const repository = new IdentityProviderRoleMappingRepositoryAdapter(\n            container.resolve<Repository<any>>(IdentityProviderRoleMappingEntity),\n        );\n        const roleRepository = this.createRoleRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new IdentityProviderRoleMappingService({\n            repository,\n            roleRepository,\n            identityPermissionProvider,\n        });\n        return new IdentityProviderRoleMappingController({ service });\n    }\n\n    createJwkController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const repository = dataSource.getRepository(KeyEntity);\n        return new JwkController({ repository });\n    }\n\n    createRealmController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new RealmRepositoryAdapter(realmRepository);\n\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const logger = container.resolve(LoggerInjectionKey);\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger,\n        });\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: container.resolve(OAuth2InjectionToken.KeyStore),\n            logger,\n        });\n\n        const service = new RealmService({\n            repository,\n            webClientProvisioner,\n            keyProvisioner,\n            logger,\n        });\n        const keyRepository = dataSource.getRepository(KeyEntity);\n\n        return new RealmController({\n            options: {\n                baseURL: config.publicUrl,\n                mtlsBaseURL: config.mtlsPublicUrl,\n                clientCertificatesEnabled: config.certificateSource !== 'disabled',\n            },\n            service,\n            keyRepository,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqKA,IAAa+H,uBAAb,MAAaA;CACT,MAAMC,MAAMC,QAAaC,WAAsC;EAC3D,MAAMC,kBAAkB,KAAKC,sBAAsBF,SAAAA;EACnD,MAAMG,kBAAkB,KAAKC,sBAAsBJ,SAAAA;EACnD,MAAMK,iBAAiB,KAAKC,qBAAqBN,SAAAA;EACjD,MAAMO,uBAAuB,MAAM,KAAKC,2BAA2BR,SAAAA;EACnE,MAAMS,6BAA6B,KAAKC,iCAAiCV,SAAAA;EACzE,MAAMW,mBAAmB,KAAKC,uBAAuBZ,SAAAA;EACrD,MAAMa,6BAA6B,KAAKC,iCAAiCd,SAAAA;EACzE,MAAMe,uBAAuB,KAAKC,2BAA2BhB,SAAAA;EAC7D,MAAMiB,wBAAwB,KAAKC,4BAA4BlB,SAAAA;EAC/D,MAAMmB,0BAA0B,KAAKC,8BAA8BpB,SAAAA;EACnE,MAAMqB,2BAA2B,KAAKC,+BAA+BtB,SAAAA;EACrE,MAAMuB,kBAAkB,KAAKC,sBAAsBxB,SAAAA;EACnD,MAAMyB,gBAAgB,KAAKC,oBAAoB1B,SAAAA;EAC/C,MAAM2B,wBAAwB,KAAKC,4BAA4B5B,SAAAA;EAC/D,MAAM6B,oBAAoB,KAAKC,wBAAwB9B,SAAAA;EACvD,MAAM+B,oBAAoB,KAAKC,wBAAwBhC,SAAAA;EACvD,MAAMiC,iBAAiB,KAAKC,qBAAqBlC,SAAAA;EACjD,MAAMmC,0BAA0B,KAAKC,8BAA8BpC,SAAAA;EACnE,MAAMqC,8BAA8B,KAAKC,kCAAkCtC,SAAAA;EAC3E,MAAMuC,2BAA2B,KAAKC,+BAA+BxC,SAAAA;EACrE,MAAMyC,qBAAqB,KAAKC,yBAAyB1C,SAAAA;EACzD,MAAM2C,mBAAmB,KAAKC,uBAAuB5C,SAAAA;EACrD,MAAM6C,iCAAiC,KAAKC,qCAAqC9C,SAAAA;EAEjFD,OAAOgD,IAAIjL,WAAW,EAClBkL,aAAa;GACT,KAAKC,gBAAgBjD,SAAAA;GACrB,KAAKkD,YAAYlD,SAAAA;GACjB,KAAKmD,oBAAoBnD,SAAAA;GACzB,KAAKoD,uBAAuBpD,SAAAA;GAC5B,KAAKqD,yBAAyBrD,SAAAA;GAC9B,KAAKsD,+BAA+BtD,SAAAA;GACpC,KAAKuD,8BAA8BvD,SAAAA;GACnC,KAAKwD,yBAAyBxD,SAAAA;GAC9B,KAAKyD,uBAAuBzD,SAAAA;GAC5B,KAAK0D,uCAAuC1D,SAAAA;GAE5C,KAAK2D,uBAAuB3D,SAAAA;GAE5BW;GACAE;GACAE;GACAE;GACAc;GACA9B;GACA4C;GACA,KAAKe,uBAAuB5D,SAAAA;GAC5ByB;GACAE;GACApB;GACAE;GACAkC;GACAxC;GACAE;GACAc;GACAE;GACAE;GACAM;GACAI;GACAE;GACAE;GACAE;GACAE;EACH,EACL,CAAA,CAAA;CACJ;CAIAQ,gBAAgBjD,WAAuB;EACnC,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EAEjC,MAAMyE,aAAa/D,UAAU8D,QAAQ1E,qBAAqB4E,uBAAuB;EACjF,MAAMC,sBAAsBjE,UAAU8D,QAAQ1E,qBAAqB8E,gCAAgC;EAEnG,MAAMC,iBAAiBnE,UAAU8D,QAAQ3E,2BAA2BiF,cAAc;EAElF,MAAMC,eAAerE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;EACxE,MAAMC,UAAUvE,UAAU8D,QAAQlE,mBAAAA;EAElC,OAAO,IAAIvD,oBAAoB;GAC3BmI,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;IAC/BgB,mBAAmBhB,OAAOgB;IAC1BC,oBAAoBjB,OAAOiB;GAC/B;GAEAf;GACAE;GAEAE;GAEAE;GACAE;GAEAQ,sBAAsB,KAAKC,gCAAgChF,SAAAA;GAC3DiF,uBAAuB,KAAKC,6BAA6BlF,SAAAA;GAEzDmF,gBAAgB,KAAKC,qBAAqBpF,SAAAA;GAC1CqF,QAAQrF,UAAU8D,QAAQrE,kBAAAA;EAC9B,CAAA;CACJ;CAEAyD,YAAYlD,WAAuB;EAC/B,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EACjC,MAAM+F,SAASrF,UAAU8D,QAAQrE,kBAAAA;EACjC,MAAM6F,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EAEpE,MAAMpB,iBAAiBnE,UAAU8D,QAAQ3E,2BAA2BiF,cAAc;EAElF,MAAMoB,eAAexF,UAAU8D,QAAQ1E,qBAAqBqG,yBAAyB;EAErF,MAAMC,oBAAoB1F,UAAU8D,QAAQ1E,qBAAqBuG,iBAAiB;EAClF,MAAMC,qBAAqB5F,UAAU8D,QAAQ1E,qBAAqByG,kBAAkB;EACpF,MAAMC,oBAAoB9F,UAAU8D,QAAQ1E,qBAAqB2G,iBAAiB;EAClF,MAAMC,WAAWhG,UAAU8D,QAAQ1E,qBAAqB6G,QAAQ;EAEhE,MAAMC,eAAelG,UAAU8D,QAAQ1E,qBAAqB+G,YAAY;EACxE,MAAMC,gBAAgBpG,UAAU8D,QAAQ1E,qBAAqBiH,aAAa;EAC1E,MAAMC,kBAAkBtG,UAAU8D,QAAQ1E,qBAAqBmH,eAAe;EAC9E,MAAMC,yBAAyBxG,UAAU8D,QAAQ1E,qBAAqBqH,sBAAsB;EAE5F,MAAMC,mBAAmB1G,UAAU8D,QAAQzE,qBAAqBsH,QAAQ;EACxE,MAAMC,8CAA8C5G,UAAU8D,QAAQzE,qBAAqBwH,mCAAmC;EAE9H,MAAMC,6BAA6B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAAkB;EAE5F,MAAMC,oBAAoB,IAAI5J,yBAAyB,CACnDwJ,6CACA,IAAI/H,kBAAkB6H,gBAAAA,CACzB,CAAA;EAED,MAAMO,4BAA4B,IAAIvJ,0BAA0B;GAC5DgJ;GACAQ,sBAAsB,IAAIpK,2BAA2B,EAAEqK,uBAAuB,IAAI/M,6BAA6BkL,UAAAA,EAAY,CAAA;EAC/H,CAAA;EAcA,OAAO,IAAIzI,gBAAgB;GACvB2I;GAEAE;GACAE;GACAE;GACAE;GAEAI;GACAF;GACAI;GACAE;GAEAnC,cAzBiBrE,UAAU8D,QAAQtK,qBAAqB8K,YAyBxDD;GACAE,SAzBYvE,UAAU8D,QAAQlE,mBAyB9B2E;GACA6C,sBAAAA,IAxB6B5J,qBAAqB;IAClD6J,YAAYrH,UAAU8D,QAAQtK,qBAAqB8N,eAAe;IAClE9C,SAAS;KACL+C,SAAS1D,OAAO2D;KAChBC,WAAW5D,OAAO6D;KAClBC,eAAe9D,OAAO+D;IAC1B;GACJ,CAiBIR;GACAS,0BAA0B,KAAK7C,gCAAgChF,SAAAA;GAC/D8H,iBAAiB,KAAKC,uBAAuB/H,SAAAA;GAC7CiF,uBAAuB,KAAKC,6BAA6BlF,SAAAA;GAEzDgI,yBAAyBnE,OAAOmE;GAChC3C;GAEAqB;GACAI;GAEAE;GAEAC;GACAgB,mBAAmBpE,OAAOoE;GAE1BC,iBAAiB,IAAInO,uBAAuBiG,UAAU8D,QAA2BrL,WAAAA,CAAAA;GAEjF0L;EACJ,CAAA;CACJ;CAEAf,uBAAuBpD,WAAuB;EAG1C,OAAO,IAAIxD,iBAAiB,EAAEiI,SAFfzE,UAAU8D,QAAQxE,kBAEMuE,CAAAA,CAAOa,UAAU,CAAA;CAC5D;CAEArB,yBAAyBrD,WAAuB;EAC5C,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EAEjC,OAAO,IAAInD,mBAAmB;GAC1BqI,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKC,0BAA0BpI,SAAAA;EAC5C,CAAA;CACJ;CAEAsD,+BAA+BtD,WAAuB;EAClD,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EAEjC,OAAO,IAAI7C,yBAAyB;GAChC+H,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKE,8BAA8BrI,SAAAA;EAChD,CAAA;CACJ;CAEAuD,8BAA8BvD,WAAuB;EACjD,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EAEjC,OAAO,IAAI5C,wBAAwB;GAC/B8H,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKE,8BAA8BrI,SAAAA;EAChD,CAAA;CACJ;CAEAqI,8BAA8BrI,WAAuB;EACjD,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EACjC,MAAMgG,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EACpE,MAAM2C,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAC7D,MAAM4O,aAAa,IAAI7M,sBAAsB;GACzC6M,YAAY,IAAInO,eAAeoM,UAAAA;GAC/B4C;EACJ,CAAA;EAIA,OAAO,IAAIrK,wBAAwB;GAC/ByK,YAJetI,UAAU8D,QAAQpE,gBAIjC4I;GACAC,sBAJyBvI,UAAU8D,QAAQnE,gCAI3C4I;GACAlB;GACAa,iBAAiB,IAAInO,uBAAuBmO,eAAAA;GAC5C7D,cAAcrE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;GACjEE,SAAS;IACLgE,yBAAyB3E,OAAO2E;IAChCC,0BAA0B5E,OAAO4E;IACjC/D,WAAWb,OAAOa;IAClBgE,mBAAmB7E,OAAO6E;GAC9B;EACJ,CAAA;CACJ;CAEAlF,yBAAyBxD,WAAuB;EAC5C,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EAEjC,OAAO,IAAI3C,mBAAmB;GAC1B6H,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKC,0BAA0BpI,SAAAA;EAC5C,CAAA;CACJ;CAEAyD,uBAAuBzD,WAAuB;EAC1C,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EAMjC,MAAMuJ,oBAAoB,IAAIlL,wBAAwB;GAClDyI,eANkBpG,UAAU8D,QAAQ1E,qBAAqBiH,aAMzDD;GACAjC,gBANmBnE,UAAU8D,QAAQ3E,2BAA2BiF,cAMhED;GACAwE,kBANqB3I,UAAU8D,QAAQ1E,qBAAqBwJ,gBAM5DD;GACAT,iBAAAA,IANwBnO,uBAAuBiG,UAAU8D,QAA2BrL,WAAAA,CAMpFyP;GACA7D,cAAcrE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;GACjEwE,iBAAiBjF,OAAOkF;EAC5B,CAAA;EAEA,OAAO,IAAIxM,iBAAiB;GACxBiI,SAAS,EAAEC,SAASZ,OAAOa,UAAU;GACrCmE;EACJ,CAAA;CACJ;CAEAlF,uBAAuB3D,WAAuB;EAC1C,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EAEjC,OAAO,IAAI1C,iBAAiB,EAAE4H,SAAS,EAAEG,UAAU,KAAKC,gBAAgBf,MAAAA,EAAQ,EAAE,CAAA;CACtF;CAEAe,gBAAgBf,QAAyC;EACrD,OAAO;GACHmF,cAAcnF,OAAOoF;GACrBC,kBAAkBrF,OAAO2E;GACzBW,mBAAmBtF,OAAO4E;EAC9B;CACJ;CAEAL,0BAA0BpI,WAAuB;EAC7C,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EACjC,MAAMgG,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EACpE,MAAM2C,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAC7D,MAAM4O,aAAa,IAAI7M,sBAAsB;GACzC6M,YAAY,IAAInO,eAAeoM,UAAAA;GAC/B4C;EACJ,CAAA;EAIA,OAAO,IAAI7J,oBAAoB;GAC3BiK,YAJetI,UAAU8D,QAAQpE,gBAIjC4I;GACAC,sBAJyBvI,UAAU8D,QAAQnE,gCAI3C4I;GACAlB;GACAa,iBAAiB,IAAInO,uBAAuBmO,eAAAA;GAC5C7D,cAAcrE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;GACjEE,SAAS;IACLyE,qBAAqBpF,OAAOoF;IAC5BR,0BAA0B5E,OAAO4E;IACjC/D,WAAWb,OAAOa;IAClBgE,mBAAmB7E,OAAO6E;GAC9B;EACJ,CAAA;CACJ;CAEA9E,uBAAuB5D,WAAuB;EAC1C,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EACjC,MAAMgG,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EAEpE,MAAM6D,iBAAiBpJ,UAAU8D,QAAQzE,qBAAqBgK,sBAAsB;EAEpF,MAAMtF,aAAa/D,UAAU8D,QAAQ1E,qBAAqB4E,uBAAuB;EAEjF,MAAMC,sBAAsBjE,UAAU8D,QAAQ1E,qBAAqB8E,gCAAgC;EAEnG,MAAMoF,eAAetJ,UAAU8D,QAAQ1E,qBAAqBmK,yBAAyB;EAErF,MAAMrB,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAE7D,MAAM4O,aAAa,IAAI5N,kCAAkC;GACrD4N,YAAY,IAAIlP,2BAA2BmN,UAAAA;GAC3C4C;EACJ,CAAA;EAEA,OAAO,IAAIlN,2BAA2B;GAClCwJ,SAAS,EAAEC,SAASZ,OAAOa,UAAU;GAErC2C;GACAa,iBAAiB,IAAInO,uBAAuBmO,eAAAA;GAC5CS,kBAAkB3I,UAAU8D,QAAQ1E,qBAAqBwJ,gBAAgB;GAEzEQ;GAEArF;GACAE;GACAqF;GAEArE,uBAAuB,KAAKC,6BAA6BlF,SAAAA;EAC7D,CAAA;CACJ;CAEAY,uBAAuBZ,WAAuB;EAC1C,MAAMkI,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAC7D,MAAM4O,aAAa,IAAIhO,wBAAwB;GAC3CgO,YAAYrH,UAAU8D,QAA4B/L,YAAAA;GAClDmQ;EACJ,CAAA;EAMA,OAAO,IAAIxN,iBAAiB;GACxByN,SAAAA,IALgBjL,cAAc;IAC9BmK;IACAa,iBAAiBsB,IAHczP,uBAAuBmO,eAGrCsB;GACrB,CAEIrB;GACAd;EACJ,CAAA;CACJ;CAEQoC,2BAA2BzJ,WAAoD;EACnF,OAAO,IAAInG,4BAA4B;GACnCwN,YAAYrH,UAAU8D,QAAgCxL,gBAAAA;GACtD4P,iBAAiBlI,UAAU8D,QAA2BrL,WAAAA;EAC1D,CAAA;CACJ;CAEQiR,qBAAqB1J,WAA8C;EACvE,OAAO,IAAI9F,sBAAsB;GAC7BmN,YAAYrH,UAAU8D,QAA0BnL,UAAAA;GAChDuP,iBAAiBlI,UAAU8D,QAA2BrL,WAAAA;EAC1D,CAAA;CACJ;CAEA,MAAM+H,2BAA2BR,WAAuB;EACpD,MAAMsF,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EACpE,MAAM2C,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAC7D,MAAM4O,aAAa,IAAIxN,4BAA4B;GAC/CwN,YAAYrH,UAAU8D,QAAgCxL,gBAAAA;GACtD4P;EACJ,CAAA;EAEA,MAAMsB,yBAAyB,IAAIzP,uBAAuBmO,eAAAA;EAiB1D,MAAMC,UAAU,IAAInK,kBAAkB;GAClCqJ;GACAa,iBAAiBsB;GACjBG,gBAAAA,IAnBuBzP,sBAAsB;IAC7CmN,YAAYrH,UAAU8D,QAA0BnL,UAAAA;IAChDuP;GACJ,CAgBIyB;GACAC,0BAAAA,IAhBiC3P,gCACjC+F,UAAU8D,QAAoClL,oBAAAA,CAe9CgR;GACAC,kBAAAA,IAdyB/P,wBAAwB;IACjDuN,YAAY,IAAI7O,iBAAiB8M,UAAAA;IACjC4C;GACJ,CAWI2B;GACAC,4BAAAA,IAVmClQ,kCACnCoG,UAAU8D,QAAsCvL,sBAAAA,CAShDuR;EACJ,CAAA;EAEA,MAAMhD,6BAA6B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAAkB;EAU5F,OAAO,IAAI5L,qBAAqB;GAC5BgN;GACA6B,gBAAAA,IATuBlM,yBAAyB;IAChDuJ;IACAa,iBAAiBsB;IACjBO,oBAAAA,IAL2BpQ,2BAA2B2L,UAKtDyE;IACAjD;GACJ,CAIIkD;EACJ,CAAA;CACJ;CAEA1J,qBAAqBN,WAAuB;EACxC,MAAMkI,kBAAkB,IAAInO,uBACxBiG,UAAU8D,QAA2BrL,WAAAA,CAAAA;EAUzC,OAAO,IAAI+C,eAAe,EAAE2M,SAAAA,IAJR3J,YAAY;GAC5B6I,YAAAA,IALmBnN,sBAAsB;IACzCmN,YAAYrH,UAAU8D,QAA0BnL,UAAAA;IAChDuP,iBAAiBlI,UAAU8D,QAA