@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.57

package/dist/core/provisioning/synchronizer/client/module.d.ts

@@ -1,4 +1,4 @@
-import type { ClientPermission, ClientRole, Permission, Role } from '@authup/core-kit';
+import type { ClientPermission, ClientRole, ClientScope, Permission, Role, Scope } from '@authup/core-kit';
 import type { IClientRepository } from '../../../entities/index.ts';
 import type { ClientProvisioningEntity } from '../../entities/client';
 import type { PermissionProvisioningEntity } from '../../entities/permission';
@@ -12,8 +12,10 @@ export declare class ClientProvisioningSynchronizer extends BaseProvisioningSync
     protected clientRepository: IClientRepository;
     protected permissionResolver: ProvisioningEntityResolver<Permission>;
     protected roleResolver: ProvisioningEntityResolver<Role>;
+    protected scopeResolver: ProvisioningEntityResolver<Scope>;
     protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;
     protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;
+    protected scopeJunction: ProvisioningJunctionSynchronizer<ClientScope>;
     protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
     protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
     constructor(ctx: ClientProvisioningSynchronizerContext);

package/dist/core/provisioning/synchronizer/client/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEjF,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;gBAElE,GAAG,EAAE,qCAAqC;IAuBhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA+GxF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,IAAI,EACJ,KAAK,EACR,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,aAAa,EAAE,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAE3D,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEjF,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,aAAa,EAAE,gCAAgC,CAAC,WAAW,CAAC,CAAC;IAEvE,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;gBAElE,GAAG,EAAE,qCAAqC;IA6BhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAsIxF"}

package/dist/core/provisioning/synchronizer/client/module.mjs

@@ -13,8 +13,10 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 	clientRepository;
 	permissionResolver;
 	roleResolver;
+	scopeResolver;
 	permissionJunction;
 	roleJunction;
+	scopeJunction;
 	permissionSynchronizer;
 	roleSynchronizer;
 	constructor(ctx) {
@@ -22,6 +24,7 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 		this.clientRepository = ctx.clientRepository;
 		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
 		this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);
+		this.scopeResolver = new ProvisioningEntityResolver(ctx.scopeRepository, { clientScoped: false });
 		this.permissionJunction = new ProvisioningJunctionSynchronizer({
 			repository: ctx.clientPermissionRepository,
 			ownerKey: "clientId",
@@ -32,6 +35,11 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 			ownerKey: "clientId",
 			ownerRealmKey: "clientRealmId"
 		});
+		this.scopeJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.clientScopeRepository,
+			ownerKey: "clientId",
+			ownerRealmKey: "clientRealmId"
+		});
 		this.permissionSynchronizer = ctx.permissionSynchronizer;
 		this.roleSynchronizer = ctx.roleSynchronizer;
 	}
@@ -64,6 +72,8 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 		if (permissions.length > 0) await this.permissionJunction.synchronize(attributes, permissions, "permissionId", "permissionRealmId");
 		const roles = [...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles), ...attributes.realmId ? await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realmId) : []];
 		if (roles.length > 0) await this.roleJunction.synchronize(attributes, roles, "roleId", "roleRealmId");
+		const scopes = [...await this.scopeResolver.resolveGlobal(input.relations && input.relations.globalScopes), ...attributes.realmId ? await this.scopeResolver.resolveRealm(input.relations && input.relations.realmScopes, attributes.realmId) : []];
+		if (scopes.length > 0) await this.scopeJunction.synchronize(attributes, scopes, "scopeId", "scopeRealmId");
 		if (input.relations && input.relations.permissions) {
 			const children = input.relations.permissions.map((child) => {
 				child.attributes.clientId = attributes.id;

