@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.57

package/dist/core/entities/client/web-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","GLOBAL","OPEN_ID","redirectUri","postLogoutRedirectUri","WebClientProvisioner","clientRepository","logger","ctx","ensureForRealm","attributes","existing","findOneBy","warn","isDirty","Object","keys","some","key","merged","merge","save","entity","create"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_WEB_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `builtIn` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard. The\n * `global` scope lets the issued token drive the management API (parity\n * with the legacy password-grant admin login); `openid` for the id-token.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: `${ScopeName.GLOBAL} ${ScopeName.OPEN_ID}`,\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // Never overwrite a non-builtIn client that happens to be named\n            // `web` — that would be a user-owned client. Skip and warn.\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping web client provisioning for realm ${realm.id}: a non-built-in client named '${CLIENT_WEB_NAME}' already exists.`,\n                    );\n                }\n                return;\n            }\n\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return;\n            }\n\n            const merged = this.clientRepository.merge(existing, attributes);\n            await this.clientRepository.save(merged);\n            return;\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        await this.clientRepository.save(entity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;GAsCA,SAAgBI,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMX;EACNY,SAASP,MAAMQ;EACfC,YAAYb,iBAAiBc;EAC7BC,oBAAoBd,yBAAyBa;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAO,GAAGjB,UAAUkB,OAAO,GAAGlB,UAAUmB;EACxCC,aAAahB;EACbiB,uBAAuBjB;CAC3B;AACJ;AAEA,IAAakB,uBAAb,MAAaA;CACCC;CAEApB;CAEAqB;CAEV,YAAYC,KAAkC;EAC1C,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKpB,aAAasB,IAAItB;EACtB,KAAKqB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAexB,OAA8C;EAC/D,MAAMyB,aAAa1B,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAMyB,WAAW,MAAM,KAAKL,iBAAiBM,UAAU;GACnDrB,MAAMX;GACNY,SAASP,MAAMQ;EACnB,CAAA;EAEA,IAAIkB,UAAU;GAGV,IAAI,CAACA,SAASd,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOM,KACR,8CAA8C5B,MAAMQ,GAAG,iCAAiCb,gBAAgB,kBAAkB;IAGlI;GACJ;GAQA,IAAI,CAFY,OAAQoC,KAAKN,UAAAA,CAAAA,CACxBO,MAAMC,QAAQP,SAASO,SAASR,WAAWQ,IAC3CJ,GACD;GAGJ,MAAMK,SAAS,KAAKb,iBAAiBc,MAAMT,UAAUD,UAAAA;GACrD,MAAM,KAAKJ,iBAAiBe,KAAKF,MAAAA;GACjC;EACJ;EAEA,MAAMG,SAAS,KAAKhB,iBAAiBiB,OAAOb,UAAAA;EAC5C,MAAM,KAAKJ,iBAAiBe,KAAKC,MAAAA;CACrC;AACJ"}
+{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","WEB_CLIENT_SCOPE_NAMES","GLOBAL","OPEN_ID","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","redirectUri","postLogoutRedirectUri","WebClientProvisioner","clientRepository","scopeRepository","clientScopeRepository","logger","ctx","ensureForRealm","client","ensureClient","ensureScopes","attributes","existing","findOneBy","isDirty","Object","keys","some","key","target","warn","findOneWithSecret","secret","secretHashed","secretEncrypted","merged","merge","save","entity","create","clientId","scopeId","clientRealmId","scopeRealmId"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_WEB_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientScopeRepository } from '../client-scope/types.ts';\nimport type { IScopeRepository } from '../scope/types.ts';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    scopeRepository: IScopeRepository;\n    clientScopeRepository: IClientScopeRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * The scopes a realm's public `web` client is granted.\n *\n * `global` lets the issued token drive the management API (parity with the\n * legacy password-grant admin login); `openid` yields the id-token.\n */\nexport const WEB_CLIENT_SCOPE_NAMES: string[] = [\n    ScopeName.GLOBAL,\n    ScopeName.OPEN_ID,\n];\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `builtIn` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n *\n * The `scope` column is descriptive only. Scope authorization resolves\n * through the `auth_client_scopes` junction, which\n * `WebClientProvisioner.ensureForRealm` fills from\n * {@see WEB_CLIENT_SCOPE_NAMES}.\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: WEB_CLIENT_SCOPE_NAMES.join(' '),\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected scopeRepository: IScopeRepository;\n\n    protected clientScopeRepository: IClientScopeRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n        this.clientScopeRepository = ctx.clientScopeRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const client = await this.ensureClient(realm);\n\n        // Always run, even when the attributes were already up to date: an\n        // instance provisioned before the junction rows existed carries a\n        // steady-state client with no scopes at all.\n        await this.ensureScopes(client);\n    }\n\n    /**\n     * Upsert the client row itself.