2BrL,WAAAA;GAC1D,CAEI4O;GACAa;EACJ,CAC4BC,EAAQ,CAAA;CACxC;CAEArH,iCAAiCd,WAAuB;EAWpD,OAAO,IAAIrF,2BAA2B,EAAEwN,SAAAA,IALpBpL,wBAAwB;GACxCsK,YAAAA,IANmBjO,kCACnB4G,UAAU8D,QAAsC9L,sBAAAA,CAKhDqP;GACA4C,sBAJyB,KAAKR,2BAA2BzJ,SAIzDiK;GACAnD,4BAJ+B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAItED;EACJ,CACwCqB,EAAQ,CAAA;CACpD;CAEAnH,2BAA2BhB,WAAuB;EAM9C,OAAO,IAAIpF,qBAAqB,EAAEuN,SAAAA,IADdnL,kBAAkB;GAAEqK,YAAAA,IAJjB/N,4BACnB0G,UAAU8D,QAAgC7L,gBAAAA,CAGNoP;GAAYP,4BADjB9G,UAAU8D,QAAQzE,qBAAqB0H,kBACtBD;EAA2B,CAC7CqB,EAAQ,CAAA;CAC9C;CAEAjH,4BAA4BlB,WAAuB;EAK/C,OAAO,IAAInF,sBAAsB,EAAEsN,SAAAA,IADflL,mBAAmB,EAAEoK,YAAAA,IAHlB9N,6BACnByG,UAAU8D,QAAiC5L,iBAAAA,CAENmP,EAAW,CACjBc,EAAQ,CAAA;CAC/C;CAEA/G,8BAA8BpB,WAAuB;EACjD,MAAMsF,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EAQpE,OAAO,IAAIhK,wBAAwB,EAAE4M,SAAAA,IADjB7J,qBAAqB;GAAE+I,YAAAA,IANpBrN,+BACnBgG,UAAU8D,QAAmCpL,mBAAAA,CAKN2O;GAAY6C,eAAAA,IAH7BC,IACtB7E,WAAW8E,YAAYzR,UAAAA,CAAAA,CAAY0R,QAAQC,KAAKC,MAAMA,EAAEC,YAAY,CAEjBN;EAAc,CAChC/B,EAAQ,CAAA;CACjD;CAEA7G,+BAA+BtB,WAAuB;EAWlD,OAAO,IAAIvE,yBAAyB,EAAE0M,SAAAA,IALlB5J,sBAAsB;GACtC8I,YAAAA,IANmBpN,gCACnB+F,UAAU8D,QAAoClL,oBAAAA,CAK9CyO;GACA4C,sBAJyB,KAAKR,2BAA2BzJ,SAIzDiK;GACAnD,4BAJ+B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAItED;EACJ,CACsCqB,EAAQ,CAAA;CAClD;CAEAzH,iCAAiCV,WAAuB;EAKpD,OAAO,IAAI5E,2BAA2B,EAAE+M,SAAAA,IADpBpK,wBAAwB,EAAEsJ,YAAAA,IAHvBzN,kCACnBoG,UAAU8D,QAAsCvL,sBAAAA,CAEN8O,EAAW,CACjBc,EAAQ,CAAA;CACpD;CAEA3G,sBAAsBxB,WAAuB;EACzC,MAAMkI,kBAAkB,IAAInO,uBACxBiG,UAAU8D,QAA2BrL,WAAAA,CAAAA;EAUzC,OAAO,IAAIiD,gBAAgB,EAAEyM,SAAAA,IAJT1J,aAAa;GAC7B4I,YAAAA,IALmBlN,uBAAuB;IAC1CkN,YAAYrH,UAAU8D,QAA2BjL,WAAAA;IACjDqP,iBAAiBlI,UAAU8D,QAA2BrL,WAAAA;GAC1D,CAEI4O;GACAa;EACJ,CAC6BC,EAAQ,CAAA;CACzC;CAEAzG,oBAAoB1B,WAAuB;EAQvC,OAAO,IAAI9E,cAAc,EAAEiN,SAAAA,IALP5K,WAAW;GAC3B8J,YAAYrH,UAAU8D,QAAQ1E,qBAAqB6G,QAAQ;GAC3D5B,cAAcrE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;GACjEmG,gBAAgBvO;EACpB,CAC2BiM,EAAQ,CAAA;CACvC;CAEAvG,4BAA4B5B,WAAuB;EAS/C,OAAO,IAAIpE,sBAAsB,EAAEuM,SAAAA,IALfxJ,mBAAmB;GACnC0I,YAAAA,IAJmBjN,6BACnB4F,UAAU8D,QAAQtK,qBAAqB+L,UAAU,CAGjD8B;GACAhD,cAAcrE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;GACjEmG,gBAAgBvO;EACpB,CACmCiM,EAAQ,CAAA;CAC/C;CAEArG,wBAAwB9B,WAAuB;EAG3C,OAAO,IAAIrE,kBAAkB,EAAEwM,SAAAA,IADXzJ,eAAe,EAAE2I,YADlBrH,UAAU8D,QAAQ3E,2BAA2BuL,iBAC3BrD,EAAW,CACjBc,EAAQ,CAAA;CAC3C;CAEU/C,qBAAqBpF,WAAwC;EAEnE,OAAO,IAAI7C,eAAe,EAAEkK,YADTrH,UAAU8D,QAAQ1E,qBAAqBuL,iBAC9BtD,EAAW,CAAA;CAC3C;CAEArF,wBAAwBhC,WAAuB;EAC3C,OAAO,IAAIlF,kBAAkB,EAAEqN,SAAS,KAAK/C,qBAAqBpF,SAAAA,EAAW,CAAA;CACjF;CAEQiF;CAEEC,6BAA6BlF,WAAqD;EACxF,IAAI,KAAKiF,uBACL,OAAO,KAAKA;EAGhB,MAAMK,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EAEpE,KAAKN,wBAAwB,IAAIxH,4BAA4B;GACzDmN,gBAAgB,IAAIpS,iBAAiB8M,UAAAA;GACrCwB,4BAA4B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAAkB;GACrF1B,QAAQrF,UAAU8D,QAAQrE,kBAAAA;EAC9B,CAAA;EAEA,OAAO,KAAKwF;CAChB;CAEQ4C;CAEE7C,gCAAgChF,WAAkD;EACxF,IAAI,KAAK6H,0BACL,OAAO,KAAKA;EAGhB,MAAMhE,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EACjC,MAAMgG,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EAEpE,MAAM8B,aAAa,IAAI/M,mCACnB0F,UAAU8D,QAA4C/K,uBAAAA,CAAAA;EAE1D,MAAM8R,iBAAiB,IAAIrQ,sBAAsB;GAC7C6M,YAAY,IAAInO,eAAeoM,UAAAA;GAC/B4C,iBAAiBlI,UAAU8D,QAA2BrL,WAAAA;EAC1D,CAAA;EAEA,IAAIqS;EACJ,IAAIC;EAKJ,IAAI;GACA,MAAMC,MAAM,IAAIC,IAAIpH,OAAOa,SAAS;GACpCoG,SAASE,IAAIE;GACbH,WAAW;IACPI,MAAMH,IAAIE;IACVE,QAAQN;IACRO,QAAQL,IAAIK;GAChB;EACJ,QAAQ;GACJP,SAASQ,KAAAA;GACTP,WAAWO,KAAAA;EACf;EAEA,KAAKzD,2BAA2B,IAAI/I,yBAAyB;GACzDuI;GACAwD;GACAU,OAAOvL,UAAU8D,QAAQtE,iBAAAA;GACzBgM,QAAQ,IAAIrN,YAAY,EAAE6H,UAAUhG,UAAU8D,QAAQ1E,qBAAqB6G,QAAQ,EAAE,CAAA;GACrF5B,cAAcrE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;GACjEgE,YAAYtI,UAAU8D,QAAQpE,gBAAAA;GAC9B6I,sBAAsBvI,UAAU8D,QAAQnE,gCAAAA;GACxC6E,SAAS;IACL+C,SAAS1D,OAAO4H;IAChBC,UAAU7H,OAAO8H;IACjBb;IACAC;GACJ;EACJ,CAAA;EAEA,OAAO,KAAKlD;CAChB;CAEAvF,kCAAkCtC,WAAuB;EACrD,OAAO,IAAIlE,4BAA4B,EAAEqM,SAAS,KAAKnD,gCAAgChF,SAAAA,EAAW,CAAA;CACtG;CAEQ8H;CAEEC,uBAAuB/H,WAA+C;EAC5E,IAAI,KAAK8H,iBACL,OAAO,KAAKA;EAGhB,KAAKA,kBAAkB,IAAIlK,sBAAsB;GAC7CuG,gBAAgBnE,UAAU8D,QAAQ3E,2BAA2BiF,cAAc;GAC3EwH,cAAc5L,UAAU8D,QAAQ1E,qBAAqByM,cAAc;GACnEnG,mBAAmB1F,UAAU8D,QAAQ1E,qBAAqBuG,iBAAiB;GAC3EC,oBAAoB5F,UAAU8D,QAAQ1E,qBAAqByG,kBAAkB;GAC7ES,iBAAiBtG,UAAU8D,QAAQ1E,qBAAqBmH,eAAe;GACvElC,cAAcrE,UAAU8D,QAAQtK,qBAAqB8K,YAAY;GACjEC,SAASvE,UAAU8D,QAAQlE,mBAAAA;EAC/B,CAAA;EAEA,OAAO,KAAKkI;CAChB;CAEApE,uCAAuC1D,WAAuB;EAC1D,OAAO,IAAI5D,iCAAiC;GACxC+L,SAAS,KAAKnD,gCAAgChF,SAAAA;GAC9CmE,gBAAgBnE,UAAU8D,QAAQ3E,2BAA2BiF,cAAc;GAC3E0D,iBAAiB,KAAKC,uBAAuB/H,SAAAA;EACjD,CAAA;CACJ;CAEAE,sBAAsBF,WAAuB;EAEzC,OAAO,IAAIjF,gBAAgB,EAAEoN,SADbnI,UAAU8D,QAAQtK,qBAAqB8K,YAC1B6D,EAAQ,CAAA;CACzC;CAEAjG,qBAAqBlC,WAAuB;EACxC,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EACjC,MAAMgG,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EACpE,MAAM2C,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAW7D,OAAO,IAAIsD,eAAe,EAAEoM,SAAAA,IALRlJ,YAAY;GAC5BoI,YAAAA,IANmB7M,sBAAsB;IACzC6M,YAAY,IAAInO,eAAeoM,UAAAA;IAC/B4C;GACJ,CAGIb;GACAa,iBAAiBsB,IAHczP,uBAAuBmO,eAGrCsB;GACjBd,mBAAmB7E,OAAO6E;EAC9B,CAC4BP,EAAQ,CAAA;CACxC;CAEA/F,8BAA8BpC,WAAuB;EACjD,MAAMsF,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EAQpE,OAAO,IAAI1J,wBAAwB,EAAEsM,SAAAA,IADjBvJ,qBAAqB;GAAEyI,YAAAA,IANpBhN,+BACnB2F,UAAU8D,QAAmChL,mBAAAA,CAKNuO;GAAY6C,eAAAA,IAH7BC,IACtB7E,WAAW8E,YAAYpR,UAAAA,CAAAA,CAAYqR,QAAQC,KAAKC,MAAMA,EAAEC,YAAY,CAEjBN;EAAc,CAChC/B,EAAQ,CAAA;CACjD;CAEA3F,+BAA+BxC,WAAuB;EAWlD,OAAO,IAAIhE,yBAAyB,EAAEmM,SAAAA,IALlBpJ,sBAAsB;GACtCsI,YAAAA,IANmB9M,gCACnByF,UAAU8D,QAAoC7K,oBAAAA,CAK9CoO;GACA4C,sBAJyB,KAAKR,2BAA2BzJ,SAIzDiK;GACAnD,4BAJ+B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAItED;EACJ,CACsCqB,EAAQ,CAAA;CAClD;CAEAzF,yBAAyB1C,WAAuB;EAM5C,OAAO,IAAI/D,mBAAmB,EAAEkM,SAAAA,IADZnJ,gBAAgB;GAAEqI,YAAAA,IAJf5M,0BACnBuF,UAAU8D,QAA8B3K,cAAAA,CAGNkO;GAAYP,4BADf9G,UAAU8D,QAAQzE,qBAAqB0H,kBACxBD;EAA2B,CAC7CqB,EAAQ,CAAA;CAC5C;CAEAvF,uBAAuB5C,WAAuB;EAC1C,MAAMsF,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EACpE,MAAM2C,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAC7D,MAAM4O,aAAa,IAAIvN,wBAAwB;GAC3CuN,YAAY,IAAI7O,iBAAiB8M,UAAAA;GACjC4C;EACJ,CAAA;EACA,MAAMsB,yBAAyB,IAAIzP,uBAAuBmO,eAAAA;EAY1D,OAAO,IAAI7M,iBAAiB;GACxB8M,SAAAA,IAZgBjK,cAAc;IAC9BmJ;IACAa,iBAAiBsB;GACrB,CASIrB;GACA6B,gBAAAA,IARuB/L,qBAAqB;IAC5CoJ;IACAa,iBAAiBsB;IACjB1C,4BAJ+B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAItED;GACJ,CAIIkD;EACJ,CAAA;CACJ;CAEAlH,qCAAqC9C,WAAuB;EAWxD,OAAO,IAAI/E,sCAAsC,EAAEkN,SAAAA,IAL/B9K,mCAAmC;GACnDgK,YAAAA,IANmB3N,6CACnBsG,UAAU8D,QAAyB1L,iCAAAA,CAKnCiP;GACAsC,gBAJmB,KAAKD,qBAAqB1J,SAI7C2J;GACA7C,4BAJ+B9G,UAAU8D,QAAQzE,qBAAqB0H,kBAItED;EACJ,CACmDqB,EAAQ,CAAA;CAC/D;CAEAhF,oBAAoBnD,WAAuB;EAGvC,OAAO,IAAI1D,cAAc,EAAE+K,YAFRrH,UAAU8D,QAAQtK,qBAAqB+L,UACvCD,CAAAA,CAAWwG,cAAczT,SACjBgP,EAAW,CAAA;CAC1C;CAEAjH,sBAAsBJ,WAAuB;EACzC,MAAM6D,SAAS7D,UAAU8D,QAAQxE,kBAAAA;EACjC,MAAMgG,aAAatF,UAAU8D,QAAQtK,qBAAqB+L,UAAU;EACpE,MAAM2C,kBAAkBlI,UAAU8D,QAA2BrL,WAAAA;EAC7D,MAAM4O,aAAa,IAAItN,uBAAuBmO,eAAAA;EAE9C,MAAMS,mBAAmB,IAAItP,wBAAwB;GACjDgO,YAAYrH,UAAU8D,QAA4B/L,YAAAA;GAClDmQ;EACJ,CAAA;EACA,MAAM7C,SAASrF,UAAU8D,QAAQrE,kBAAAA;EAWjC,MAAM0I,UAAU,IAAI/J,aAAa;GAC7BiJ;GACA0E,sBAAAA,IAZ6B7M,qBAAqB;IAClDyJ;IACAqD,YAAYzM,cAAcsE,MAAAA;IAC1BwB;GACJ,CAQI0G;GACAE,gBAAAA,IARuB3O,eAAe;IACtC0I,UAAUhG,UAAU8D,QAAQ1E,qBAAqB6G,QAAQ;IACzDZ;GACJ,CAKI4G;GACA5G;EACJ,CAAA;EACA,MAAM6G,gBAAgB5G,WAAWwG,cAAczT,SAAAA;EAE/C,OAAO,IAAIiD,gBAAgB;GACvBkJ,SAAS;IACLC,SAASZ,OAAOa;IAChByH,aAAatI,OAAOuI;IACpBC,2BAA2BxI,OAAOoE,sBAAsB;GAC5D;GACAE;GACA+D;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"controller.mjs","names":["decorators","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","IdentityProviderRepository","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyRepository","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRepository","UserRoleEntity","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","DatabaseInjectionKey","IdentityProviderRepositoryAdapter","IdentityProviderRoleMappingRepositoryAdapter","PermissionDatabaseProvider","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RoleAttributeRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","TrustAnchorRepositoryAdapter","UserAttributeRepositoryAdapter","UserAuthenticatorRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","ClientController","ClientPermissionController","ClientRoleController","ClientScopeController","ConsentController","EventController","IdentityProviderController","IdentityProviderRoleMappingController","KeyController","PermissionController","PermissionPolicyController","PolicyController","RealmController","RoleAttributeController","RoleController","RolePermissionController","ScopeController","SessionController","TrustAnchorController","UserAttributeController","UserAuthenticatorController","UserController","UserPermissionController","UserRoleController","useRequestEventContext","ActivateController","AuthenticatorChallengeController","AuthorizeController","JwkController","LogoutController","OpenIDController","PasswordForgotController","PasswordResetController","RegisterController","StatusController","TokenController","UserInfoController","ClientCertificateValidator","ClientPermissionService","ClientRoleService","ClientScopeService","ClientService","ConsentService","CredentialsAuthenticator","IdentityProviderRoleMappingService","KeyProvisioner","KeyService","LoginThrottleService","OAuth2AccessPolicyEvaluator","OAuth2ClientAuthenticator","OAuth2EndSessionService","OAuth2MfaLoginService","PasswordRecoveryService","PermissionCheckerService","PermissionPolicyService","PermissionService","PolicyCheckerService","PolicyService","RealmCipher","RealmService","RegistrationService","RoleAttributeService","RolePermissionService","RoleService","ScopeService","SessionService","TrustAnchorService","UserAttributeService","UserAuthenticator","UserAuthenticatorService","UserPermissionService","UserRoleService","UserService","WebClientProvisioner","AuthenticationInjectionKey","OAuth2InjectionToken","IdentityInjectionKey","ConfigInjectionKey","getAppOrigins","CacheInjectionKey","LoggerInjectionKey","MailInjectionKey","MailTemplateRendererInjectionKey","MetricsInjectionKey","HTTPControllerModule","mount","router","container","eventController","createEventController","realmController","createRealmController","roleController","createRoleController","permissionController","createPermissionController","permissionPolicyController","createPermissionPolicyController","clientController","createClientController","clientPermissionController","createClientPermissionController","clientRoleController","createClientRoleController","clientScopeController","createClientScopeController","roleAttributeController","createRoleAttributeController","rolePermissionController","createRolePermissionController","scopeController","createScopeController","keyController","createKeyController