package/dist/core/provisioning/synchronizer/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","children","map","child","clientId","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission, \n    ClientRole, \n    Permission, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAyBA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKP,mBAAmBO,IAAIP;EAE5B,KAAKC,qBAAqB,IAAIJ,2BAA2BU,IAAIC,oBAAoB;EACjF,KAAKN,eAAe,IAAIL,2BAA2BU,IAAIE,cAAc;EAErE,KAAKN,qBAAqB,IAAIL,iCAAiC;GAC3DY,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKT,eAAe,IAAIN,iCAAiC;GACrDY,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;EAEA,KAAKR,yBAAyBE,IAAIF;EAClC,KAAKC,mBAAmBC,IAAID;CAChC;CAEA,MAAMS,YAAYC,OAAoE;EAClF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWxB,oCAAoCqB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKlB,iBAAiBoB,UAAU;GACnDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS7B,+BAA+B8B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKlB,iBAAiByB,OAAOP,UAAAA;GAEvC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK7B,+BAA+BgC;IAChCR,aAAa,KAAKlB,iBAAiB2B,MAC/BT,YACAC,SAASD,aACLzB,WAAWuB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAExBA,aAAa,MAAM,KAAKlB,iBAAiB4B,KAAKV,UAAAA;IAC9C;GACJ,KAAKxB,+BAA+BmC;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKlB,iBAAiB4B,KAAK,KAAK5B,iBAAiB+B,OAAOf,MAAME,UAAU,CAAA;IAC3F;EACR;OAEAA,aAAa,MAAM,KAAKlB,iBAAiB4B,KAAK,KAAK5B,iBAAiB+B,OAAOf,MAAME,UAAU,CAAA;EAI/F,MAAMc,cAAc,CACb,GAAA,MAAM,KAAK/B,mBAAmBgC,cAC7BjB,MAAMkB,aAAalB,MAAMkB,UAAUC,iBAAiB,GAEpDjB,GAAAA,WAAWI,UACX,MAAM,KAAKrB,mBAAmBmC,aAC1BpB,MAAMkB,aAAalB,MAAMkB,UAAUG,kBACnCnB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKnC,mBAAmBY,YAC1BG,YACAc,aACA,gBACA,mBAAA;EAKR,MAAMO,QAAQ,CACP,GAAA,MAAM,KAAKrC,aAAa+B,cACvBjB,MAAMkB,aAAalB,MAAMkB,UAAUM,WAAW,GAE9CtB,GAAAA,WAAWI,UACX,MAAM,KAAKpB,aAAakC,aACpBpB,MAAMkB,aAAalB,MAAMkB,UAAUO,YACnCvB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKlC,aAAaW,YACpBG,YACAqB,OACA,UACA,aAAA;EAMR,IAAIvB,MAAMkB,aAAalB,MAAMkB,UAAUF,aAAa;GAChD,MAAMU,WAAW1B,MAAMkB,UAAUF,YAAYW,KAAKC,UAAAA;IAC9CA,MAAM1B,WAAW2B,WAAW3B,WAAWY;IACvCc,MAAM1B,WAAW4B,SAAS5B;IAC1B,OAAO0B;GACX,CAAA;GAEA,MAAM,KAAKvC,uBAAuB0C,gBAAgBL,QAAAA;EACtD;EAEA,IAAI1B,MAAMkB,aAAalB,MAAMkB,UAAUK,OAAO;GAC1C,MAAMG,WAAW1B,MAAMkB,UAAUK,MAAMI,KAAKC,UAAAA;IACxCA,MAAM1B,WAAW2B,WAAW3B,WAAWY;IACvCc,MAAM1B,WAAW4B,SAAS5B;IAC1B,OAAO0B;GACX,CAAA;GAEA,MAAM,KAAKtC,iBAAiByC,gBAAgBL,QAAAA;EAChD;EAEA,OAAO;GACH,GAAG1B;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","scopeResolver","permissionJunction","roleJunction","scopeJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","scopeRepository","clientScoped","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","clientScopeRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","scopes","globalScopes","realmScopes","children","map","child","clientId","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    Permission,\n    Role,\n    Scope,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected scopeResolver: ProvisioningEntityResolver<Scope>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected scopeJunction: ProvisioningJunctionSynchronizer<ClientScope>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n        this.scopeResolver = new ProvisioningEntityResolver(ctx.scopeRepository, { clientScoped: false });\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.scopeJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientScopeRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        // Scopes (Global + Realm). The junction is the only source the\n        // /authorize code-request verifier reads scopes from.\n        const scopes = [\n            ...await this.scopeResolver.resolveGlobal(\n                input.relations && input.relations.globalScopes,\n            ),\n            ...(attributes.realmId ?\n                await this.scopeResolver.resolveRealm(\n                    input.relations && input.relations.realmScopes,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (scopes.length > 0) {\n            await this.scopeJunction.synchronize(\n                attributes,\n                scopes,\n                'scopeId',\n                'scopeRealmId',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AA2BA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKT,mBAAmBS,IAAIT;EAE5B,KAAKC,qBAAqB,IAAIJ,2BAA2BY,IAAIC,oBAAoB;EACjF,KAAKR,eAAe,IAAIL,2BAA2BY,IAAIE,cAAc;EACrE,KAAKR,gBAAgB,IAAIN,2BAA2BY,IAAIG,iBAAiB,EAAEC,cAAc,MAAM,CAAA;EAE/F,KAAKT,qBAAqB,IAAIN,iCAAiC;GAC3DgB,YAAYL,IAAIM;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKZ,eAAe,IAAIP,iCAAiC;GACrDgB,YAAYL,IAAIS;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKX,gBAAgB,IAAIR,iCAAiC;GACtDgB,YAAYL,IAAIU;GAChBH,UAAU;GACVC,eAAe;EACnB,CAAA;EAEA,KAAKV,yBAAyBE,IAAIF;EAClC,KAAKC,mBAAmBC,IAAID;CAChC;CAEA,MAAMY,YAAYC,OAAoE;EAClF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAW7B,oCAAoC0B,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKvB,iBAAiByB,UAAU;GACnDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASlC,+BAA+BmC,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKvB,iBAAiB8B,OAAOP,UAAAA;GAEvC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKlC,+BAA+BqC;IAChCR,aAAa,KAAKvB,iBAAiBgC,MAC/BT,YACAC,SAASD,aACL9B,WAAW4B,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAExBA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAKV,UAAAA;IAC9C;GACJ,KAAK7B,+BAA+BwC;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;IAC3F;EACR;OAEAA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;EAI/F,MAAMc,cAAc,CACb,GAAA,MAAM,KAAKpC,mBAAmBqC,cAC7BjB,MAAMkB,aAAalB,MAAMkB,UAAUC,iBAAiB,GAEpDjB,GAAAA,WAAWI,UACX,MAAM,KAAK1B,mBAAmBwC,aAC1BpB,MAAMkB,aAAalB,MAAMkB,UAAUG,kBACnCnB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKvC,mBAAmBgB,YAC1BG,YACAc,aACA,gBACA,mBAAA;EAKR,MAAMO,QAAQ,CACP,GAAA,MAAM,KAAK1C,aAAaoC,cACvBjB,MAAMkB,aAAalB,MAAMkB,UAAUM,WAAW,GAE9CtB,GAAAA,WAAWI,UACX,MAAM,KAAKzB,aAAauC,aACpBpB,MAAMkB,aAAalB,MAAMkB,UAAUO,YACnCvB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKtC,aAAae,YACpBG,YACAqB,OACA,UACA,aAAA;EAMR,MAAMG,SAAS,CACR,GAAA,MAAM,KAAK5C,cAAcmC,cACxBjB,MAAMkB,aAAalB,MAAMkB,UAAUS,YAAY,GAE/CzB,GAAAA,WAAWI,UACX,MAAM,KAAKxB,cAAcsC,aACrBpB,MAAMkB,aAAalB,MAAMkB,UAAUU,aACnC1B,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIoB,OAAOJ,SAAS,GAChB,MAAM,KAAKrC,cAAcc,YACrBG,YACAwB,QACA,WACA,cAAA;EAMR,IAAI1B,MAAMkB,aAAalB,MAAMkB,UAAUF,aAAa;GAChD,MAAMa,WAAW7B,MAAMkB,UAAUF,YAAYc,KAAKC,UAAAA;IAC9CA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK7C,uBAAuBgD,gBAAgBL,QAAAA;EACtD;EAEA,IAAI7B,MAAMkB,aAAalB,MAAMkB,UAAUK,OAAO;GAC1C,MAAMM,WAAW7B,MAAMkB,UAAUK,MAAMO,KAAKC,UAAAA;IACxCA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK5C,iBAAiB+C,gBAAgBL,QAAAA;EAChD;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/client/types.d.ts