\n     *\n     * `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row\n     * belongs to the system whatever state it is in. A non-built-in one\n     * predates the reservation and is taken over rather than left to shadow\n     * the realm's login client.\n     */\n    protected async ensureClient(realm: Realm | { id: string }): Promise<Client> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return existing;\n            }\n\n            let target = existing;\n\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Taking over the non-built-in client named '${CLIENT_WEB_NAME}' in realm ${realm.id}: the name is reserved for the built-in web client.`,\n                    );\n                }\n\n                // The takeover makes the client public, so a secret it carried\n                // as a confidential client can never authenticate it again.\n                // Drop it instead of leaving the material at rest.\n                //\n                // The row has to be re-read WITH the secret for that: `secret`\n                // is a `select: false` column, so the loaded entity carries no\n                // value for it and typeorm's changed-column diff would not\n                // emit the null. Re-reading is confined to this branch, and\n                // the secret stays out of `buildWebClientAttributes` for the\n                // same reason (an undefined-vs-null compare would read as\n                // dirty on every boot).\n                target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;\n                target.secret = null;\n                target.secretHashed = false;\n                target.secretEncrypted = false;\n            }\n\n            const merged = this.clientRepository.merge(target, attributes);\n\n            return this.clientRepository.save(merged);\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        return this.clientRepository.save(entity);\n    }\n\n    /**\n     * Bind the built-in global scopes through `auth_client_scopes`. That\n     * junction is the only source the /authorize code-request verifier reads\n     * scopes from.\n     *\n     * Additive like the attribute MERGE above: an extra scope an admin bound\n     * by hand is left in place.\n     */\n    protected async ensureScopes(client: Client): Promise<void> {\n        for (const name of WEB_CLIENT_SCOPE_NAMES) {\n            const scope = await this.scopeRepository.findOneBy({\n                name,\n                realmId: null,\n            });\n\n            if (!scope) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping scope '${name}' for the web client of realm ${client.realmId}: the scope is not provisioned.`,\n                    );\n                }\n                continue;\n            }\n\n            const existing = await this.clientScopeRepository.findOneBy({\n                clientId: client.id,\n                scopeId: scope.id,\n            });\n\n            if (existing) {\n                continue;\n            }\n\n            await this.clientScopeRepository.save(this.clientScopeRepository.create({\n                clientId: client.id,\n                clientRealmId: client.realmId,\n                scopeId: scope.id,\n                scopeRealmId: scope.realmId,\n            }));\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAiCA,MAAaI,yBAAmC,CAC5CD,UAAUE,QACVF,UAAUG,OACb;;;;;;;;;;;;;;;;;;GAoBD,SAAgBC,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMd;EACNe,SAASP,MAAMQ;EACfC,YAAYhB,iBAAiBiB;EAC7BC,oBAAoBjB,yBAAyBgB;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAOnB,uBAAuBS,KAAK,GAAA;EACnCW,aAAad;EACbe,uBAAuBf;CAC3B;AACJ;AAEA,IAAagB,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEApB;CAEAqB;CAEV,YAAYC,KAAkC;EAC1C,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKpB,aAAasB,IAAItB;EACtB,KAAKqB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAexB,OAA8C;EAC/D,MAAMyB,SAAS,MAAM,KAAKC,aAAa1B,KAAAA;EAKvC,MAAM,KAAK2B,aAAaF,MAAAA;CAC5B;;;;;;;;IAUA,MAAgBC,aAAa1B,OAAgD;EACzE,MAAM4B,aAAa7B,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAM4B,WAAW,MAAM,KAAKV,iBAAiBW,UAAU;GACnDxB,MAAMd;GACNe,SAASP,MAAMQ;EACnB,CAAA;EAEA,IAAIqB,UAAU;GAOV,IAAI,CAFY,OAAQI,KAAKL,UAAAA,CAAAA,CACxBM,MAAMC,QAAQN,SAASM,SAASP,WAAWO,IAC3CJ,GACD,OAAOF;GAGX,IAAIO,SAASP;GAEb,IAAI,CAACA,SAASjB,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOe,KACR,8CAA8C7C,gBAAgB,aAAaQ,MAAMQ,GAAG,oDAAoD;IAehJ4B,SAAS,MAAM,KAAKjB,iBAAiBmB,kBAAkB,EAAE9B,IAAIqB,SAASrB,GAAG,CAAA,KAAMqB;IAC/EO,OAAOG,SAAS;IAChBH,OAAOI,eAAe;IACtBJ,OAAOK,kBAAkB;GAC7B;GAEA,MAAMC,SAAS,KAAKvB,iBAAiBwB,MAAMP,QAAQR,UAAAA;GAEnD,OAAO,KAAKT,iBAAiByB,KAAKF,MAAAA;EACtC;EAEA,MAAMG,SAAS,KAAK1B,iBAAiB2B,OAAOlB,UAAAA;EAC5C,OAAO,KAAKT,iBAAiByB,KAAKC,MAAAA;CACtC;;;;;;;;IAUA,MAAgBlB,aAAaF,QAA+B;EACxD,KAAK,MAAMnB,QAAQV,wBAAwB;GACvC,MAAMmB,QAAQ,MAAM,KAAKK,gBAAgBU,UAAU;IAC/CxB;IACAC,SAAS;GACb,CAAA;GAEA,IAAI,CAACQ,OAAO;IACR,IAAI,KAAKO,QACL,KAAKA,OAAOe,KACR,mBAAmB/B,KAAK,gCAAgCmB,OAAOlB,QAAQ,gCAAgC;IAG/G;GACJ;GAOA,IAAIsB,MALmB,KAAKR,sBAAsBS,UAAU;IACxDiB,UAAUtB,OAAOjB;IACjBwC,SAASjC,MAAMP;GACnB,CAAA,GAGI;GAGJ,MAAM,KAAKa,sBAAsBuB,KAAK,KAAKvB,sBAAsByB,OAAO;IACpEC,UAAUtB,OAAOjB;IACjByC,eAAexB,OAAOlB;IACtByC,SAASjC,MAAMP;IACf0C,cAAcnC,MAAMR;GACxB,CAAA,CAAA;EACJ;CACJ;AACJ"}