","trustAnchorController","createTrustAnchorController","sessionController","createSessionController","consentController","createConsentController","userController","createUserController","userAttributeController","createUserAttributeController","userAuthenticatorController","createUserAuthenticatorController","userPermissionController","createUserPermissionController","userRoleController","createUserRoleController","policyController","createPolicyController","identityProviderRoleController","createIdentityProviderRoleController","use","controllers","createAuthorize","createToken","createJwkController","createOpenIDController","createActivateController","createPasswordForgotController","createPasswordResetController","createRegisterController","createLogoutController","createAuthenticatorChallengeController","createUserInfoController","createStatusController","createIdentityProvider","config","resolve","codeIssuer","AuthorizationCodeIssuer","codeRequestVerifier","AuthorizationCodeRequestVerifier","sessionManager","SessionManager","eventService","EventService","metrics","options","baseURL","publicUrl","features","buildUIFeatures","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","resolveUserAuthenticatorService","accessPolicyEvaluator","resolveAccessPolicyEvaluator","consentService","createConsentService","logger","dataSource","DataSource","codeVerifier","AuthorizationCodeVerifier","accessTokenIssuer","AccessTokenIssuer","refreshTokenIssuer","RefreshTokenIssuer","openIdTokenIssuer","OpenIDTokenIssuer","keyStore","KeyStore","tokenRevoker","TokenRevoker","tokenVerifier","TokenVerifier","tokenRepository","TokenRepository","sessionTokenRepository","SessionTokenRepository","identityResolver","Resolver","identityProviderLdapCollectionAuthenticator","ProviderLdapCollectionAuthenticator","identityPermissionProvider","PermissionProvider","userAuthenticator","oauth2ClientAuthenticator","certificateValidator","trustAnchorRepository","loginThrottleService","repository","EventRepository","enabled","loginAttemptThrottleEnabled","threshold","loginAttemptThreshold","windowSeconds","loginAttemptWindow","userAuthenticatorService","mfaLoginService","resolveMfaLoginService","tokenRefreshGracePeriod","certificateSource","realmRepository","service","createRegistrationService","createPasswordRecoveryService","mailClient","mailTemplateRenderer","passwordRecoveryEnabled","emailVerificationEnabled","passwordMinLength","clientRepository","ClientRepository","endSessionService","hintGracePeriod","endSessionHintGracePeriod","registration","registrationEnabled","passwordRecovery","emailVerification","accountManager","ProviderAccountManager","stateManager","AuthorizationStateManager","realmRepositoryAdapter","createPermissionRepository","createRoleRepository","roleRepository","rolePermissionRepository","policyRepository","permissionPolicyRepository","permissionProvider","checkerService","permissionRepository","reservedNames","Set","getMetadata","columns","map","c","propertyName","requestContext","SessionRepository","ConsentRepository","policyProvider","userRepository","issuer","webauthn","url","URL","hostname","rpId","rpName","origin","undefined","cache","cipher","mfaEnabled","required","mfaRequired","ticketIssuer","MfaTokenIssuer","createUserService","getRepository","webClientProvisioner","scopeRepository","clientScopeRepository","appOrigins","keyProvisioner","keyRepository","mtlsBaseURL","mtlsPublicUrl","clientCertificatesEnabled"],"sources":["../../../../../src/app/modules/http/modules/controller.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { decorators } from '@routup/decorators';\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    Permission,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RoleAttribute,\n    RolePermission,\n    Scope,\n    UserAttribute,\n    UserAuthenticator as UserAuthenticatorModel,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    IdentityProviderRepository,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyRepository,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRepository,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    DatabaseInjectionKey,\n    IdentityProviderRepositoryAdapter,\n    IdentityProviderRoleMappingRepositoryAdapter,\n    PermissionDatabaseProvider,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RoleAttributeRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    TrustAnchorRepositoryAdapter,\n    UserAttributeRepositoryAdapter,\n    UserAuthenticatorRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter,\n    UserRoleRepositoryAdapter,\n} from '../../database/index.ts';\nimport {\n    ClientController,\n    ClientPermissionController,\n    ClientRoleController,\n    ClientScopeController,\n    ConsentController,\n    EventController,\n    IdentityProviderController,\n    IdentityProviderRoleMappingController,\n    KeyController,\n    PermissionController,\n    PermissionPolicyController,\n    PolicyController,\n    RealmController,\n    RoleAttributeController,\n    RoleController,\n    RolePermissionController,\n    ScopeController,\n    SessionController,\n    TrustAnchorController,\n    UserAttributeController,\n    UserAuthenticatorController,\n    UserController,\n    UserPermissionController,\n    UserRoleController,\n    useRequestEventContext,\n} from '../../../../adapters/http/index.ts';\nimport {\n    ActivateController,\n    AuthenticatorChallengeController,\n    AuthorizeController,\n    JwkController,\n    LogoutController,\n    OpenIDController,\n    PasswordForgotController,\n    PasswordResetController,\n    RegisterController,\n    StatusController,\n    TokenController,\n    UserInfoController,\n} from '../../../../adapters/http/controllers/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCertificateValidator,\n    ClientPermissionService,\n    ClientRoleService,\n    ClientScopeService,\n    ClientService,\n    ConsentService,\n    CredentialsAuthenticator,\n    IdentityProviderRoleMappingService,\n    KeyProvisioner,\n    KeyService,\n    LoginThrottleService,\n    OAuth2AccessPolicyEvaluator,\n    OAuth2ClientAuthenticator,\n    OAuth2EndSessionService,\n    OAuth2MfaLoginService,\n    PasswordRecoveryService,\n    PermissionCheckerService,\n    PermissionPolicyService,\n    PermissionService,\n    PolicyCheckerService,\n    PolicyService,\n    RealmCipher,\n    RealmService,\n    RegistrationService,\n    RoleAttributeService,\n    RolePermissionService,\n    RoleService,\n    ScopeService,\n    SessionService,\n    TrustAnchorService,\n    UserAttributeService,\n    UserAuthenticator,\n    UserAuthenticatorService,\n    UserPermissionService,\n    UserRoleService,\n    UserService,\n    WebClientProvisioner,\n} from '../../../../core/index.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport type { Config } from '../../config/index.ts';\nimport { ConfigInjectionKey, getAppOrigins } from '../../config/index.ts';\nimport { CacheInjectionKey } from '../../cache/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { MailInjectionKey, MailTemplateRendererInjectionKey } from '../../mail/index.ts';\nimport { MetricsInjectionKey } from '../../metrics/index.ts';\n\nexport class HTTPControllerModule {\n    async mount(router: App, container: IContainer): Promise<void> {\n        const eventController = this.createEventController(container);\n        const realmController = this.createRealmController(container);\n        const roleController = this.createRoleController(container);\n        const permissionController = await this.createPermissionController(container);\n        const permissionPolicyController = this.createPermissionPolicyController(container);\n        const clientController = this.createClientController(container);\n        const clientPermissionController = this.createClientPermissionController(container);\n        const clientRoleController = this.createClientRoleController(container);\n        const clientScopeController = this.createClientScopeController(container);\n        const roleAttributeController = this.createRoleAttributeController(container);\n        const rolePermissionController = this.createRolePermissionController(container);\n        const scopeController = this.createScopeController(container);\n        const keyController = this.createKeyController(container);\n        const trustAnchorController = this.createTrustAnchorController(container);\n        const sessionController = this.createSessionController(container);\n        const consentController = this.createConsentController(container);\n        const userController = this.createUserController(container);\n        const userAttributeController = this.createUserAttributeController(container);\n        const userAuthenticatorController = this.createUserAuthenticatorController(container);\n        const userPermissionController = this.createUserPermissionController(container);\n        const userRoleController = this.createUserRoleController(container);\n        const policyController = this.createPolicyController(container);\n        const identityProviderRoleController = this.createIdentityProviderRoleController(container);\n\n        router.use(decorators({\n            controllers: [\n                this.createAuthorize(container),\n                this.createToken(container),\n                this.createJwkController(container),\n                this.createOpenIDController(container),\n                this.createActivateController(container),\n                this.createPasswordForgotController(container),\n                this.createPasswordResetController(container),\n                this.createRegisterController(container),\n                this.createLogoutController(container),\n                this.createAuthenticatorChallengeController(container),\n                this.createUserInfoController(container),\n\n                this.createStatusController(container),\n\n                clientController,\n                clientPermissionController,\n                clientRoleController,\n                clientScopeController,\n                consentController,\n                eventController,\n                identityProviderRoleController,\n                this.createIdentityProvider(container),\n                keyController,\n                trustAnchorController,\n                permissionController,\n                permissionPolicyController,\n                policyController,\n                realmController,\n                roleController,\n                roleAttributeController,\n                rolePermissionController,\n                scopeController,\n                sessionController,\n                userController,\n                userAttributeController,\n                userAuthenticatorController,\n                userPermissionController,\n                userRoleController,\n            ],\n        }));\n    }\n\n    // ----------------------------------------------------\n\n    createAuthorize(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);\n        const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);\n\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n\n        const eventService = container.resolve(DatabaseInjectionKey.EventService);\n        const metrics = container.resolve(MetricsInjectionKey);\n\n        return new AuthorizeController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n                promptLoginMaxAge: config.promptLoginMaxAge,\n                mfaFreshnessMaxAge: config.mfaFreshnessMaxAge,\n            },\n\n            codeIssuer,\n            codeRequestVerifier,\n\n            sessionManager,\n\n            eventService,\n            metrics,\n\n            mfaChallengeProvider: this.resolveUserAuthenticatorService(container),\n            accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),\n\n            consentService: this.createConsentService(container),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n    }\n\n    createToken(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n\n        const codeVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeVerifier);\n\n        const accessTokenIssuer = container.resolve(OAuth2InjectionToken.AccessTokenIssuer);\n        const refreshTokenIssuer = container.resolve(OAuth2InjectionToken.RefreshTokenIssuer);\n        const openIdTokenIssuer = container.resolve(OAuth2InjectionToken.OpenIDTokenIssuer);\n        const keyStore = container.resolve(OAuth2InjectionToken.KeyStore);\n\n        const tokenRevoker = container.resolve(OAuth2InjectionToken.TokenRevoker);\n        const tokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const tokenRepository = container.resolve(OAuth2InjectionToken.TokenRepository);\n        const sessionTokenRepository = container.resolve(OAuth2InjectionToken.SessionTokenRepository);\n\n        const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n        const identityProviderLdapCollectionAuthenticator = container.resolve(IdentityInjectionKey.ProviderLdapCollectionAuthenticator);\n\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n        const userAuthenticator = new CredentialsAuthenticator([\n            identityProviderLdapCollectionAuthenticator,\n            new UserAuthenticator(identityResolver),\n        ]);\n\n        const oauth2ClientAuthenticator = new OAuth2ClientAuthenticator({\n            identityResolver,\n            certificateValidator: new ClientCertificateValidator({ trustAnchorRepository: new TrustAnchorRepositoryAdapter(dataSource) }),\n        });\n\n        const eventService = container.resolve(DatabaseInjectionKey.EventService);\n        const metrics = container.resolve(MetricsInjectionKey);\n\n        const loginThrottleService = new LoginThrottleService({\n            repository: container.resolve(DatabaseInjectionKey.EventRepository),\n            options: {\n                enabled: config.loginAttemptThrottleEnabled,\n                threshold: config.loginAttemptThreshold,\n                windowSeconds: config.loginAttemptWindow,\n            },\n        });\n\n        return new TokenController({\n            codeVerifier,\n\n            accessTokenIssuer,\n            refreshTokenIssuer,\n            openIdTokenIssuer,\n            keyStore,\n\n            tokenVerifier,\n            tokenRevoker,\n            tokenRepository,\n            sessionTokenRepository,\n\n            eventService,\n            metrics,\n            loginThrottleService,\n            userAuthenticatorService: this.resolveUserAuthenticatorService(container),\n            mfaLoginService: this.resolveMfaLoginService(container),\n            accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),\n\n            tokenRefreshGracePeriod: config.tokenRefreshGracePeriod,\n            logger,\n\n            identityResolver,\n            identityPermissionProvider,\n\n            userAuthenticator,\n\n            oauth2ClientAuthenticator,\n            certificateSource: config.certificateSource,\n\n            realmRepository: new RealmRepositoryAdapter(container.resolve<Repository<Realm>>(RealmEntity)),\n\n            sessionManager,\n        });\n    }\n\n    createOpenIDController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new OpenIDController({ baseURL: config.publicUrl });\n    }\n\n    createActivateController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new ActivateController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createRegistrationService(container),\n        });\n    }\n\n    createPasswordForgotController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new PasswordForgotController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createPasswordRecoveryService(container),\n        });\n    }\n\n    createPasswordResetController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new PasswordResetController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createPasswordRecoveryService(container),\n        });\n    }\n\n    createPasswordRecoveryService(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const mailClient = container.resolve(MailInjectionKey);\n        const mailTemplateRenderer = container.resolve(MailTemplateRendererInjectionKey);\n\n        return new PasswordRecoveryService({\n            mailClient,\n            mailTemplateRenderer,\n            repository,\n            realmRepository: new RealmRepositoryAdapter(realmRepository),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            options: {\n                passwordRecoveryEnabled: config.passwordRecoveryEnabled,\n                emailVerificationEnabled: config.emailVerificationEnabled,\n                publicUrl: config.publicUrl,\n                passwordMinLength: config.passwordMinLength,\n            },\n        });\n    }\n\n    createRegisterController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new RegisterController({\n            options: {\n                baseURL: config.publicUrl,\n                features: this.buildUIFeatures(config),\n            },\n            service: this.createRegistrationService(container),\n        });\n    }\n\n    createLogoutController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const tokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n        const clientRepository = container.resolve(OAuth2InjectionToken.ClientRepository);\n        const realmRepository = new RealmRepositoryAdapter(container.resolve<Repository<Realm>>(RealmEntity));\n\n        const endSessionService = new OAuth2EndSessionService({\n            tokenVerifier,\n            sessionManager,\n            clientRepository,\n            realmRepository,\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            hintGracePeriod: config.endSessionHintGracePeriod,\n        });\n\n        return new LogoutController({\n            options: { baseURL: config.publicUrl },\n            endSessionService,\n        });\n    }\n\n    createStatusController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return new StatusController({ options: { features: this.buildUIFeatures(config) } });\n    }\n\n    buildUIFeatures(config: Config) : StatusResponseFeatures {\n        return {\n            registration: config.registrationEnabled,\n            passwordRecovery: config.passwordRecoveryEnabled,\n            emailVerification: config.emailVerificationEnabled,\n        };\n    }\n\n    createRegistrationService(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const mailClient = container.resolve(MailInjectionKey);\n        const mailTemplateRenderer = container.resolve(MailTemplateRendererInjectionKey);\n\n        return new RegistrationService({\n            mailClient,\n            mailTemplateRenderer,\n            repository,\n            realmRepository: new RealmRepositoryAdapter(realmRepository),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            options: {\n                registrationEnabled: config.registrationEnabled,\n                emailVerificationEnabled: config.emailVerificationEnabled,\n                publicUrl: config.publicUrl,\n                passwordMinLength: config.passwordMinLength,\n            },\n        });\n    }\n\n    createIdentityProvider(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const accountManager = container.resolve(IdentityInjectionKey.ProviderAccountManager);\n\n        const codeIssuer = container.resolve(OAuth2InjectionToken.AuthorizationCodeIssuer);\n\n        const codeRequestVerifier = container.resolve(OAuth2InjectionToken.AuthorizationCodeRequestVerifier);\n\n        const stateManager = container.resolve(OAuth2InjectionToken.AuthorizationStateManager);\n\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const repository = new IdentityProviderRepositoryAdapter({\n            repository: new IdentityProviderRepository(dataSource),\n            realmRepository,\n        });\n\n        return new IdentityProviderController({\n            options: { baseURL: config.publicUrl },\n\n            repository,\n            realmRepository: new RealmRepositoryAdapter(realmRepository),\n            clientRepository: container.resolve(OAuth2InjectionToken.ClientRepository),\n\n            accountManager,\n\n            codeIssuer,\n            codeRequestVerifier,\n            stateManager,\n\n            accessPolicyEvaluator: this.resolveAccessPolicyEvaluator(container),\n        });\n    }\n\n    createClientController(container: IContainer) {\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        const service = new ClientService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n        });\n        return new ClientController({\n            service,\n            repository,\n        });\n    }\n\n    private createPermissionRepository(container: IContainer): PermissionRepositoryAdapter {\n        return new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<Permission>>(PermissionEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n    }\n\n    private createRoleRepository(container: IContainer): RoleRepositoryAdapter {\n        return new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n    }\n\n    async createPermissionController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<Permission>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const rolePermissionRepository = new RolePermissionRepositoryAdapter(\n            container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n        );\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const service = new PermissionService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            roleRepository,\n            rolePermissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n        const checkerService = new PermissionCheckerService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            