@@ -1,4 +1,4 @@
-import type { IClientPermissionRepository, IClientRepository, IClientRoleRepository, IPermissionRepository, IRoleRepository } from '../../../entities/index.ts';
+import type { IClientPermissionRepository, IClientRepository, IClientRoleRepository, IClientScopeRepository, IPermissionRepository, IRoleRepository, IScopeRepository } from '../../../entities/index.ts';
 import type { PermissionProvisioningEntity } from '../../entities/permission';
 import type { RoleProvisioningEntity } from '../../entities/role';
 import type { IProvisioningSynchronizer } from '../../types.ts';
@@ -6,8 +6,10 @@ export type ClientProvisioningSynchronizerContext = {
     clientRepository: IClientRepository;
     clientRoleRepository: IClientRoleRepository;
     clientPermissionRepository: IClientPermissionRepository;
+    clientScopeRepository: IClientScopeRepository;
     roleRepository: IRoleRepository;
     permissionRepository: IPermissionRepository;
+    scopeRepository: IScopeRepository;
     roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
     permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
 };

package/dist/core/provisioning/synchronizer/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,cAAc,EAAE,eAAe,CAAC;IAChC,oBAAoB,EAAE,qBAAqB,CAAC;IAE5C,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;CACnF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,qBAAqB,EAAE,sBAAsB,CAAC;IAE9C,cAAc,EAAE,eAAe,CAAC;IAChC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,eAAe,EAAE,gBAAgB,CAAC;IAElC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;CACnF,CAAC"}

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts

@@ -1,10 +1,13 @@
 import type { ObjectLiteral } from '@authup/kit';
 import type { IEntityRepository } from '@authup/server-kit';
+import type { ProvisioningEntityResolverOptions } from './types.ts';
 export declare class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {
     protected repository: IEntityRepository<T>;
-    constructor(repository: IEntityRepository<T>);
+    protected clientScoped: boolean;
+    constructor(repository: IEntityRepository<T>, options?: ProvisioningEntityResolverOptions);
     resolveGlobal(names?: string[]): Promise<T[]>;
     resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]>;
     resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]>;
+    protected resolve(names: string[] | undefined, where: Record<string, any>, clientId?: string | null): Promise<T[]>;
 }
 //# sourceMappingURL=entity-resolver.d.ts.map