package/dist/core/entities/client-scope/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAiB5B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAmB5B,CAAC"}

package/dist/core/entities/client-scope/schema.mjs

@@ -17,7 +17,9 @@ const clientScopeSchema = defineSchema({
 		"clientId",
 		"clientRealmId",
 		"scopeId",
-		"scopeRealmId"
+		"scopeRealmId",
+		"createdAt",
+		"updatedAt"
 	] },
 	filters: { allowed: [
 		"clientId",

package/dist/core/entities/client-scope/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default'] },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;CAAU,EAAC;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default'] },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;CAAU,EAAC;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/event/constants.d.ts

@@ -4,4 +4,11 @@
  * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
  */
 export declare const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+/**
+ * Column bound for the denormalized actor name. Shared by the write boundary
+ * (EventService.record truncates to it) and every reader that matches stored
+ * rows by actor name (the login throttle) so the two cannot drift — an
+ * untruncated lookup key never matches its own truncated rows.
+ */
+export declare const EVENT_ACTOR_NAME_MAX_LENGTH = 128;
 //# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/event/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC"}

package/dist/core/entities/event/constants.mjs

@@ -7,7 +7,13 @@ import.meta.url;
 * posture, Okta-parity; raise via eventLogRetentionDays /
 * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
 */ const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+/**
+* Column bound for the denormalized actor name. Shared by the write boundary
+* (EventService.record truncates to it) and every reader that matches stored
+* rows by actor name (the login throttle) so the two cannot drift — an
+* untruncated lookup key never matches its own truncated rows.
+*/ const EVENT_ACTOR_NAME_MAX_LENGTH = 128;
 //#endregion
-export { EVENT_LOG_RETENTION_DAYS_DEFAULT };
+export { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT };
 
 //# sourceMappingURL=constants.mjs.map

package/dist/core/entities/event/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n */\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC"}
+{"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT","EVENT_ACTOR_NAME_MAX_LENGTH"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n */\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n\n/**\n * Column bound for the denormalized actor name. Shared by the write boundary\n * (EventService.record truncates to it) and every reader that matches stored\n * rows by actor name (the login throttle) so the two cannot drift — an\n * untruncated lookup key never matches its own truncated rows.\n */\nexport const EVENT_ACTOR_NAME_MAX_LENGTH = 128;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC;;;;;;GAQhD,MAAaC,8BAA8B"}

package/dist/core/entities/event/index.mjs

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
 import { eventSchema } from "./schema.mjs";
-import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
 import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./diff.mjs";
 import { EntityEventHandler } from "./entity-event-handler.mjs";
 import { sanitizeEventData } from "./sanitize.mjs";
 import { EventService } from "./service.mjs";
-export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, eventSchema, sanitizeEventData };
+export { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, eventSchema, sanitizeEventData };

package/dist/core/entities/event/service.mjs

@@ -1,10 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "./constants.mjs";
 import { eventSchema } from "./schema.mjs";
 import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
 import "../../query/index.mjs";
-import "./constants.mjs";
 import { sanitizeEventData } from "./sanitize.mjs";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";