permissionProvider,\n            identityPermissionProvider,\n        });\n\n        return new PermissionController({\n            service,\n            checkerService,\n        });\n    }\n\n    createRoleController(container: IContainer) {\n        const realmRepository = new RealmRepositoryAdapter(\n            container.resolve<Repository<Realm>>(RealmEntity),\n        );\n        const repository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n        const service = new RoleService({\n            repository,\n            realmRepository,\n        });\n        return new RoleController({ service });\n    }\n\n    createClientPermissionController(container: IContainer) {\n        const repository = new ClientPermissionRepositoryAdapter(\n            container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n        );\n        const permissionRepository = this.createPermissionRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new ClientPermissionService({\n            repository,\n            permissionRepository,\n            identityPermissionProvider,\n        });\n        return new ClientPermissionController({ service });\n    }\n\n    createClientRoleController(container: IContainer) {\n        const repository = new ClientRoleRepositoryAdapter(\n            container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n        );\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new ClientRoleService({ repository, identityPermissionProvider });\n        return new ClientRoleController({ service });\n    }\n\n    createClientScopeController(container: IContainer) {\n        const repository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n        const service = new ClientScopeService({ repository });\n        return new ClientScopeController({ service });\n    }\n\n    createRoleAttributeController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const repository = new RoleAttributeRepositoryAdapter(\n            container.resolve<Repository<RoleAttribute>>(RoleAttributeEntity),\n        );\n        const reservedNames = new Set(\n            dataSource.getMetadata(RoleEntity).columns.map((c) => c.propertyName),\n        );\n        const service = new RoleAttributeService({ repository, reservedNames });\n        return new RoleAttributeController({ service });\n    }\n\n    createRolePermissionController(container: IContainer) {\n        const repository = new RolePermissionRepositoryAdapter(\n            container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n        );\n        const permissionRepository = this.createPermissionRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new RolePermissionService({\n            repository,\n            permissionRepository,\n            identityPermissionProvider,\n        });\n        return new RolePermissionController({ service });\n    }\n\n    createPermissionPolicyController(container: IContainer) {\n        const repository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n        const service = new PermissionPolicyService({ repository });\n        return new PermissionPolicyController({ service });\n    }\n\n    createScopeController(container: IContainer) {\n        const realmRepository = new RealmRepositoryAdapter(\n            container.resolve<Repository<Realm>>(RealmEntity),\n        );\n        const repository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n        const service = new ScopeService({\n            repository,\n            realmRepository,\n        });\n        return new ScopeController({ service });\n    }\n\n    createKeyController(container: IContainer) {\n        // the DI singleton carries the optional KEK cipher — never construct\n        // a fresh adapter here.\n        const service = new KeyService({\n            repository: container.resolve(OAuth2InjectionToken.KeyStore),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            requestContext: useRequestEventContext,\n        });\n        return new KeyController({ service });\n    }\n\n    createTrustAnchorController(container: IContainer) {\n        const repository = new TrustAnchorRepositoryAdapter(\n            container.resolve(DatabaseInjectionKey.DataSource),\n        );\n        const service = new TrustAnchorService({\n            repository,\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            requestContext: useRequestEventContext,\n        });\n        return new TrustAnchorController({ service });\n    }\n\n    createSessionController(container: IContainer) {\n        const repository = container.resolve(AuthenticationInjectionKey.SessionRepository);\n        const service = new SessionService({ repository });\n        return new SessionController({ service });\n    }\n\n    protected createConsentService(container: IContainer) : ConsentService {\n        const repository = container.resolve(OAuth2InjectionToken.ConsentRepository);\n        return new ConsentService({ repository });\n    }\n\n    createConsentController(container: IContainer) {\n        return new ConsentController({ service: this.createConsentService(container) });\n    }\n\n    private accessPolicyEvaluator? : OAuth2AccessPolicyEvaluator;\n\n    protected resolveAccessPolicyEvaluator(container: IContainer) : OAuth2AccessPolicyEvaluator {\n        if (this.accessPolicyEvaluator) {\n            return this.accessPolicyEvaluator;\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        this.accessPolicyEvaluator = new OAuth2AccessPolicyEvaluator({\n            policyProvider: new PolicyRepository(dataSource),\n            identityPermissionProvider: container.resolve(IdentityInjectionKey.PermissionProvider),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        return this.accessPolicyEvaluator;\n    }\n\n    private userAuthenticatorService? : UserAuthenticatorService;\n\n    protected resolveUserAuthenticatorService(container: IContainer) : UserAuthenticatorService {\n        if (this.userAuthenticatorService) {\n            return this.userAuthenticatorService;\n        }\n\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const repository = new UserAuthenticatorRepositoryAdapter(\n            container.resolve<Repository<UserAuthenticatorModel>>(UserAuthenticatorEntity),\n        );\n        const userRepository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n\n        let issuer : string | undefined;\n        let webauthn : {\n            rpId: string, \n            rpName: string, \n            origin: string \n        } | undefined;\n        try {\n            const url = new URL(config.publicUrl);\n            issuer = url.hostname;\n            webauthn = {\n                rpId: url.hostname,\n                rpName: issuer,\n                origin: url.origin,\n            };\n        } catch {\n            issuer = undefined;\n            webauthn = undefined;\n        }\n\n        this.userAuthenticatorService = new UserAuthenticatorService({\n            repository,\n            userRepository,\n            cache: container.resolve(CacheInjectionKey),\n            cipher: new RealmCipher({ keyStore: container.resolve(OAuth2InjectionToken.KeyStore) }),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            mailClient: container.resolve(MailInjectionKey),\n            mailTemplateRenderer: container.resolve(MailTemplateRendererInjectionKey),\n            options: {\n                enabled: config.mfaEnabled,\n                required: config.mfaRequired,\n                issuer,\n                webauthn,\n            },\n        });\n\n        return this.userAuthenticatorService;\n    }\n\n    createUserAuthenticatorController(container: IContainer) {\n        return new UserAuthenticatorController({ service: this.resolveUserAuthenticatorService(container) });\n    }\n\n    private mfaLoginService? : OAuth2MfaLoginService;\n\n    protected resolveMfaLoginService(container: IContainer) : OAuth2MfaLoginService {\n        if (this.mfaLoginService) {\n            return this.mfaLoginService;\n        }\n\n        this.mfaLoginService = new OAuth2MfaLoginService({\n            sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),\n            ticketIssuer: container.resolve(OAuth2InjectionToken.MfaTokenIssuer),\n            accessTokenIssuer: container.resolve(OAuth2InjectionToken.AccessTokenIssuer),\n            refreshTokenIssuer: container.resolve(OAuth2InjectionToken.RefreshTokenIssuer),\n            tokenRepository: container.resolve(OAuth2InjectionToken.TokenRepository),\n            eventService: container.resolve(DatabaseInjectionKey.EventService),\n            metrics: container.resolve(MetricsInjectionKey),\n        });\n\n        return this.mfaLoginService;\n    }\n\n    createAuthenticatorChallengeController(container: IContainer) {\n        return new AuthenticatorChallengeController({\n            service: this.resolveUserAuthenticatorService(container),\n            sessionManager: container.resolve(AuthenticationInjectionKey.SessionManager),\n            mfaLoginService: this.resolveMfaLoginService(container),\n        });\n    }\n\n    createEventController(container: IContainer) {\n        const service = container.resolve(DatabaseInjectionKey.EventService);\n        return new EventController({ service });\n    }\n\n    createUserService(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        return new UserService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            passwordMinLength: config.passwordMinLength,\n        });\n    }\n\n    createUserController(container: IContainer) {\n        return new UserController({ service: this.createUserService(container) });\n    }\n\n    createUserInfoController(container: IContainer) {\n        return new UserInfoController({ service: this.createUserService(container) });\n    }\n\n    createUserAttributeController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const repository = new UserAttributeRepositoryAdapter(\n            container.resolve<Repository<UserAttribute>>(UserAttributeEntity),\n        );\n        const reservedNames = new Set(\n            dataSource.getMetadata(UserEntity).columns.map((c) => c.propertyName),\n        );\n        const service = new UserAttributeService({ repository, reservedNames });\n        return new UserAttributeController({ service });\n    }\n\n    createUserPermissionController(container: IContainer) {\n        const repository = new UserPermissionRepositoryAdapter(\n            container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n        );\n        const permissionRepository = this.createPermissionRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new UserPermissionService({\n            repository,\n            permissionRepository,\n            identityPermissionProvider,\n        });\n        return new UserPermissionController({ service });\n    }\n\n    createUserRoleController(container: IContainer) {\n        const repository = new UserRoleRepositoryAdapter(\n            container.resolve<Repository<UserRole>>(UserRoleEntity),\n        );\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new UserRoleService({ repository, identityPermissionProvider });\n        return new UserRoleController({ service });\n    }\n\n    createPolicyController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n        const realmRepositoryAdapter = new RealmRepositoryAdapter(realmRepository);\n        const service = new PolicyService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n        });\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const checkerService = new PolicyCheckerService({\n            repository,\n            realmRepository: realmRepositoryAdapter,\n            identityPermissionProvider,\n        });\n\n        return new PolicyController({\n            service,\n            checkerService,\n        });\n    }\n\n    createIdentityProviderRoleController(container: IContainer) {\n        const repository = new IdentityProviderRoleMappingRepositoryAdapter(\n            container.resolve<Repository<any>>(IdentityProviderRoleMappingEntity),\n        );\n        const roleRepository = this.createRoleRepository(container);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n        const service = new IdentityProviderRoleMappingService({\n            repository,\n            roleRepository,\n            identityPermissionProvider,\n        });\n        return new IdentityProviderRoleMappingController({ service });\n    }\n\n    createJwkController(container: IContainer) {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const repository = dataSource.getRepository(KeyEntity);\n        return new JwkController({ repository });\n    }\n\n    createRealmController(container: IContainer) {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const repository = new RealmRepositoryAdapter(realmRepository);\n\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const logger = container.resolve(LoggerInjectionKey);\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            scopeRepository: new ScopeRepositoryAdapter({\n                repository: container.resolve<Repository<Scope>>(ScopeEntity),\n                realmRepository,\n            }),\n            clientScopeRepository: new ClientScopeRepositoryAdapter(\n                container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n            ),\n            appOrigins: getAppOrigins(config),\n            logger,\n        });\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: container.resolve(OAuth2InjectionToken.KeyStore),\n            logger,\n        });\n\n        const service = new RealmService({\n            repository,\n            webClientProvisioner,\n            keyProvisioner,\n            logger,\n        });\n        const keyRepository = dataSource.getRepository(KeyEntity);\n\n        return new RealmController({\n            options: {\n                baseURL: config.publicUrl,\n                mtlsBaseURL: config.mtlsPublicUrl,\n                clientCertificatesEnabled: config.certificateSource !== 'disabled',\n            },\n            service,\n            keyRepository,\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsKA,IAAagI,uBAAb,MAAaA;CACT,MAAMC,MAAMC,QAAaC,WAAsC;EAC3D,MAAMC,kBAAkB,KAAKC,sBAAsBF,SAAAA;EACnD,MAAMG,kBAAkB,KAAKC,sBAAsBJ,SAAAA;EACnD,MAAMK,iBAAiB,KAAKC,qBAAqBN,SAAAA;EACjD,MAAMO,uBAAuB,MAAM,KAAKC,2BAA2BR,SAAAA;EACnE,MAAMS,6BAA6B,KAAKC,iCAAiCV,SAAAA;EACzE,MAAMW,mBAAmB,KAAKC,uBAAuBZ,SAAAA;EACrD,MAAMa,6BAA6B,KAAKC,iCAAiCd,SAAAA;EACzE,MAAMe,uBAAuB,KAAKC,2BAA2BhB,SAAAA;EAC7D,MAAMiB,wBAAwB,KAAKC,4BAA4BlB,SAAAA;EAC/D,MAAMmB,0BAA0B,KAAKC,8BAA8BpB,SAAAA;EACnE,MAAMqB,2BAA2B,KAAKC,+BAA+BtB,SAAAA;EACrE,MAAMuB,kBAAkB,KAAKC,sBAAsBxB,SAAAA;EACnD,MAAMyB,gBAAgB,KAAKC,oBAAoB1B,SAAAA;EAC/C,MAAM2B,wBAAwB,KAAKC,4BAA4B5B,SAAAA;EAC/D,MAAM6B,oBAAoB,KAAKC,wBAAwB9B,SAAAA;EACvD,MAAM+B,oBAAoB,KAAKC,wBAAwBhC,SAAAA;EACvD,MAAMiC,iBAAiB,KAAKC,qBAAqBlC,SAAAA;EACjD,MAAMmC,0BAA0B,KAAKC,8BAA8BpC,SAAAA;EACnE,MAAMqC,8BAA8B,KAAKC,kCAAkCtC,SAAAA;EAC3E,MAAMuC,2BAA2B,KAAKC,+BAA+BxC,SAAAA;EACrE,MAAMyC,qBAAqB,KAAKC,yBAAyB1C,SAAAA;EACzD,MAAM2C,mBAAmB,KAAKC,uBAAuB5C,SAAAA;EACrD,MAAM6C,iCAAiC,KAAKC,qCAAqC9C,SAAAA;EAEjFD,OAAOgD,IAAIlL,WAAW,EAClBmL,aAAa;GACT,KAAKC,gBAAgBjD,SAAAA;GACrB,KAAKkD,YAAYlD,SAAAA;GACjB,KAAKmD,oBAAoBnD,SAAAA;GACzB,KAAKoD,uBAAuBpD,SAAAA;GAC5B,KAAKqD,yBAAyBrD,SAAAA;GAC9B,KAAKsD,+BAA+BtD,SAAAA;GACpC,KAAKuD,8BAA8BvD,SAAAA;GACnC,KAAKwD,yBAAyBxD,SAAAA;GAC9B,KAAKyD,uBAAuBzD,SAAAA;GAC5B,KAAK0D,uCAAuC1D,SAAAA;GAC5C,KAAK2D,yBAAyB3D,SAAAA;GAE9B,KAAK4D,uBAAuB5D,SAAAA;GAE5BW;GACAE;GACAE;GACAE;GACAc;GACA9B;GACA4C;GACA,KAAKgB,uBAAuB7D,SAAAA;GAC5ByB;GACAE;GACApB;GACAE;GACAkC;GACAxC;GACAE;GACAc;GACAE;GACAE;GACAM;GACAI;GACAE;GACAE;GACAE;GACAE;EACH,EACL,CAAA,CAAA;CACJ;CAIAQ,gBAAgBjD,WAAuB;EACnC,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EAEjC,MAAM0E,aAAahE,UAAU+D,QAAQ3E,qBAAqB6E,uBAAuB;EACjF,MAAMC,sBAAsBlE,UAAU+D,QAAQ3E,qBAAqB+E,gCAAgC;EAEnG,MAAMC,iBAAiBpE,UAAU+D,QAAQ5E,2BAA2BkF,cAAc;EAElF,MAAMC,eAAetE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;EACxE,MAAMC,UAAUxE,UAAU+D,QAAQnE,mBAAAA;EAElC,OAAO,IAAIxD,oBAAoB;GAC3BqI,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;IAC/BgB,mBAAmBhB,OAAOgB;IAC1BC,oBAAoBjB,OAAOiB;GAC/B;GAEAf;GACAE;GAEAE;GAEAE;GACAE;GAEAQ,sBAAsB,KAAKC,gCAAgCjF,SAAAA;GAC3DkF,uBAAuB,KAAKC,6BAA6BnF,SAAAA;GAEzDoF,gBAAgB,KAAKC,qBAAqBrF,SAAAA;GAC1CsF,QAAQtF,UAAU+D,QAAQtE,kBAAAA;EAC9B,CAAA;CACJ;CAEAyD,YAAYlD,WAAuB;EAC/B,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EACjC,MAAMgG,SAAStF,UAAU+D,QAAQtE,kBAAAA;EACjC,MAAM8F,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EAEpE,MAAMpB,iBAAiBpE,UAAU+D,QAAQ5E,2BAA2BkF,cAAc;EAElF,MAAMoB,eAAezF,UAAU+D,QAAQ3E,qBAAqBsG,yBAAyB;EAErF,MAAMC,oBAAoB3F,UAAU+D,QAAQ3E,qBAAqBwG,iBAAiB;EAClF,MAAMC,qBAAqB7F,UAAU+D,QAAQ3E,qBAAqB0G,kBAAkB;EACpF,MAAMC,oBAAoB/F,UAAU+D,QAAQ3E,qBAAqB4G,iBAAiB;EAClF,MAAMC,WAAWjG,UAAU+D,QAAQ3E,qBAAqB8G,QAAQ;EAEhE,MAAMC,eAAenG,UAAU+D,QAAQ3E,qBAAqBgH,YAAY;EACxE,MAAMC,gBAAgBrG,UAAU+D,QAAQ3E,qBAAqBkH,aAAa;EAC1E,MAAMC,kBAAkBvG,UAAU+D,QAAQ3E,qBAAqBoH,eAAe;EAC9E,MAAMC,yBAAyBzG,UAAU+D,QAAQ3E,qBAAqBsH,sBAAsB;EAE5F,MAAMC,mBAAmB3G,UAAU+D,QAAQ1E,qBAAqBuH,QAAQ;EACxE,MAAMC,8CAA8C7G,UAAU+D,QAAQ1E,qBAAqByH,mCAAmC;EAE9H,MAAMC,6BAA6B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAAkB;EAE5F,MAAMC,oBAAoB,IAAI7J,yBAAyB,CACnDyJ,6CACA,IAAIhI,kBAAkB8H,gBAAAA,CACzB,CAAA;EAED,MAAMO,4BAA4B,IAAIxJ,0BAA0B;GAC5DiJ;GACAQ,sBAAsB,IAAIrK,2BAA2B,EAAEsK,uBAAuB,IAAIjN,6BAA6BoL,UAAAA,EAAY,CAAA;EAC/H,CAAA;EAcA,OAAO,IAAI3I,gBAAgB;GACvB6I;GAEAE;GACAE;GACAE;GACAE;GAEAI;GACAF;GACAI;GACAE;GAEAnC,cAzBiBtE,UAAU+D,QAAQxK,qBAAqBgL,YAyBxDD;GACAE,SAzBYxE,UAAU+D,QAAQnE,mBAyB9B4E;GACA6C,sBAAAA,IAxB6B7J,qBAAqB;IAClD8J,YAAYtH,UAAU+D,QAAQxK,qBAAqBgO,eAAe;IAClE9C,SAAS;KACL+C,SAAS1D,OAAO2D;KAChBC,WAAW5D,OAAO6D;KAClBC,eAAe9D,OAAO+D;IAC1B;GACJ,CAiBIR;GACAS,0BAA0B,KAAK7C,gCAAgCjF,SAAAA;GAC/D+H,iBAAiB,KAAKC,uBAAuBhI,SAAAA;GAC7CkF,uBAAuB,KAAKC,6BAA6BnF,SAAAA;GAEzDiI,yBAAyBnE,OAAOmE;GAChC3C;GAEAqB;GACAI;GAEAE;GAEAC;GACAgB,mBAAmBpE,OAAOoE;GAE1BC,iBAAiB,IAAIrO,uBAAuBkG,UAAU+D,QAA2BvL,WAAAA,CAAAA;GAEjF4L;EACJ,CAAA;CACJ;CAEAhB,uBAAuBpD,WAAuB;EAG1C,OAAO,IAAIzD,iBAAiB,EAAEmI,SAFf1E,UAAU+D,QAAQzE,kBAEMwE,CAAAA,CAAOa,UAAU,CAAA;CAC5D;CAEAtB,yBAAyBrD,WAAuB;EAC5C,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EAEjC,OAAO,IAAIpD,mBAAmB;GAC1BuI,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKC,0BAA0BrI,SAAAA;EAC5C,CAAA;CACJ;CAEAsD,+BAA+BtD,WAAuB;EAClD,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EAEjC,OAAO,IAAI9C,yBAAyB;GAChCiI,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKE,8BAA8BtI,SAAAA;EAChD,CAAA;CACJ;CAEAuD,8BAA8BvD,WAAuB;EACjD,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EAEjC,OAAO,IAAI7C,wBAAwB;GAC/BgI,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKE,8BAA8BtI,SAAAA;EAChD,CAAA;CACJ;CAEAsI,8BAA8BtI,WAAuB;EACjD,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EACjC,MAAMiG,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EACpE,MAAM2C,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAC7D,MAAM8O,aAAa,IAAI/M,sBAAsB;GACzC+M,YAAY,IAAIrO,eAAesM,UAAAA;GAC/B4C;EACJ,CAAA;EAIA,OAAO,IAAItK,wBAAwB;GAC/B0K,YAJevI,UAAU+D,QAAQrE,gBAIjC6I;GACAC,sBAJyBxI,UAAU+D,QAAQpE,gCAI3C6I;GACAlB;GACAa,iBAAiB,IAAIrO,uBAAuBqO,eAAAA;GAC5C7D,cAActE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;GACjEE,SAAS;IACLgE,yBAAyB3E,OAAO2E;IAChCC,0BAA0B5E,OAAO4E;IACjC/D,WAAWb,OAAOa;IAClBgE,mBAAmB7E,OAAO6E;GAC9B;EACJ,CAAA;CACJ;CAEAnF,yBAAyBxD,WAAuB;EAC5C,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EAEjC,OAAO,IAAI5C,mBAAmB;GAC1B+H,SAAS;IACLC,SAASZ,OAAOa;IAChBC,UAAU,KAAKC,gBAAgBf,MAAAA;GACnC;GACAsE,SAAS,KAAKC,0BAA0BrI,SAAAA;EAC5C,CAAA;CACJ;CAEAyD,uBAAuBzD,WAAuB;EAC1C,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EAMjC,MAAMwJ,oBAAoB,IAAInL,wBAAwB;GAClD0I,eANkBrG,UAAU+D,QAAQ3E,qBAAqBkH,aAMzDD;GACAjC,gBANmBpE,UAAU+D,QAAQ5E,2BAA2BkF,cAMhED;GACAwE,kBANqB5I,UAAU+D,QAAQ3E,qBAAqByJ,gBAM5DD;GACAT,iBAAAA,IANwBrO,uBAAuBkG,UAAU+D,QAA2BvL,WAAAA,CAMpF2P;GACA7D,cAActE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;GACjEwE,iBAAiBjF,OAAOkF;EAC5B,CAAA;EAEA,OAAO,IAAI1M,iBAAiB;GACxBmI,SAAS,EAAEC,SAASZ,OAAOa,UAAU;GACrCmE;EACJ,CAAA;CACJ;CAEAlF,uBAAuB5D,WAAuB;EAC1C,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EAEjC,OAAO,IAAI3C,iBAAiB,EAAE8H,SAAS,EAAEG,UAAU,KAAKC,gBAAgBf,MAAAA,EAAQ,EAAE,CAAA;CACtF;CAEAe,gBAAgBf,QAAyC;EACrD,OAAO;GACHmF,cAAcnF,OAAOoF;GACrBC,kBAAkBrF,OAAO2E;GACzBW,mBAAmBtF,OAAO4E;EAC9B;CACJ;CAEAL,0BAA0BrI,WAAuB;EAC7C,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EACjC,MAAMiG,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EACpE,MAAM2C,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAC7D,MAAM8O,aAAa,IAAI/M,sBAAsB;GACzC+M,YAAY,IAAIrO,eAAesM,UAAAA;GAC/B4C;EACJ,CAAA;EAIA,OAAO,IAAI9J,oBAAoB;GAC3BkK,YAJevI,UAAU+D,QAAQrE,gBAIjC6I;GACAC,sBAJyBxI,UAAU+D,QAAQpE,gCAI3C6I;GACAlB;GACAa,iBAAiB,IAAIrO,uBAAuBqO,eAAAA;GAC5C7D,cAActE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;GACjEE,SAAS;IACLyE,qBAAqBpF,OAAOoF;IAC5BR,0BAA0B5E,OAAO4E;IACjC/D,WAAWb,OAAOa;IAClBgE,mBAAmB7E,OAAO6E;GAC9B;EACJ,CAAA;CACJ;CAEA9E,uBAAuB7D,WAAuB;EAC1C,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EACjC,MAAMiG,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EAEpE,MAAM6D,iBAAiBrJ,UAAU+D,QAAQ1E,qBAAqBiK,sBAAsB;EAEpF,MAAMtF,aAAahE,UAAU+D,QAAQ3E,qBAAqB6E,uBAAuB;EAEjF,MAAMC,sBAAsBlE,UAAU+D,QAAQ3E,qBAAqB+E,gCAAgC;EAEnG,MAAMoF,eAAevJ,UAAU+D,QAAQ3E,qBAAqBoK,yBAAyB;EAErF,MAAMrB,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAE7D,MAAM8O,aAAa,IAAI9N,kCAAkC;GACrD8N,YAAY,IAAIpP,2BAA2BqN,UAAAA;GAC3C4C;EACJ,CAAA;EAEA,OAAO,IAAIpN,2BAA2B;GAClC0J,SAAS,EAAEC,SAASZ,OAAOa,UAAU;GAErC2C;GACAa,iBAAiB,IAAIrO,uBAAuBqO,eAAAA;GAC5CS,kBAAkB5I,UAAU+D,QAAQ3E,qBAAqByJ,gBAAgB;GAEzEQ;GAEArF;GACAE;GACAqF;GAEArE,uBAAuB,KAAKC,6BAA6BnF,SAAAA;EAC7D,CAAA;CACJ;CAEAY,uBAAuBZ,WAAuB;EAC1C,MAAMmI,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAC7D,MAAM8O,aAAa,IAAIlO,wBAAwB;GAC3CkO,YAAYtH,UAAU+D,QAA4BjM,YAAAA;GAClDqQ;EACJ,CAAA;EAMA,OAAO,IAAI1N,iBAAiB;GACxB2N,SAAAA,IALgBlL,cAAc;IAC9BoK;IACAa,iBAAiBsB,IAHc3P,uBAAuBqO,eAGrCsB;GACrB,CAEIrB;GACAd;EACJ,CAAA;CACJ;CAEQoC,2BAA2B1J,WAAoD;EACnF,OAAO,IAAIpG,4BAA4B;GACnC0N,YAAYtH,UAAU+D,QAAgC1L,gBAAAA;GACtD8P,iBAAiBnI,UAAU+D,QAA2BvL,WAAAA;EAC1D,CAAA;CACJ;CAEQmR,qBAAqB3J,WAA8C;EACvE,OAAO,IAAI/F,sBAAsB;GAC7BqN,YAAYtH,UAAU+D,QAA0BrL,UAAAA;GAChDyP,iBAAiBnI,UAAU+D,QAA2BvL,WAAAA;EAC1D,CAAA;CACJ;CAEA,MAAMgI,2BAA2BR,WAAuB;EACpD,MAAMuF,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EACpE,MAAM2C,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAC7D,MAAM8O,aAAa,IAAI1N,4BAA4B;GAC/C0N,YAAYtH,UAAU+D,QAAgC1L,gBAAAA;GACtD8P;EACJ,CAAA;EAEA,MAAMsB,yBAAyB,IAAI3P,uBAAuBqO,eAAAA;EAiB1D,MAAMC,UAAU,IAAIpK,kBAAkB;GAClCsJ;GACAa,iBAAiBsB;GACjBG,gBAAAA,IAnBuB3P,sBAAsB;IAC7CqN,YAAYtH,UAAU+D,QAA0BrL,UAAAA;IAChDyP;GACJ,CAgBIyB;GACAC,0BAAAA,IAhBiC7P,gCACjCgG,UAAU+D,QAAoCpL,oBAAAA,CAe9CkR;GACAC,kBAAAA,IAdyBjQ,wBAAwB;IACjDyN,YAAY,IAAI/O,iBAAiBgN,UAAAA;IACjC4C;GACJ,CAWI2B;GACAC,4BAAAA,IAVmCpQ,kCACnCqG,UAAU+D,QAAsCzL,sBAAAA,CAShDyR;EACJ,CAAA;EAEA,MAAMhD,6BAA6B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAAkB;EAU5F,OAAO,IAAI9L,qBAAqB;GAC5BkN;GACA6B,gBAAAA,IATuBnM,yBAAyB;IAChDwJ;IACAa,iBAAiBsB;IACjBO,oBAAAA,IAL2BtQ,2BAA2B6L,UAKtDyE;IACAjD;GACJ,CAIIkD;EACJ,CAAA;CACJ;CAEA3J,qBAAqBN,WAAuB;EACxC,MAAMmI,kBAAkB,IAAIrO,uBACxBkG,UAAU+D,QAA2BvL,WAAAA,CAAAA;EAUzC,OAAO,IAAI+C,eAAe,EAAE6M,SAAAA,IAJR5J,YAAY;GAC5B8I,YAAAA,IALmBrN,sBAAsB;IACzCqN,YAAYtH,UAAU+D,QAA0BrL,UAAAA;IAChDyP,iBAAiBnI,UAAU+D,QAA2BvL,WAAAA;GAC1D,CAEI8O;GACAa;EACJ,CAC4BC,EAAQ,CAAA;CACxC;CAEAtH,iCAAiCd,WAAuB;EAWpD,OAAO,IAAItF,2BAA2B,EAAE0N,SAAAA,IALpBrL,wBAAwB;GACxCuK,YAAAA,IANmBnO,kCACnB6G,UAAU+D,QAAsChM,sBAAAA,CAKhDuP;GACA4C,sBAJyB,KAAKR,2BAA2B1J,SAIzDkK;GACAnD,4BAJ+B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAItED;EACJ,CACwCqB,EAAQ,CAAA;CACpD;CAEApH,2BAA2BhB,WAAuB;EAM9C,OAAO,IAAIrF,qBAAqB,EAAEyN,SAAAA,IADdpL,kBAAkB;GAAEsK,YAAAA,IAJjBjO,4BACnB2G,UAAU+D,QAAgC/L,gBAAAA,CAGNsP;GAAYP,4BADjB/G,UAAU+D,QAAQ1E,qBAAqB2H,kBACtBD;EAA2B,CAC7CqB,EAAQ,CAAA;CAC9C;CAEAlH,4BAA4BlB,WAAuB;EAK/C,OAAO,IAAIpF,sBAAsB,EAAEwN,SAAAA,IADfnL,mBAAmB,EAAEqK,YAAAA,IAHlBhO,6BACnB0G,UAAU+D,QAAiC9L,iBAAAA,CAENqP,EAAW,CACjBc,EAAQ,CAAA;CAC/C;CAEAhH,8BAA8BpB,WAAuB;EACjD,MAAMuF,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EAQpE,OAAO,IAAIlK,wBAAwB,EAAE8M,SAAAA,IADjB9J,qBAAqB;GAAEgJ,YAAAA,IANpBvN,+BACnBiG,UAAU+D,QAAmCtL,mBAAAA,CAKN6O;GAAY6C,eAAAA,IAH7BC,IACtB7E,WAAW8E,YAAY3R,UAAAA,CAAAA,CAAY4R,QAAQC,KAAKC,MAAMA,EAAEC,YAAY,CAEjBN;EAAc,CAChC/B,EAAQ,CAAA;CACjD;CAEA9G,+BAA+BtB,WAAuB;EAWlD,OAAO,IAAIxE,yBAAyB,EAAE4M,SAAAA,IALlB7J,sBAAsB;GACtC+I,YAAAA,IANmBtN,gCACnBgG,UAAU+D,QAAoCpL,oBAAAA,CAK9C2O;GACA4C,sBAJyB,KAAKR,2BAA2B1J,SAIzDkK;GACAnD,4BAJ+B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAItED;EACJ,CACsCqB,EAAQ,CAAA;CAClD;CAEA1H,iCAAiCV,WAAuB;EAKpD,OAAO,IAAI7E,2BAA2B,EAAEiN,SAAAA,IADpBrK,wBAAwB,EAAEuJ,YAAAA,IAHvB3N,kCACnBqG,UAAU+D,QAAsCzL,sBAAAA,CAENgP,EAAW,CACjBc,EAAQ,CAAA;CACpD;CAEA5G,sBAAsBxB,WAAuB;EACzC,MAAMmI,kBAAkB,IAAIrO,uBACxBkG,UAAU+D,QAA2BvL,WAAAA,CAAAA;EAUzC,OAAO,IAAIiD,gBAAgB,EAAE2M,SAAAA,IAJT3J,aAAa;GAC7B6I,YAAAA,IALmBpN,uBAAuB;IAC1CoN,YAAYtH,UAAU+D,QAA2BnL,WAAAA;IACjDuP,iBAAiBnI,UAAU+D,QAA2BvL,WAAAA;GAC1D,CAEI8O;GACAa;EACJ,CAC6BC,EAAQ,CAAA;CACzC;CAEA1G,oBAAoB1B,WAAuB;EAQvC,OAAO,IAAI/E,cAAc,EAAEmN,SAAAA,IALP7K,WAAW;GAC3B+J,YAAYtH,UAAU+D,QAAQ3E,qBAAqB8G,QAAQ;GAC3D5B,cAActE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;GACjEmG,gBAAgBzO;EACpB,CAC2BmM,EAAQ,CAAA;CACvC;CAEAxG,4BAA4B5B,WAAuB;EAS/C,OAAO,IAAIrE,sBAAsB,EAAEyM,SAAAA,IALfzJ,mBAAmB;GACnC2I,YAAAA,IAJmBnN,6BACnB6F,UAAU+D,QAAQxK,qBAAqBiM,UAAU,CAGjD8B;GACAhD,cAActE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;GACjEmG,gBAAgBzO;EACpB,CACmCmM,EAAQ,CAAA;CAC/C;CAEAtG,wBAAwB9B,WAAuB;EAG3C,OAAO,IAAItE,kBAAkB,EAAE0M,SAAAA,IADX1J,eAAe,EAAE4I,YADlBtH,UAAU+D,QAAQ5E,2BAA2BwL,iBAC3BrD,EAAW,CACjBc,EAAQ,CAAA;CAC3C;CAEU/C,qBAAqBrF,WAAwC;EAEnE,OAAO,IAAI7C,eAAe,EAAEmK,YADTtH,UAAU+D,QAAQ3E,qBAAqBwL,iBAC9BtD,EAAW,CAAA;CAC3C;CAEAtF,wBAAwBhC,WAAuB;EAC3C,OAAO,IAAInF,kBAAkB,EAAEuN,SAAS,KAAK/C,qBAAqBrF,SAAAA,EAAW,CAAA;CACjF;CAEQkF;CAEEC,6BAA6BnF,WAAqD;EACxF,IAAI,KAAKkF,uBACL,OAAO,KAAKA;EAGhB,MAAMK,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EAEpE,KAAKN,wBAAwB,IAAIzH,4BAA4B;GACzDoN,gBAAgB,IAAItS,iBAAiBgN,UAAAA;GACrCwB,4BAA4B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAAkB;GACrF1B,QAAQtF,UAAU+D,QAAQtE,kBAAAA;EAC9B,CAAA;EAEA,OAAO,KAAKyF;CAChB;CAEQ4C;CAEE7C,gCAAgCjF,WAAkD;EACxF,IAAI,KAAK8H,0BACL,OAAO,KAAKA;EAGhB,MAAMhE,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EACjC,MAAMiG,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EAEpE,MAAM8B,aAAa,IAAIjN,mCACnB2F,UAAU+D,QAA4CjL,uBAAAA,CAAAA;EAE1D,MAAMgS,iBAAiB,IAAIvQ,sBAAsB;GAC7C+M,YAAY,IAAIrO,eAAesM,UAAAA;GAC/B4C,iBAAiBnI,UAAU+D,QAA2BvL,WAAAA;EAC1D,CAAA;EAEA,IAAIuS;EACJ,IAAIC;EAKJ,IAAI;GACA,MAAMC,MAAM,IAAIC,IAAIpH,OAAOa,SAAS;GACpCoG,SAASE,IAAIE;GACbH,WAAW;IACPI,MAAMH,IAAIE;IACVE,QAAQN;IACRO,QAAQL,IAAIK;GAChB;EACJ,QAAQ;GACJP,SAASQ,KAAAA;GACTP,WAAWO,KAAAA;EACf;EAEA,KAAKzD,2BAA2B,IAAIhJ,yBAAyB;GACzDwI;GACAwD;GACAU,OAAOxL,UAAU+D,QAAQvE,iBAAAA;GACzBiM,QAAQ,IAAItN,YAAY,EAAE8H,UAAUjG,UAAU+D,QAAQ3E,qBAAqB8G,QAAQ,EAAE,CAAA;GACrF5B,cAActE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;GACjEgE,YAAYvI,UAAU+D,QAAQrE,gBAAAA;GAC9B8I,sBAAsBxI,UAAU+D,QAAQpE,gCAAAA;GACxC8E,SAAS;IACL+C,SAAS1D,OAAO4H;IAChBC,UAAU7H,OAAO8H;IACjBb;IACAC;GACJ;EACJ,CAAA;EAEA,OAAO,KAAKlD;CAChB;CAEAxF,kCAAkCtC,WAAuB;EACrD,OAAO,IAAInE,4BAA4B,EAAEuM,SAAS,KAAKnD,gCAAgCjF,SAAAA,EAAW,CAAA;CACtG;CAEQ+H;CAEEC,uBAAuBhI,WAA+C;EAC5E,IAAI,KAAK+H,iBACL,OAAO,KAAKA;EAGhB,KAAKA,kBAAkB,IAAInK,sBAAsB;GAC7CwG,gBAAgBpE,UAAU+D,QAAQ5E,2BAA2BkF,cAAc;GAC3EwH,cAAc7L,UAAU+D,QAAQ3E,qBAAqB0M,cAAc;GACnEnG,mBAAmB3F,UAAU+D,QAAQ3E,qBAAqBwG,iBAAiB;GAC3EC,oBAAoB7F,UAAU+D,QAAQ3E,qBAAqB0G,kBAAkB;GAC7ES,iBAAiBvG,UAAU+D,QAAQ3E,qBAAqBoH,eAAe;GACvElC,cAActE,UAAU+D,QAAQxK,qBAAqBgL,YAAY;GACjEC,SAASxE,UAAU+D,QAAQnE,mBAAAA;EAC/B,CAAA;EAEA,OAAO,KAAKmI;CAChB;CAEArE,uCAAuC1D,WAAuB;EAC1D,OAAO,IAAI7D,iCAAiC;GACxCiM,SAAS,KAAKnD,gCAAgCjF,SAAAA;GAC9CoE,gBAAgBpE,UAAU+D,QAAQ5E,2BAA2BkF,cAAc;GAC3E0D,iBAAiB,KAAKC,uBAAuBhI,SAAAA;EACjD,CAAA;CACJ;CAEAE,sBAAsBF,WAAuB;EAEzC,OAAO,IAAIlF,gBAAgB,EAAEsN,SADbpI,UAAU+D,QAAQxK,qBAAqBgL,YAC1B6D,EAAQ,CAAA;CACzC;CAEA2D,kBAAkB/L,WAAuB;EACrC,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EACjC,MAAMiG,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EACpE,MAAM2C,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAM7D,OAAO,IAAIyG,YAAY;GACnBqI,YAAAA,IANmB/M,sBAAsB;IACzC+M,YAAY,IAAIrO,eAAesM,UAAAA;IAC/B4C;GACJ,CAGIb;GACAa,iBAAiBsB,IAHc3P,uBAAuBqO,eAGrCsB;GACjBd,mBAAmB7E,OAAO6E;EAC9B,CAAA;CACJ;CAEAzG,qBAAqBlC,WAAuB;EACxC,OAAO,IAAIlE,eAAe,EAAEsM,SAAS,KAAK2D,kBAAkB/L,SAAAA,EAAW,CAAA;CAC3E;CAEA2D,yBAAyB3D,WAAuB;EAC5C,OAAO,IAAInD,mBAAmB,EAAEuL,SAAS,KAAK2D,kBAAkB/L,SAAAA,EAAW,CAAA;CAC/E;CAEAoC,8BAA8BpC,WAAuB;EACjD,MAAMuF,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EAQpE,OAAO,IAAI5J,wBAAwB,EAAEwM,SAAAA,IADjBxJ,qBAAqB;GAAE0I,YAAAA,IANpBlN,+BACnB4F,UAAU+D,QAAmClL,mBAAAA,CAKNyO;GAAY6C,eAAAA,IAH7BC,IACtB7E,WAAW8E,YAAYtR,UAAAA,CAAAA,CAAYuR,QAAQC,KAAKC,MAAMA,EAAEC,YAAY,CAEjBN;EAAc,CAChC/B,EAAQ,CAAA;CACjD;CAEA5F,+BAA+BxC,WAAuB;EAWlD,OAAO,IAAIjE,yBAAyB,EAAEqM,SAAAA,IALlBrJ,sBAAsB;GACtCuI,YAAAA,IANmBhN,gCACnB0F,UAAU+D,QAAoC/K,oBAAAA,CAK9CsO;GACA4C,sBAJyB,KAAKR,2BAA2B1J,SAIzDkK;GACAnD,4BAJ+B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAItED;EACJ,CACsCqB,EAAQ,CAAA;CAClD;CAEA1F,yBAAyB1C,WAAuB;EAM5C,OAAO,IAAIhE,mBAAmB,EAAEoM,SAAAA,IADZpJ,gBAAgB;GAAEsI,YAAAA,IAJf9M,0BACnBwF,UAAU+D,QAA8B7K,cAAAA,CAGNoO;GAAYP,4BADf/G,UAAU+D,QAAQ1E,qBAAqB2H,kBACxBD;EAA2B,CAC7CqB,EAAQ,CAAA;CAC5C;CAEAxF,uBAAuB5C,WAAuB;EAC1C,MAAMuF,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EACpE,MAAM2C,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAC7D,MAAM8O,aAAa,IAAIzN,wBAAwB;GAC3CyN,YAAY,IAAI/O,iBAAiBgN,UAAAA;GACjC4C;EACJ,CAAA;EACA,MAAMsB,yBAAyB,IAAI3P,uBAAuBqO,eAAAA;EAY1D,OAAO,IAAI/M,iBAAiB;GACxBgN,SAAAA,IAZgBlK,cAAc;IAC9BoJ;IACAa,iBAAiBsB;GACrB,CASIrB;GACA6B,gBAAAA,IARuBhM,qBAAqB;IAC5CqJ;IACAa,iBAAiBsB;IACjB1C,4BAJ+B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAItED;GACJ,CAIIkD;EACJ,CAAA;CACJ;CAEAnH,qCAAqC9C,WAAuB;EAWxD,OAAO,IAAIhF,sCAAsC,EAAEoN,SAAAA,IAL/B/K,mCAAmC;GACnDiK,YAAAA,IANmB7N,6CACnBuG,UAAU+D,QAAyB5L,iCAAAA,CAKnCmP;GACAsC,gBAJmB,KAAKD,qBAAqB3J,SAI7C4J;GACA7C,4BAJ+B/G,UAAU+D,QAAQ1E,qBAAqB2H,kBAItED;EACJ,CACmDqB,EAAQ,CAAA;CAC/D;CAEAjF,oBAAoBnD,WAAuB;EAGvC,OAAO,IAAI3D,cAAc,EAAEiL,YAFRtH,UAAU+D,QAAQxK,qBAAqBiM,UACvCD,CAAAA,CAAWyG,cAAc5T,SACjBkP,EAAW,CAAA;CAC1C;CAEAlH,sBAAsBJ,WAAuB;EACzC,MAAM8D,SAAS9D,UAAU+D,QAAQzE,kBAAAA;EACjC,MAAMiG,aAAavF,UAAU+D,QAAQxK,qBAAqBiM,UAAU;EACpE,MAAM2C,kBAAkBnI,UAAU+D,QAA2BvL,WAAAA;EAC7D,MAAM8O,aAAa,IAAIxN,uBAAuBqO,eAAAA;EAE9C,MAAMS,mBAAmB,IAAIxP,wBAAwB;GACjDkO,YAAYtH,UAAU+D,QAA4BjM,YAAAA;GAClDqQ;EACJ,CAAA;EACA,MAAM7C,SAAStF,UAAU+D,QAAQtE,kBAAAA;EAkBjC,MAAM2I,UAAU,IAAIhK,aAAa;GAC7BkJ;GACA2E,sBAAAA,IAnB6B/M,qBAAqB;IAClD0J;IACAsD,iBAAiB,IAAIhS,uBAAuB;KACxCoN,YAAYtH,UAAU+D,QAA2BnL,WAAAA;KACjDuP;IACJ,CAAA;IACAgE,uBAAuB,IAAI7S,6BACvB0G,UAAU+D,QAAiC9L,iBAAAA,CAAAA;IAE/CmU,YAAY7M,cAAcuE,MAAAA;IAC1BwB;GACJ,CAQI2G;GACAI,gBAAAA,IARuB/O,eAAe;IACtC2I,UAAUjG,UAAU+D,QAAQ3E,qBAAqB8G,QAAQ;IACzDZ;GACJ,CAKI+G;GACA/G;EACJ,CAAA;EACA,MAAMgH,gBAAgB/G,WAAWyG,cAAc5T,SAAAA;EAE/C,OAAO,IAAIiD,gBAAgB;GACvBoJ,SAAS;IACLC,SAASZ,OAAOa;IAChB4H,aAAazI,OAAO0I;IACpBC,2BAA2B3I,OAAOoE,sBAAsB;GAC5D;GACAE;GACAkE;EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/index.mjs

@@ -6,6 +6,10 @@ import { CacheInjectionKey } from "./cache/constants.mjs";
 import { ModuleName } from "./constants.mjs";
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./config/constants.mjs";
 import { expandToOrigins, getAppOrigins } from "./config/origins.mjs";
+import { readConfigRawFromEnv } from "./config/read/env.mjs";
+import { readConfigRawFromFS } from "./config/read/fs.mjs";
+import { readConfigRaw } from "./config/read/module.mjs";
+import { readConfig } from "./config/helpers.mjs";
 import { ConfigModule } from "./config/module.mjs";
 import "./config/index.mjs";
 import { CacheModule } from "./cache/module.mjs";
@@ -75,4 +79,4 @@ import { ProvisionerModule } from "./provisioning/module.mjs";
 import "./provisioning/index.mjs";
 import { RuntimeModule } from "./runtime/module.mjs";
 import "./runtime/index.mjs";
-export { AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins };
+export { AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/oauth2/repositories/consent/repository.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { CachePrefix } from "../../../../../adapters/database/domains/constants.mjs";
 import { ConsentEntity } from "../../../../../adapters/database/domains/consent/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