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,qBAAa,0BAA0B,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC3E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAE/B,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAItC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAsB7C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAsBxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAqBpG"}
+{"version":3,"file":"entity-resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEpE,qBAAa,0BAA0B,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC3E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC;gBAEpB,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,iCAAsC;IAKvF,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAI7C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;cAIjF,OAAO,CACnB,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC/B,OAAO,CAAC,CAAC,EAAE,CAAC;CA0BlB"}

package/dist/core/provisioning/synchronizer/entity-resolver.mjs

@@ -4,46 +4,31 @@ import.meta.url;
 //#region src/core/provisioning/synchronizer/entity-resolver.ts
 var ProvisioningEntityResolver = class {
 	repository;
-	constructor(repository) {
+	clientScoped;
+	constructor(repository, options = {}) {
 		this.repository = repository;
+		this.clientScoped = options.clientScoped ?? true;
 	}
 	async resolveGlobal(names) {
-		if (!names || names.length === 0) return [];
-		names = names.map((name) => name.trim().toLowerCase());
-		if (names.includes("*")) return this.repository.findManyBy({
-			realmId: null,
-			clientId: null
-		});
-		return this.repository.findManyBy({
-			name: names,
-			realmId: null,
-			clientId: null
-		});
+		return this.resolve(names, { realmId: null });
 	}
 	async resolveRealm(names, realmId) {
-		if (!names || names.length === 0) return [];
-		names = names.map((name) => name.trim().toLowerCase());
-		if (names.includes("*")) return this.repository.findManyBy({
-			realmId,
-			clientId: null
-		});
-		return this.repository.findManyBy({
-			name: names,
-			realmId,
-			clientId: null
-		});
+		return this.resolve(names, { realmId });
 	}
 	async resolveClient(names, realmId, clientId) {
+		return this.resolve(names, { realmId }, clientId);
+	}
+	async resolve(names, where, clientId = null) {
 		if (!names || names.length === 0) return [];
 		names = names.map((name) => name.trim().toLowerCase());
-		if (names.includes("*")) return this.repository.findManyBy({
-			realmId,
+		const conditions = this.clientScoped ? {
+			...where,
 			clientId
-		});
+		} : where;
+		if (names.includes("*")) return this.repository.findManyBy(conditions);
 		return this.repository.findManyBy({
-			name: names,
-			realmId,
-			clientId
+			...conditions,
+			name: names
 		});
 	}
 };