package/dist/core/entities/event/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, 128),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMe,YAAY;AAElB,IAAaC,eAAb,cAAkCP,sBAAAA;CACpBQ;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM3B,eAAe4B;IACrBT,MAAMxB,iBAAiB,GAAGD,kBAAkBmC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdpC,kBAAkBqC;KAClBrC,kBAAkBsC;KAClBtC,kBAAkBmC;IACrB,EACL;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB3C,WAAAA;EACrB,OAAO2C,mBAAmBF,cACtBE,iBAAiB3C,WAAAA;EAGrB,IAAI,MAAM,KAAK8B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5B1B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQqC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBP,MAAMO,iBAAiB,KAAKtC,QAAQsC,iBAAAA;GAE1D,MAAMlC,SAAS,KAAKL,WAAWwC,OAAO;IAClC9B,IAAI3B,WAAAA;IACJmD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASM,SAAST,MAAMG,SAAS,EAAA;IACjCC,OAAOK,SAAST,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5B1B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BkC,WAAWD,SAAST,MAAMU,WAAW,GAAA;IACrCC,aAAaF,SAAST,MAAMW,aAAa,GAAA;IACzCC,eAAeH,SAAST,MAAMY,eAAe,EAAA;IAC7CC,kBAAkBJ,SAAST,MAAMa,kBAAkB,EAAA;IACnDC,kBAAkBL,SAAST,MAAMc,kBAAkB,GAAA;IACnDhC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAsC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgBzC,SAAAA,CAAAA,CAAYqD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKnD,WAAWoD,KAAK/C,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQmD,KAAK,6BAA6BrB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMqC,QACFC,OACAjD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMuD,SAAS,MAAM5D,YAAY2D,OAAO;GAAEE,QAAQ5D;GAAaS;EAAM,CAAA;EAErE,IAAIoD,aAAa;EACjB,IAAI;GACA,MAAMpD,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM3B,eAAe4B,WAAW,CAAA;EAClF,SAAS0C,GAAG;GACR,IAAI,CAACtD,MAAMC,UACP,MAAMqD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK1D,WAAW6D,SAASL,QAAQ;GACpC1B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMgD,WAAW,MAAMxD,MAAMS,oBAAoBgD,QAAQ,EAAE9C,MAAM3B,eAAe4B,WAAW,CAAA;EAC3F,IAAI4C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY3D,MAAMC,WACpBrB,IAAIC,GAAG,WAAWmB,MAAMC,SAASE,KAAKC,EAAE,GAAGvB,GAAG,aAAamB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIsD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASvE,sBAAsB6D,QAAQS,aAAa7E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI0E,SAASE,YAAY,eAC5BE,SAASvE,sBACL6D,QACAS,YAAY5E,GAAG4E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKnE,WAAW6D,SAASK,QAAQ,EAAE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMsD,aAAa,MAAM,KAAK7C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM4D,UAAUC,SAAS,MAAM,KAAKtE,WAAW6D,SAASL,QAAQ;GACpE,GAAIvD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIsD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM3D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUgE,UAAU;GAC3B,IAAI,KAAKjE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM3B,eAAe4B;KACrBT,MAAMxB,iBAAiB;OAClBD,kBAAkBuF,aAAalE;MAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA6D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASjE,KAAKiE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOjE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW4E,YAAYlE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIvB,oBAAAA;EAGd,IAAI,CAAC,KAAKa,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM3B,eAAe4B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM3B,eAAe4B;IACrBT,MAAMxB,iBAAiB;MAClBD,kBAAkBuF,aAAalE;KAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASoC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}
+{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_ACTOR_NAME_MAX_LENGTH","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, EVENT_ACTOR_NAME_MAX_LENGTH),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMgB,YAAY;AAElB,IAAaC,eAAb,cAAkCR,sBAAAA;CACpBS;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB,GAAGD,kBAAkBoC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdrC,kBAAkBsC;KAClBtC,kBAAkBuC;KAClBvC,kBAAkBoC;IACrB,EACL;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB5C,WAAAA;EACrB,OAAO4C,mBAAmBF,cACtBE,iBAAiB5C,WAAAA;EAGrB,IAAI,MAAM,KAAK+B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5B1B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQqC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBP,MAAMO,iBAAiB,KAAKtC,QAAQsC,iBAAAA;GAE1D,MAAMlC,SAAS,KAAKL,WAAWwC,OAAO;IAClC9B,IAAI5B,WAAAA;IACJoD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASM,SAAST,MAAMG,SAAS,EAAA;IACjCC,OAAOK,SAAST,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5B1B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BkC,WAAWD,SAAST,MAAMU,WAAAA,GAAWlD;IACrCmD,aAAaF,SAAST,MAAMW,aAAa,GAAA;IACzCC,eAAeH,SAAST,MAAMY,eAAe,EAAA;IAC7CC,kBAAkBJ,SAAST,MAAMa,kBAAkB,EAAA;IACnDC,kBAAkBL,SAAST,MAAMc,kBAAkB,GAAA;IACnDhC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAsC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgBzC,SAAAA,CAAAA,CAAYqD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKnD,WAAWoD,KAAK/C,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQmD,KAAK,6BAA6BrB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMqC,QACFC,OACAjD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMuD,SAAS,MAAM5D,YAAY2D,OAAO;GAAEE,QAAQ5D;GAAaS;EAAM,CAAA;EAErE,IAAIoD,aAAa;EACjB,IAAI;GACA,MAAMpD,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM5B,eAAe6B,WAAW,CAAA;EAClF,SAAS0C,GAAG;GACR,IAAI,CAACtD,MAAMC,UACP,MAAMqD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK1D,WAAW6D,SAASL,QAAQ;GACpC1B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMgD,WAAW,MAAMxD,MAAMS,oBAAoBgD,QAAQ,EAAE9C,MAAM5B,eAAe6B,WAAW,CAAA;EAC3F,IAAI4C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY3D,MAAMC,WACpBtB,IAAIC,GAAG,WAAWoB,MAAMC,SAASE,KAAKC,EAAE,GAAGxB,GAAG,aAAaoB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIsD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASvE,sBAAsB6D,QAAQS,aAAa9E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI2E,SAASE,YAAY,eAC5BE,SAASvE,sBACL6D,QACAS,YAAY7E,GAAG6E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKnE,WAAW6D,SAASK,QAAQ,EAAE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMsD,aAAa,MAAM,KAAK7C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM4D,UAAUC,SAAS,MAAM,KAAKtE,WAAW6D,SAASL,QAAQ;GACpE,GAAIvD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIsD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM3D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUgE,UAAU;GAC3B,IAAI,KAAKjE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM5B,eAAe6B;KACrBT,MAAMzB,iBAAiB;OAClBD,kBAAkBwF,aAAalE;MAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA6D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASjE,KAAKiE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOjE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW4E,YAAYlE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIxB,oBAAAA;EAGd,IAAI,CAAC,KAAKc,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM5B,eAAe6B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB;MAClBD,kBAAkBwF,aAAalE;KAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASoC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}