-import { applyQuery } from "../../../database/repositories/query.mjs";
+import { applyQuery, redactFieldConditions } from "../../../database/repositories/query.mjs";
 import { applyRealmScopeSelect } from "../../../database/repositories/helpers.mjs";
 import { isUniqueConstraintDatabaseError } from "../../../../../adapters/database/errors/driver.mjs";
 import "../../../../../adapters/database/errors/index.mjs";
@@ -33,7 +33,7 @@ var ConsentRepositoryAdapter = class {
 		if (options.realmId) qb.andWhere("consent.realmId = :realmId", { realmId: options.realmId });
 		const [entities, total] = await qb.getManyAndCount();
 		return {
-			data: entities,
+			data: redactFieldConditions(query, entities),
 			meta: {
 				total,
 				...pagination

package/dist/app/modules/oauth2/repositories/consent/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: entities,\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaO,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAed,WAAWY,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAMH;GACNI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCpC,kBAAkB;GACdqC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYxB,aAAawD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}
+{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","redactFieldConditions","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAef,WAAWa,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAM3B,sBAAsBU,OAAOc,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCrC,kBAAkB;GACdsC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYzB,aAAayD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAmBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAOH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAiKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAuKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -9,6 +9,7 @@ import { ClientRoleEntity } from "../../../adapters/database/domains/client-role
 import { PermissionEntity } from "../../../adapters/database/domains/permission/entity.mjs";
 import { ClientPermissionEntity } from "../../../adapters/database/domains/client-permission/entity.mjs";
 import { ScopeEntity } from "../../../adapters/database/domains/scope/entity.mjs";
+import { ClientScopeEntity } from "../../../adapters/database/domains/client-scope/entity.mjs";
 import { UserRepository } from "../../../adapters/database/domains/user/repository.mjs";
 import { PermissionPolicyEntity } from "../../../adapters/database/domains/permission-policy/entity.mjs";
 import { RolePermissionEntity } from "../../../adapters/database/domains/role-permission/entity.mjs";
@@ -37,6 +38,7 @@ import { RealmRepositoryAdapter } from "../database/repositories/realm/repositor
 import { ClientRepositoryAdapter } from "../database/repositories/client/repository.mjs";
 import { ClientPermissionRepositoryAdapter } from "../database/repositories/client-permission/repository.mjs";
 import { ClientRoleRepositoryAdapter } from "../database/repositories/client-role/repository.mjs";
+import { ClientScopeRepositoryAdapter } from "../database/repositories/client-scope/repository.mjs";
 import { KeyRepositoryAdapter } from "../database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "../database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "../database/repositories/permission-policy/repository.mjs";
@@ -101,6 +103,11 @@ var ProvisionerModule = class {
 			repository: container.resolve(ClientEntity),
 			realmRepository
 		});
+		const scopeRepository = new ScopeRepositoryAdapter({
+			repository: container.resolve(ScopeEntity),
+			realmRepository
+		});
+		const clientScopeRepository = new ClientScopeRepositoryAdapter(container.resolve(ClientScopeEntity));
 		const permissionSynchronizer = new PermissionProvisioningSynchronizer({
 			repository: permissionRepository,
 			policyRepository,
@@ -115,8 +122,10 @@ var ProvisionerModule = class {
 			clientRepository,
 			clientRoleRepository: new ClientRoleRepositoryAdapter(container.resolve(ClientRoleEntity)),
 			clientPermissionRepository: new ClientPermissionRepositoryAdapter(container.resolve(ClientPermissionEntity)),
+			clientScopeRepository,
 			roleRepository,
 			permissionRepository,
+			scopeRepository,
 			roleSynchronizer,
 			permissionSynchronizer
 		});
@@ -131,10 +140,7 @@ var ProvisionerModule = class {
 			roleRepository,
 			permissionRepository
 		});
-		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: new ScopeRepositoryAdapter({
-			repository: container.resolve(ScopeEntity),
-			realmRepository
-		}) });
+		const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });
 		await new GraphProvisioningSynchronizer({
 			policySynchronizer,
 			permissionSynchronizer,
@@ -151,6 +157,8 @@ var ProvisionerModule = class {
 		}).synchronize(data);
 		const webClientProvisioner = new WebClientProvisioner({
 			clientRepository,
+			scopeRepository,
+			clientScopeRepository,
 			appOrigins: getAppOrigins(config),
 			logger: container.resolve(LoggerInjectionKey)
 		});

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n\n            roleRepository,\n            permissionRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,IAAagD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BtD,WAAAA;EAE7D,MAAMoE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCvD,gBAAAA;GAC5DoE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI7D,iBAAiByD,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsC/C,sBAAAA,CAAAA;EAGpD,MAAMiE,qBAAqB,IAAI3D,+BAA+B;GAC1DwD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BrD,UAAAA;GAChDkE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIvD,wBAAwB;GACjDkD,YAAYjB,UAAUE,QAA4B1D,YAAAA;GAClDuE;EACJ,CAAA;EAEA,MAAMQ,yBAAyB,IAAI/D,mCAAmC;GAClEyD,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMK,mBAAmB,IAAI7D,6BAA6B;GACtDsD,YAAYI;GACZL;GACAS,0BAA0B,IAAInD,gCAC1B0B,UAAUE,QAAoCpD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM4E,qBAAqB,IAAIpE,+BAA+B;GAC1DgE;GACAK,sBAAsB,IAAI3D,4BACtBgC,UAAUE,QAAgCxD,gBAAAA,CAAAA;GAE9CkF,4BAA4B,IAAI9D,kCAC5BkC,UAAUE,QAAsCzD,sBAAAA,CAAAA;GAGpD4E;GACAL;GAEAQ;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIhE,6BAA6B;GACtDiE,gBAAgB,IAAIpD,sBAAsB;IACtCuC,YAAY,IAAI5D,eAAewD,UAAAA;IAC/BE;GACJ,CAAA;GACAgB,oBAAoB,IAAIpD,0BACpBqB,UAAUE,QAA8BjD,cAAAA,CAAAA;GAE5C+E,0BAA0B,IAAIvD,gCAC1BuB,UAAUE,QAAoClD,oBAAAA,CAAAA;GAGlDsE;GACAD;GACAL;EACJ,CAAA;EAOA,MAAMkB,oBAAoB,IAAItE,8BAA8B,EAAEqD,YAAYgB,IAL9CzD,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BnD,WAAAA;GACjDgE;EACJ,CAE0EkB,EAAgB,CAAA;EAoB1F,MAAMG,IARuB7E,8BAA8B;GACvD6D;GACAG;GACAC;GACAW,mBAAAA,IAd0BzE,8BAA8B;IACxDuD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCW;IACAF;IACAD;IACAM;IACAK;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY1B,IAAAA;EAOnC,MAAM2B,uBAAuB,IAAIlD,qBAAqB;GAClDkC;GACAiB,YAAYtD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMqD,iBAAiB,IAAInD,eAAe;GACtCoD,UAAU,IAAIxE,qBAAqB4C,YAAY,EAC3C6B,eAAezC,OAAO0C,uBAClB,IAAIzD,gBAAgBe,OAAO0C,oBAAoB,IAC/C,KACR,CAAA;GACAlC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAMyD,SAAS,MAAM7B,gBAAgB8B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI7C,OAAO+C,oCACP,MAAM,KAAKC,oBAAoBpC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB+B,oBACZpC,YACAK,kBACa;EACb,MAAMgC,gBAAgB,MAAMhC,iBAAiBiC,cAAcjG,iBAAiBkG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBxC,WAAWyC,cAAc3G,gBAAAA;EAChD,MAAM4G,eAAe1C,WAAWyC,cAAcnG,sBAAAA;EAE9C,MAAMqG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,IAAakD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BvD,WAAAA;EAE7D,MAAMqE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCxD,gBAAAA;GAC5DqE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI9D,iBAAiB0D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMkE,qBAAqB,IAAI5D,+BAA+B;GAC1DyD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BtD,UAAAA;GAChDmE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIxD,wBAAwB;GACjDmD,YAAYjB,UAAUE,QAA4B5D,YAAAA;GAClDyE;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAI/C,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BpD,WAAAA;GACjDiE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAIxD,6BAC9BgC,UAAUE,QAAiCzD,iBAAAA,CAAAA;EAG/C,MAAMgF,yBAAyB,IAAIlE,mCAAmC;GAClE0D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIhE,6BAA6B;GACtDuD,YAAYI;GACZL;GACAW,0BAA0B,IAAIrD,gCAC1B0B,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DiE;GACAO,sBAAsB,IAAI9D,4BACtBiC,UAAUE,QAAgC1D,gBAAAA,CAAAA;GAE9CsF,4BAA4B,IAAIjE,kCAC5BmC,UAAUE,QAAsC3D,sBAAAA,CAAAA;GAEpDiF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAInE,6BAA6B;GACtDoE,gBAAgB,IAAItD,sBAAsB;IACtCuC,YAAY,IAAI7D,eAAeyD,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAItD,0BACpBqB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAIzD,gCAC1BuB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDuE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAIxE,8BAA8B,EAAEsD,YAAYM,gBAAgB,CAAA;EAoB1F,MAAMc,IARuB/E,8BAA8B;GACvD8D;GACAK;GACAC;GACAU,mBAAAA,IAd0B3E,8BAA8B;IACxDwD,YAAY,IAAI5C,uBAAuB0C,eAAAA;IAEvCa;IACAF;IACAD;IACAM;IACAI;GACJ,CAMIC;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY3B,IAAAA;EAOnC,MAAM4B,uBAAuB,IAAInD,qBAAqB;GAClDkC;GACAC;GACAC;GACAgB,YAAYvD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMsD,iBAAiB,IAAIpD,eAAe;GACtCqD,UAAU,IAAIzE,qBAAqB4C,YAAY,EAC3C8B,eAAe1C,OAAO2C,uBAClB,IAAI1D,gBAAgBe,OAAO2C,oBAAoB,IAC/C,KACR,CAAA;GACAnC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM0D,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI9C,OAAOgD,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAcnG,iBAAiBoG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc7G,gBAAAA;EAChD,MAAM8G,eAAe3C,WAAW0C,cAAcrG,sBAAAA;EAE9C,MAAMuG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/types.d.ts

@@ -0,0 +1,5 @@
+import type { ConfigModule } from './modules/index.ts';
+export type CreateApplicationContext = {
+    config?: ConfigModule;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/app/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/app/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACnC,MAAM,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC"}

package/dist/app/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/cli/commands/healthcheck.d.ts

@@ -1,2 +1,3 @@
-export declare function defineCLIHealthCheckCommand(): import("citty").CommandDef<import("citty").ArgsDef>;
+import type { ConfigReadFsOptions } from '../../app/index.ts';
+export declare function defineCLIHealthCheckCommand(configFs?: ConfigReadFsOptions): import("citty").CommandDef<import("citty").ArgsDef>;
 //# sourceMappingURL=healthcheck.d.ts.map

package/dist/cli/commands/healthcheck.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/healthcheck.ts"],"names":[],"mappings":"AAYA,wBAAgB,2BAA2B,wDAmC1C"}
+{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/healthcheck.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D,wBAAgB,2BAA2B,CAAC,QAAQ,GAAE,mBAAwB,uDAmC7E"}