package/dist/core/provisioning/synchronizer/entity-resolver.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity-resolver.mjs","names":["ProvisioningEntityResolver","repository","resolveGlobal","names","length","map","name","trim","toLowerCase","hasWildcard","includes","findManyBy","realmId","clientId","resolveRealm","resolveClient"],"sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '@authup/server-kit';\n\nexport class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {\n    protected repository: IEntityRepository<T>;\n\n    constructor(repository: IEntityRepository<T>) {\n        this.repository = repository;\n    }\n\n    async resolveGlobal(names?: string[]): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realmId: null,\n                clientId: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    async resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realmId,\n                clientId: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realmId,\n            clientId: null,\n        });\n    }\n\n    async resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realmId,\n                clientId,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realmId,\n            clientId,\n        });\n    }\n}\n"],"mappings":";;;;AAUA,IAAaA,6BAAb,MAAaA;CACCC;CAEV,YAAYA,YAAkC;EAC1C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,cAAcC,OAAgC;EAChD,IAAI,CAACA,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAGXD,QAAQA,MAAME,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAGnD,IADoBL,MAAMO,SAAS,GAC/BD,GACA,OAAO,KAAKR,WAAWU,WAAW;GAC9BC,SAAS;GACTC,UAAU;EACd,CAAA;EAGJ,OAAO,KAAKZ,WAAWU,WAAW;GAC9BL,MAAMH;GACNS,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAEA,MAAMC,aAAaX,OAA6BS,SAA+B;EAC3E,IAAI,CAACT,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAGXD,QAAQA,MAAME,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAGnD,IADoBL,MAAMO,SAAS,GAC/BD,GACA,OAAO,KAAKR,WAAWU,WAAW;GAC9BC;GACAC,UAAU;EACd,CAAA;EAGJ,OAAO,KAAKZ,WAAWU,WAAW;GAC9BL,MAAMH;GACNS;GACAC,UAAU;EACd,CAAA;CACJ;CAEA,MAAME,cAAcZ,OAA6BS,SAAiBC,UAAgC;EAC9F,IAAI,CAACV,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAGXD,QAAQA,MAAME,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAGnD,IADoBL,MAAMO,SAAS,GAC/BD,GACA,OAAO,KAAKR,WAAWU,WAAW;GAC9BC;GACAC;EACJ,CAAA;EAGJ,OAAO,KAAKZ,WAAWU,WAAW;GAC9BL,MAAMH;GACNS;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"entity-resolver.mjs","names":["ProvisioningEntityResolver","repository","clientScoped","options","resolveGlobal","names","resolve","realmId","resolveRealm","resolveClient","clientId","where","length","map","name","trim","toLowerCase","conditions","includes","findManyBy"],"sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '@authup/server-kit';\nimport type { ProvisioningEntityResolverOptions } from './types.ts';\n\nexport class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {\n    protected repository: IEntityRepository<T>;\n\n    protected clientScoped: boolean;\n\n    constructor(repository: IEntityRepository<T>, options: ProvisioningEntityResolverOptions = {}) {\n        this.repository = repository;\n        this.clientScoped = options.clientScoped ?? true;\n    }\n\n    async resolveGlobal(names?: string[]): Promise<T[]> {\n        return this.resolve(names, { realmId: null });\n    }\n\n    async resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]> {\n        return this.resolve(names, { realmId });\n    }\n\n    async resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]> {\n        return this.resolve(names, { realmId }, clientId);\n    }\n\n    protected async resolve(\n        names: string[] | undefined,\n        where: Record<string, any>,\n        clientId: string | null = null,\n    ): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        // A client-ownable entity must never resolve another owner's rows, so\n        // the client dimension is always pinned. Entities without one (scope)\n        // opt out, because the predicate would not compile against the table.\n        const conditions = this.clientScoped ?\n            {\n                ...where,\n                clientId,\n            } :\n            where;\n\n        if (names.includes('*')) {\n            return this.repository.findManyBy(conditions);\n        }\n\n        return this.repository.findManyBy({\n            ...conditions,\n            name: names,\n        });\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAkCE,UAA6C,CAAC,GAAG;EAC3F,KAAKF,aAAaA;EAClB,KAAKC,eAAeC,QAAQD,gBAAgB;CAChD;CAEA,MAAME,cAAcC,OAAgC;EAChD,OAAO,KAAKC,QAAQD,OAAO,EAAEE,SAAS,KAAK,CAAA;CAC/C;CAEA,MAAMC,aAAaH,OAA6BE,SAA+B;EAC3E,OAAO,KAAKD,QAAQD,OAAO,EAAEE,QAAQ,CAAA;CACzC;CAEA,MAAME,cAAcJ,OAA6BE,SAAiBG,UAAgC;EAC9F,OAAO,KAAKJ,QAAQD,OAAO,EAAEE,QAAQ,GAAGG,QAAAA;CAC5C;CAEA,MAAgBJ,QACZD,OACAM,OACAD,WAA0B,MACd;EACZ,IAAI,CAACL,SAASA,MAAMO,WAAW,GAC3B,OAAO,CAAA;EAGXP,QAAQA,MAAMQ,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAKnD,MAAMC,aAAa,KAAKf,eACpB;GACI,GAAGS;GACHD;EACJ,IACAC;EAEJ,IAAIN,MAAMa,SAAS,GAAA,GACf,OAAO,KAAKjB,WAAWkB,WAAWF,UAAAA;EAGtC,OAAO,KAAKhB,WAAWkB,WAAW;GAC9B,GAAGF;GACHH,MAAMT;EACV,CAAA;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/index.d.ts

@@ -7,5 +7,6 @@ export * from './realm/index.ts';
 export * from './role/index.ts';
 export * from './root/index.ts';
 export * from './scope/index.ts';
+export * from './types.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/core/provisioning/synchronizer/realm/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;IAExC,SAAS,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAElF,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;gBAErE,GAAG,EAAE,oCAAoC;IAW/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CA8FtF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;IAExC,SAAS,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAElF,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;gBAErE,GAAG,EAAE,oCAAoC;IAW/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAgGtF"}

package/dist/core/provisioning/synchronizer/realm/module.mjs

@@ -45,6 +45,14 @@ var RealmProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (input.relations && input.relations.scopes) {
+			const scopes = input.relations.scopes.map((child) => {
+				child.attributes.realmId = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.scopeSynchronizer.synchronizeMany(scopes);
+		}
 		if (input.relations && input.relations.clients) {
 			const clients = input.relations.clients.map((child) => {
 				child.attributes.realmId = attributes.id;
@@ -77,14 +85,6 @@ var RealmProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			});
 			await this.userSynchronizer.synchronizeMany(users);
 		}
-		if (input.relations && input.relations.scopes) {
-			const scopes = input.relations.scopes.map((child) => {
-				child.attributes.realmId = attributes.id;
-				child.attributes.realm = attributes;
-				return child;
-			});
-			await this.scopeSynchronizer.synchronizeMany(scopes);
-		}
 		return {
 			...input,
 			attributes