package/dist/core/entities/index.mjs

@@ -2,6 +2,8 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH } from "./consent/types.mjs";
+import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./event/constants.mjs";
+import { CLIENT_READ_PERMISSIONS } from "./client/constants.mjs";
 import { clientSchema } from "./client/schema.mjs";
 import { clientPermissionSchema } from "./client-permission/schema.mjs";
 import { clientRoleSchema } from "./client-role/schema.mjs";
@@ -27,7 +29,7 @@ import { userAuthenticatorSchema } from "./user-authenticator/schema.mjs";
 import { userPermissionSchema } from "./user-permission/schema.mjs";
 import { userRoleSchema } from "./user-role/schema.mjs";
 import { ClientService } from "./client/service.mjs";
-import { WebClientProvisioner, buildWebClientAttributes } from "./client/web-client.mjs";
+import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./client/web-client.mjs";
 import "./client/index.mjs";
 import { ClientPermissionService } from "./client-permission/service.mjs";
 import "./client-permission/index.mjs";
@@ -37,7 +39,6 @@ import { ClientScopeService } from "./client-scope/service.mjs";
 import "./client-scope/index.mjs";
 import { ConsentService } from "./consent/service.mjs";
 import "./consent/index.mjs";
-import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./event/constants.mjs";
 import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./event/diff.mjs";
 import { EntityEventHandler } from "./event/entity-event-handler.mjs";
 import { sanitizeEventData } from "./event/sanitize.mjs";
@@ -82,4 +83,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, WebClientProvisioner, buildEntityDiff, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };
+export { CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildEntityDiff, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };

package/dist/core/entities/role/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAmBrB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAqBrB,CAAC"}

package/dist/core/entities/role/schema.mjs

@@ -10,18 +10,22 @@ const roleSchema = defineSchema({
 	name: EntityType.ROLE,
 	fields: { allowed: [
 		"id",
+		"builtIn",
 		"name",
 		"displayName",
 		"target",
 		"description",
+		"clientId",
 		"realmId",
 		"createdAt",
 		"updatedAt"
 	] },
 	filters: { allowed: [
 		"id",
+		"builtIn",
 		"name",
 		"target",
+		"clientId",
 		"realmId"
 	] },
 	relations: {

package/dist/core/entities/role/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","roleSchema","name","ROLE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Role } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const roleSchema = defineSchema<Role>({\n    name: EntityType.ROLE,\n    fields: {\n        allowed: [\n            'id',\n            'name',\n            'displayName',\n            'target',\n            'description',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'target', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;EAAU;CAAU,EAAC;CACxDE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","roleSchema","name","ROLE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Role } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const roleSchema = defineSchema<Role>({\n    name: EntityType.ROLE,\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'target',\n            'description',\n            'clientId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'builtIn', 'name', 'target', 'clientId', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAQ;EAAU;EAAY;CAAU,EAAC;CAC/EE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/session/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CAwBxB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CA0BxB,CAAC"}

package/dist/core/entities/session/schema.mjs

@@ -15,6 +15,8 @@ const sessionSchema = defineSchema({
 		"subKind",
 		"ipAddress",
 		"userAgent",
+		"authMethod",
+		"mfaAt",
 		"expiresAt",
 		"refreshedAt",
 		"seenAt",

package/dist/core/entities/session/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n    name: EntityType.SESSION,\n    fields: {\n        allowed: [\n            'id',\n            'sub',\n            'subKind',\n            'ipAddress',\n            'userAgent',\n            'expiresAt',\n            'refreshedAt',\n            'seenAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'clientId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: [...SESSION_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS,CAAIT,GAAAA,mBAAoB,EAAC;CAC7CW,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;CAAY,EAAC;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n    name: EntityType.SESSION,\n    fields: {\n        allowed: [\n            'id',\n            'sub',\n            'subKind',\n            'ipAddress',\n            'userAgent',\n            'authMethod',\n            'mfaAt',\n            'expiresAt',\n            'refreshedAt',\n            'seenAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'clientId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: [...SESSION_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS,CAAIT,GAAAA,mBAAoB,EAAC;CAC7CW,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;CAAY,EAAC;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}

package/dist/core/entities/user/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAwBrB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/user/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCA0BrB,CAAC"}

package/dist/core/entities/user/schema.mjs

@@ -19,6 +19,8 @@ const userSchema = defineSchema({
 			"avatar",
 			"cover",
 			"active",
+			"status",
+			"statusMessage",
 			"createdAt",
 			"updatedAt",
 			"realmId"

package/dist/core/entities/user/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","userSchema","name","USER","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { User } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const userSchema = defineSchema<User>({\n    name: EntityType.USER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'nameLocked',\n            'firstName',\n            'lastName',\n            'displayName',\n            'avatar',\n            'cover',\n            'active',\n            'createdAt',\n            'updatedAt',\n            'realmId',\n        ],\n        allowed: ['email'],\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'displayName', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,OAAQ;CACtB;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAe;EAAa;CAAY,EAAC;CACzEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","userSchema","name","USER","fields","default","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/user/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { User } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const userSchema = defineSchema<User>({\n    name: EntityType.USER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'nameLocked',\n            'firstName',\n            'lastName',\n            'displayName',\n            'avatar',\n            'cover',\n            'active',\n            'status',\n            'statusMessage',\n            'createdAt',\n            'updatedAt',\n            'realmId',\n        ],\n        allowed: ['email'],\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'displayName', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,OAAQ;CACtB;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAe;EAAa;CAAY,EAAC;CACzEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}