package/dist/core/provisioning/synchronizer/realm/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","clients","map","child","realmId","realm","synchronizeMany","permissions","roles","users","scopes"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realmId = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKN,aAAaM,IAAIN;EACtB,KAAKC,qBAAqBK,IAAIL;EAC9B,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWd,oCAAoCW,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKV,WAAWY,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKV,WAAWgB,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCP,aAAa,KAAKV,WAAWkB,MACzBR,YACAC,SAASD,aACLf,WAAWa,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKV,WAAWmB,KAAKT,UAAAA;IACxC;GACJ,KAAKd,+BAA+BwB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,SAAS;GAC5C,MAAMA,UAAUhB,MAAMe,UAAUC,QAAQC,KACnCC,UAAAA;IACGA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBL,OAAAA;EAClD;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,aAAa;GAChD,MAAMA,cAActB,MAAMe,UAAUO,YAAYL,KAAKC,UAAAA;IACjDA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBC,WAAAA;EACtD;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,OAAO;GAC1C,MAAMA,QAAQvB,MAAMe,UAAUQ,MAAMN,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBE,KAAAA;EAChD;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,QAAQ;GAC3C,MAAMA,SAASzB,MAAMe,UAAUU,OAAOR,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBI,MAAAA;EACjD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","scopes","map","child","realmId","realm","synchronizeMany","clients","permissions","roles","users"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n    protected repository : IRealmRepository;\n\n    protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n    protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n    constructor(ctx: RealmProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.clientSynchronizer = ctx.clientSynchronizer;\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n        this.userSynchronizer = ctx.userSynchronizer;\n        this.scopeSynchronizer = ctx.scopeSynchronizer;\n    }\n\n    async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n        let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        // Scopes first: they are leaf entities carrying no relations of their\n        // own, and a client below may bind them through `realmScopes`.\n        if (input.relations && input.relations.scopes) {\n            const scopes = input.relations.scopes.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.scopeSynchronizer.synchronizeMany(scopes);\n        }\n\n        if (input.relations && input.relations.clients) {\n            const clients = input.relations.clients.map(\n                (child) => {\n                    child.attributes.realmId = attributes.id;\n                    child.attributes.realm = attributes;\n                    return child;\n                },\n            );\n\n            await this.clientSynchronizer.synchronizeMany(clients);\n        }\n\n        if (input.relations && input.relations.permissions) {\n            const permissions = input.relations.permissions.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(permissions);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const roles = input.relations.roles.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(roles);\n        }\n\n        if (input.relations && input.relations.users) {\n            const users = input.relations.users.map((child) => {\n                child.attributes.realmId = attributes.id;\n                child.attributes.realm = attributes;\n                return child;\n            });\n\n            await this.userSynchronizer.synchronizeMany(users);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKN,aAAaM,IAAIN;EACtB,KAAKC,qBAAqBK,IAAIL;EAC9B,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWd,oCAAoCW,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKV,WAAWY,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKV,WAAWgB,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCP,aAAa,KAAKV,WAAWkB,MACzBR,YACAC,SAASD,aACLf,WAAWa,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKV,WAAWmB,KAAKT,UAAAA;IACxC;GACJ,KAAKd,+BAA+BwB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAKnF,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,QAAQ;GAC3C,MAAMA,SAAShB,MAAMe,UAAUC,OAAOC,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBL,MAAAA;EACjD;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,SAAS;GAC5C,MAAMA,UAAUtB,MAAMe,UAAUO,QAAQL,KACnCC,UAAAA;IACGA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBC,OAAAA;EAClD;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,aAAa;GAChD,MAAMA,cAAcvB,MAAMe,UAAUQ,YAAYN,KAAKC,UAAAA;IACjDA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBE,WAAAA;EACtD;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,OAAO;GAC1C,MAAMA,QAAQzB,MAAMe,UAAUU,MAAMR,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBI,KAAAA;EAChD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/types.d.ts

@@ -0,0 +1,11 @@
+export type ProvisioningEntityResolverOptions = {
+    /**
+     * Whether the resolved entity carries a `clientId` column.
+     *
+     * Permissions and roles are client-ownable, so their lookups pin the
+     * client dimension. Scopes have none, so leaving the predicate in would
+     * make the query fail against the table. Defaults to true.
+     */
+    clientScoped?: boolean;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iCAAiC,GAAG;IAC5C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC"}

package/dist/core/provisioning/synchronizer/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/query/describe.d.ts