package/dist/core/identity/password-recovery/check.mjs

@@ -4,20 +4,20 @@ import.meta.url;
 import { PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE } from "./disabled.mjs";
 import { EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE } from "./email-verification-required.mjs";
 import { RESET_TOKEN_EXPIRED_ERROR_INSTANCE } from "./token-expired.mjs";
-import { ErrorCode, hasInstanceof, isAuthupError } from "@authup/errors";
+import { ErrorCode, isAuthupError, matchesInstanceof } from "@authup/errors";
 //#region src/core/identity/password-recovery/check.ts
 function isPasswordRecoveryDisabledError(input) {
-	if (hasInstanceof(input, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE)) return true;
+	if (matchesInstanceof(input, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE)) return true;
 	if (!isAuthupError(input)) return false;
 	return input.code === ErrorCode.PASSWORD_RECOVERY_DISABLED;
 }
 function isEmailVerificationRequiredError(input) {
-	if (hasInstanceof(input, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE)) return true;
+	if (matchesInstanceof(input, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE)) return true;
 	if (!isAuthupError(input)) return false;
 	return input.code === ErrorCode.EMAIL_VERIFICATION_REQUIRED;
 }
 function isResetTokenExpiredError(input) {
-	if (hasInstanceof(input, RESET_TOKEN_EXPIRED_ERROR_INSTANCE)) return true;
+	if (matchesInstanceof(input, RESET_TOKEN_EXPIRED_ERROR_INSTANCE)) return true;
 	if (!isAuthupError(input)) return false;
 	return input.code === ErrorCode.RESET_TOKEN_EXPIRED;
 }

package/dist/core/identity/password-recovery/check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"check.mjs","names":["ErrorCode","hasInstanceof","isAuthupError","PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE","EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","isPasswordRecoveryDisabledError","input","code","PASSWORD_RECOVERY_DISABLED","isEmailVerificationRequiredError","EMAIL_VERIFICATION_REQUIRED","isResetTokenExpiredError","RESET_TOKEN_EXPIRED"],"sources":["../../../../src/core/identity/password-recovery/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, hasInstanceof, isAuthupError } from '@authup/errors';\nimport { PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE, type PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE, type EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { RESET_TOKEN_EXPIRED_ERROR_INSTANCE, type ResetTokenExpiredError } from './token-expired.ts';\n\nexport function isPasswordRecoveryDisabledError(input: unknown): input is PasswordRecoveryDisabledError {\n    if (hasInstanceof(input, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.PASSWORD_RECOVERY_DISABLED;\n}\n\nexport function isEmailVerificationRequiredError(input: unknown): input is EmailVerificationRequiredError {\n    if (hasInstanceof(input, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.EMAIL_VERIFICATION_REQUIRED;\n}\n\nexport function isResetTokenExpiredError(input: unknown): input is ResetTokenExpiredError {\n    if (hasInstanceof(input, RESET_TOKEN_EXPIRED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.RESET_TOKEN_EXPIRED;\n}\n"],"mappings":";;;;;;;;AAYA,SAAgBM,gCAAgCC,OAAc;CAC1D,IAAIN,cAAcM,OAAOJ,yCAAAA,GAA4C,OAAO;CAC5E,IAAI,CAACD,cAAcK,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUS;AACpC;AAEA,SAAgBC,iCAAiCH,OAAc;CAC3D,IAAIN,cAAcM,OAAOH,0CAAAA,GAA6C,OAAO;CAC7E,IAAI,CAACF,cAAcK,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUW;AACpC;AAEA,SAAgBC,yBAAyBL,OAAc;CACnD,IAAIN,cAAcM,OAAOF,kCAAAA,GAAqC,OAAO;CACrE,IAAI,CAACH,cAAcK,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUa;AACpC"}
+{"version":3,"file":"check.mjs","names":["ErrorCode","isAuthupError","matchesInstanceof","PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE","EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE","RESET_TOKEN_EXPIRED_ERROR_INSTANCE","isPasswordRecoveryDisabledError","input","code","PASSWORD_RECOVERY_DISABLED","isEmailVerificationRequiredError","EMAIL_VERIFICATION_REQUIRED","isResetTokenExpiredError","RESET_TOKEN_EXPIRED"],"sources":["../../../../src/core/identity/password-recovery/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, isAuthupError, matchesInstanceof } from '@authup/errors';\nimport { PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE, type PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE, type EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { RESET_TOKEN_EXPIRED_ERROR_INSTANCE, type ResetTokenExpiredError } from './token-expired.ts';\n\nexport function isPasswordRecoveryDisabledError(input: unknown): input is PasswordRecoveryDisabledError {\n    if (matchesInstanceof(input, PASSWORD_RECOVERY_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.PASSWORD_RECOVERY_DISABLED;\n}\n\nexport function isEmailVerificationRequiredError(input: unknown): input is EmailVerificationRequiredError {\n    if (matchesInstanceof(input, EMAIL_VERIFICATION_REQUIRED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.EMAIL_VERIFICATION_REQUIRED;\n}\n\nexport function isResetTokenExpiredError(input: unknown): input is ResetTokenExpiredError {\n    if (matchesInstanceof(input, RESET_TOKEN_EXPIRED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.RESET_TOKEN_EXPIRED;\n}\n"],"mappings":";;;;;;;;AAYA,SAAgBM,gCAAgCC,OAAc;CAC1D,IAAIL,kBAAkBK,OAAOJ,yCAAAA,GAA4C,OAAO;CAChF,IAAI,CAACF,cAAcM,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUS;AACpC;AAEA,SAAgBC,iCAAiCH,OAAc;CAC3D,IAAIL,kBAAkBK,OAAOH,0CAAAA,GAA6C,OAAO;CACjF,IAAI,CAACH,cAAcM,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUW;AACpC;AAEA,SAAgBC,yBAAyBL,OAAc;CACnD,IAAIL,kBAAkBK,OAAOF,kCAAAA,GAAqC,OAAO;CACzE,IAAI,CAACJ,cAAcM,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASR,UAAUa;AACpC"}