@@ -0,0 +1,25 @@
+import { Parameter } from '@rapiq/core';
+import type { Schema, SchemaDescription } from '@rapiq/core';
+/**
+ * The parameter subset advertised on single-record reads: a record
+ * response never advertises filter/sort/pagination vocabulary (no
+ * single read processes those). NOTE: today only the user/client
+ * single reads actually decode `fields`/`relations`
+ * (`decodeQuery(..., { parameters: ['fields', 'relations'] })`); the
+ * other record endpoints ignore the query entirely, so for them this
+ * advertisement is the TARGET vocabulary, not current behavior —
+ * converging them is tracked in plan 076.
+ */
+export declare const RECORD_QUERY_PARAMETERS: `${Parameter}`[];
+/**
+ * Serialize an entity schema's declared query constraints for the
+ * response `meta.schema` key (issue #1649) — the static upper bound of
+ * the queryable vocabulary. Relation capabilities are not expanded
+ * inline: `relations.schemas` names each relation's target schema,
+ * whose own endpoints carry its description. Actor-dependent gates
+ * (relations read gate, field visibility conditions) are deliberately
+ * not reflected. Descriptions are immutable per (schema, parameters),
+ * so they are memoized — callers MUST NOT mutate the returned object.
+ */
+export declare function describeQuerySchema(schema: Schema<any>, parameters?: `${Parameter}`[]): SchemaDescription;
+//# sourceMappingURL=describe.d.ts.map

package/dist/core/query/describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../../src/core/query/describe.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,GAAG,SAAS,EAAE,EAGnD,CAAC;AAgBF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EACnB,UAAU,CAAC,EAAE,GAAG,SAAS,EAAE,EAAE,GAC7B,iBAAiB,CAgBpB"}

package/dist/core/query/describe.mjs

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Parameter } from "@rapiq/core";
+//#region src/core/query/describe.ts
+/**
+* The parameter subset advertised on single-record reads: a record
+* response never advertises filter/sort/pagination vocabulary (no
+* single read processes those). NOTE: today only the user/client
+* single reads actually decode `fields`/`relations`
+* (`decodeQuery(..., { parameters: ['fields', 'relations'] })`); the
+* other record endpoints ignore the query entirely, so for them this
+* advertisement is the TARGET vocabulary, not current behavior —
+* converging them is tracked in plan 076.
+*/ const RECORD_QUERY_PARAMETERS = [Parameter.FIELDS, Parameter.RELATIONS];
+const cache = /* @__PURE__ */ new WeakMap();
+function deepFreeze(input) {
+	if (input !== null && typeof input === "object") {
+		for (const value of Object.values(input)) deepFreeze(value);
+		Object.freeze(input);
+	}
+	return input;
+}
+/**
+* Serialize an entity schema's declared query constraints for the
+* response `meta.schema` key (issue #1649) — the static upper bound of
+* the queryable vocabulary. Relation capabilities are not expanded
+* inline: `relations.schemas` names each relation's target schema,
+* whose own endpoints carry its description. Actor-dependent gates
+* (relations read gate, field visibility conditions) are deliberately
+* not reflected. Descriptions are immutable per (schema, parameters),
+* so they are memoized — callers MUST NOT mutate the returned object.
+*/ function describeQuerySchema(schema, parameters) {
+	let bySignature = cache.get(schema);
+	if (!bySignature) {
+		bySignature = /* @__PURE__ */ new Map();
+		cache.set(schema, bySignature);
+	}
+	const signature = parameters ? [...parameters].sort().join(",") : "*";
+	let output = bySignature.get(signature);
+	if (!output) {
+		output = deepFreeze(schema.describe(parameters ? { parameters } : {}));
+		bySignature.set(signature, output);
+	}
+	return output;
+}
+//#endregion
+export { RECORD_QUERY_PARAMETERS, describeQuerySchema };
+
+//# sourceMappingURL=describe.mjs.map