package/dist/core/identity/registration/check.mjs

@@ -2,10 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { REGISTRATION_DISABLED_ERROR_INSTANCE } from "./error.mjs";
-import { ErrorCode, hasInstanceof, isAuthupError } from "@authup/errors";
+import { ErrorCode, isAuthupError, matchesInstanceof } from "@authup/errors";
 //#region src/core/identity/registration/check.ts
 function isRegistrationDisabledError(input) {
-	if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;
+	if (matchesInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;
 	if (!isAuthupError(input)) return false;
 	return input.code === ErrorCode.REGISTRATION_DISABLED;
 }

package/dist/core/identity/registration/check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"check.mjs","names":["ErrorCode","hasInstanceof","isAuthupError","REGISTRATION_DISABLED_ERROR_INSTANCE","isRegistrationDisabledError","input","code","REGISTRATION_DISABLED"],"sources":["../../../../src/core/identity/registration/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, hasInstanceof, isAuthupError } from '@authup/errors';\nimport { REGISTRATION_DISABLED_ERROR_INSTANCE, type RegistrationDisabledError } from './error.ts';\n\nexport function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError {\n    if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.REGISTRATION_DISABLED;\n}\n"],"mappings":";;;;;;AAUA,SAAgBI,4BAA4BC,OAAc;CACtD,IAAIJ,cAAcI,OAAOF,oCAAAA,GAAuC,OAAO;CACvE,IAAI,CAACD,cAAcG,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASN,UAAUO;AACpC"}
+{"version":3,"file":"check.mjs","names":["ErrorCode","isAuthupError","matchesInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","isRegistrationDisabledError","input","code","REGISTRATION_DISABLED"],"sources":["../../../../src/core/identity/registration/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, isAuthupError, matchesInstanceof } from '@authup/errors';\nimport { REGISTRATION_DISABLED_ERROR_INSTANCE, type RegistrationDisabledError } from './error.ts';\n\nexport function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError {\n    if (matchesInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.REGISTRATION_DISABLED;\n}\n"],"mappings":";;;;;;AAUA,SAAgBI,4BAA4BC,OAAc;CACtD,IAAIH,kBAAkBG,OAAOF,oCAAAA,GAAuC,OAAO;CAC3E,IAAI,CAACF,cAAcI,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASN,UAAUO;AACpC"}

package/dist/core/index.mjs

@@ -7,6 +7,7 @@ import { UserCredentialsService } from "./authentication/credential/entities/use
 import { BaseCredentialsAuthenticator } from "./authentication/base.mjs";
 import { ClientAuthenticator } from "./authentication/entities/client/module.mjs";
 import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
+import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./entities/event/constants.mjs";
 import { LoginThrottleService } from "./authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
@@ -14,6 +15,8 @@ import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
 import { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain } from "./client-certificate/module.mjs";
 import "./client-certificate/index.mjs";
+import { CLIENT_READ_PERMISSIONS } from "./entities/client/constants.mjs";
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "./query/describe.mjs";
 import { createRelationsReadGate } from "./query/relations.mjs";
 import { clientSchema } from "./entities/client/schema.mjs";
 import { clientPermissionSchema } from "./entities/client-permission/schema.mjs";
@@ -42,13 +45,12 @@ import { userRoleSchema } from "./entities/user-role/schema.mjs";
 import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./query/module.mjs";
 import "./query/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
-import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
+import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./identity/permission/junction-grant.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
 import { ClientScopeService } from "./entities/client-scope/service.mjs";
 import { ConsentService } from "./entities/consent/service.mjs";
-import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./entities/event/constants.mjs";
 import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./entities/event/diff.mjs";
 import { EntityEventHandler } from "./entities/event/entity-event-handler.mjs";
 import { sanitizeEventData } from "./entities/event/sanitize.mjs";
@@ -173,4 +175,4 @@ import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, eventSchema, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WEB_CLIENT_SCOPE_NAMES, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/key/check.mjs

@@ -2,10 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { REALM_CIPHER_BLOB_ERROR_INSTANCE } from "./error.mjs";
-import { hasInstanceof } from "@authup/errors";
+import { matchesInstanceof } from "@authup/errors";
 //#region src/core/key/check.ts
 function isRealmCipherBlobError(input) {
-	return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);
+	return matchesInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);
 }
 //#endregion
 export { isRealmCipherBlobError };

package/dist/core/key/check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"check.mjs","names":["hasInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","isRealmCipherBlobError","input"],"sources":["../../../src/core/key/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { hasInstanceof } from '@authup/errors';\nimport { REALM_CIPHER_BLOB_ERROR_INSTANCE, type RealmCipherBlobError } from './error.ts';\n\nexport function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError {\n    return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;;AAUA,SAAgBE,uBAAuBC,OAAc;CACjD,OAAOH,cAAcG,OAAOF,gCAAAA;AAChC"}
+{"version":3,"file":"check.mjs","names":["matchesInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","isRealmCipherBlobError","input"],"sources":["../../../src/core/key/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { matchesInstanceof } from '@authup/errors';\nimport { REALM_CIPHER_BLOB_ERROR_INSTANCE, type RealmCipherBlobError } from './error.ts';\n\nexport function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError {\n    return matchesInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;;AAUA,SAAgBE,uBAAuBC,OAAc;CACjD,OAAOH,kBAAkBG,OAAOF,gCAAAA;AACpC"}

package/dist/core/provisioning/entities/client/relations-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAKpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CAkCvB"}
+{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAKpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CA0CvB"}

package/dist/core/provisioning/entities/client/relations-validator.mjs

@@ -21,6 +21,8 @@ var ClientProvisioningRelationsValidator = class extends Container {
 		this.mount("roles", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(roleValidator))));
 		this.mount("realmRoles", { optional: true }, createValidator(z.array(z.string())));
 		this.mount("globalRoles", { optional: true }, createValidator(z.array(z.string())));
+		this.mount("realmScopes", { optional: true }, createValidator(z.array(z.string())));
+		this.mount("globalScopes", { optional: true }, createValidator(z.array(z.string())));
 	}
 };
 //#endregion

package/dist/core/provisioning/entities/client/relations-validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningValidator","RoleProvisioningValidator","createProvisioningEntitiesValidator","ClientProvisioningRelationsValidator","initialize","permissionValidator","roleValidator","mount","optional","array","any","check","string"],"sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { ClientProvisioningRelations } from './types.ts';\n\nexport class ClientProvisioningRelationsValidator extends Container<ClientProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const permissionValidator = new PermissionProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n\n        this.mount('permissions', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(permissionValidator)),\n        ));\n\n        this.mount('realmPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('roles', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(roleValidator)),\n        ));\n\n        this.mount('realmRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAaM,uCAAb,cAA0DL,UAAAA;CAC5CM,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,sBAAsB,IAAIL,gCAAAA;EAChC,MAAMM,gBAAgB,IAAIL,0BAAAA;EAE1B,KAAKM,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCG,mBAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKE,MAAM,oBAAoB,EAAEC,UAAU,KAAK,GAAGX,gBAC/CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,qBAAqB,EAAEC,UAAU,KAAK,GAAGX,gBAChDE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGX,gBACpCE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCI,aAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKC,MAAM,cAAc,EAAEC,UAAU,KAAK,GAAGX,gBACzCE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;CAExB;AACJ"}
+{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningValidator","RoleProvisioningValidator","createProvisioningEntitiesValidator","ClientProvisioningRelationsValidator","initialize","permissionValidator","roleValidator","mount","optional","array","any","check","string"],"sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { ClientProvisioningRelations } from './types.ts';\n\nexport class ClientProvisioningRelationsValidator extends Container<ClientProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const permissionValidator = new PermissionProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n\n        this.mount('permissions', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(permissionValidator)),\n        ));\n\n        this.mount('realmPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('roles', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(roleValidator)),\n        ));\n\n        this.mount('realmRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('realmScopes', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalScopes', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAaM,uCAAb,cAA0DL,UAAAA;CAC5CM,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,sBAAsB,IAAIL,gCAAAA;EAChC,MAAMM,gBAAgB,IAAIL,0BAAAA;EAE1B,KAAKM,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCG,mBAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKE,MAAM,oBAAoB,EAAEC,UAAU,KAAK,GAAGX,gBAC/CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,qBAAqB,EAAEC,UAAU,KAAK,GAAGX,gBAChDE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGX,gBACpCE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCI,aAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKC,MAAM,cAAc,EAAEC,UAAU,KAAK,GAAGX,gBACzCE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,gBAAgB,EAAEC,UAAU,KAAK,GAAGX,gBAC3CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;CAExB;AACJ"}

package/dist/core/provisioning/entities/client/types.d.ts

@@ -27,6 +27,14 @@ export type ClientProvisioningRelations = {
      * Assign client to global roles.
      */
     globalRoles?: string[];
+    /**
+     * Assign client to scopes of same realm.
+     */
+    realmScopes?: string[];
+    /**
+     * Assign client to global scopes.
+     */
+    globalScopes?: string[];
 };
 export type ClientProvisioningEntity = BaseProvisioningEntity<Client> & {
     attributes: Partial<Client>;

package/dist/core/provisioning/entities/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAE7C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAI7B;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAE1B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG;IACpE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5B,SAAS,CAAC,EAAE,2BAA2B,CAAA;CAC1C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAE7C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAI7B;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAIvB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CAE3B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG;IACpE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5B,SAAS,CAAC,EAAE,2BAA2B,CAAA;CAC1C,CAAC"}