package/dist/core/query/describe.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.mjs","names":["Parameter","RECORD_QUERY_PARAMETERS","FIELDS","RELATIONS","cache","WeakMap","deepFreeze","input","value","Object","values","freeze","describeQuerySchema","schema","parameters","bySignature","get","Map","set","signature","sort","join","output","describe"],"sources":["../../../src/core/query/describe.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Parameter } from '@rapiq/core';\nimport type { Schema, SchemaDescription } from '@rapiq/core';\n\n/**\n * The parameter subset advertised on single-record reads: a record\n * response never advertises filter/sort/pagination vocabulary (no\n * single read processes those). NOTE: today only the user/client\n * single reads actually decode `fields`/`relations`\n * (`decodeQuery(..., { parameters: ['fields', 'relations'] })`); the\n * other record endpoints ignore the query entirely, so for them this\n * advertisement is the TARGET vocabulary, not current behavior —\n * converging them is tracked in plan 076.\n */\nexport const RECORD_QUERY_PARAMETERS: `${Parameter}`[] = [\n    Parameter.FIELDS,\n    Parameter.RELATIONS,\n];\n\nconst cache = new WeakMap<Schema<any>, Map<string, SchemaDescription>>();\n\nfunction deepFreeze<T>(input: T) : T {\n    if (input !== null && typeof input === 'object') {\n        for (const value of Object.values(input)) {\n            deepFreeze(value);\n        }\n\n        Object.freeze(input);\n    }\n\n    return input;\n}\n\n/**\n * Serialize an entity schema's declared query constraints for the\n * response `meta.schema` key (issue #1649) — the static upper bound of\n * the queryable vocabulary. Relation capabilities are not expanded\n * inline: `relations.schemas` names each relation's target schema,\n * whose own endpoints carry its description. Actor-dependent gates\n * (relations read gate, field visibility conditions) are deliberately\n * not reflected. Descriptions are immutable per (schema, parameters),\n * so they are memoized — callers MUST NOT mutate the returned object.\n */\nexport function describeQuerySchema(\n    schema: Schema<any>,\n    parameters?: `${Parameter}`[],\n) : SchemaDescription {\n    let bySignature = cache.get(schema);\n    if (!bySignature) {\n        bySignature = new Map();\n        cache.set(schema, bySignature);\n    }\n\n    const signature = parameters ? [...parameters].sort().join(',') : '*';\n\n    let output = bySignature.get(signature);\n    if (!output) {\n        output = deepFreeze(schema.describe(parameters ? { parameters } : {}));\n        bySignature.set(signature, output);\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;GAoBA,MAAaC,0BAA4C,CACrDD,UAAUE,QACVF,UAAUG,SACb;AAED,MAAMC,wBAAQ,IAAIC,QAAAA;AAElB,SAASC,WAAcC,OAAQ;CAC3B,IAAIA,UAAU,QAAQ,OAAOA,UAAU,UAAU;EAC7C,KAAK,MAAMC,SAASC,OAAOC,OAAOH,KAAAA,GAC9BD,WAAWE,KAAAA;EAGfC,OAAOE,OAAOJ,KAAAA;CAClB;CAEA,OAAOA;AACX;;;;;;;;;;GAYA,SAAgBK,oBACZC,QACAC,YAA6B;CAE7B,IAAIC,cAAcX,MAAMY,IAAIH,MAAAA;CAC5B,IAAI,CAACE,aAAa;EACdA,8BAAc,IAAIE,IAAAA;EAClBb,MAAMc,IAAIL,QAAQE,WAAAA;CACtB;CAEA,MAAMI,YAAYL,aAAa,CAAIA,GAAAA,UAAW,CAAA,CAACM,KAAI,CAAA,CAAGC,KAAK,GAAA,IAAO;CAElE,IAAIC,SAASP,YAAYC,IAAIG,SAAAA;CAC7B,IAAI,CAACG,QAAQ;EACTA,SAAShB,WAAWO,OAAOU,SAAST,aAAa,EAAEA,WAAW,IAAI,CAAC,CAAA,CAAA;EACnEC,YAAYG,IAAIC,WAAWG,MAAAA;CAC/B;CAEA,OAAOA;AACX"}

package/dist/core/query/fields.d.ts

@@ -0,0 +1,44 @@
+import type { KeyValidationVerdict, KeyValidatorMany } from '@rapiq/core';
+import type { ActorContext } from '@authup/server-kit';
+import type { QueryDecodeContext } from './types.ts';
+/**
+ * Per-field read gate: given the acting identity, answer with a
+ * {@link KeyValidationVerdict} for one gated column — `true` to project
+ * it, `false` to strip it, or an `ICondition` to project it visible
+ * only on rows satisfying the condition (rapiq attaches it to the
+ * `Field` node; the repository layer enforces it after the fetch via
+ * `redactFieldConditions`).
+ *
+ * A returned condition must be authored FAIL-CLOSED over incomplete
+ * rows: `@rapiq/adapter-memory` unifies a missing column with `null`, so a
+ * negative predicate (`not(...)`, `ne(...)`) over an unselected column
+ * evaluates true and ships the value. The SQL adapter force-selects
+ * every column a condition references (rapiq#830's operand
+ * projection), so this is defense in depth — but prefer positive legs
+ * (`eq(x, true)`) plus an outer presence guard (`ne('realmId', null)`)
+ * over negated trees.
+ */
+export type FieldReadGate = (actor: ActorContext) => Promise<KeyValidationVerdict> | KeyValidationVerdict;
+/**
+ * Build a rapiq `fields.validateMany` hook gating individual columns on
+ * a per-actor verdict (issue #3322): invoked once per (governing
+ * schema, relation path) with every client-requested field, so a gate
+ * can compile the actor's permission tree once per query instead of
+ * once per field. The batched form matters because the gate applies
+ * uniformly at the query ROOT and under any relation path — the
+ * position where `ClientPermissionService` & co. serve
+ * `include=client&fields[client]=secret` never runs the client
+ * service's own read path.
+ *
+ * Ungated fields accept. Schema defaults never reach the hook, so an
+ * unqualified list request costs no evaluation. Caller classes mirror
+ * the relations read gate: a SYSTEM decode (no actor in the context)
+ * is unrestricted; every REQUEST decode carries an actor (anonymous
+ * ones hold no grants). A gate failure fails closed (strip).
+ *
+ * NOTE: schemas import this file DIRECTLY (never the `core/query`
+ * barrel) — the barrel reaches `module.ts`, which imports every
+ * schema; importing it from a schema would create a TDZ cycle.
+ */
+export declare function createFieldsReadGate(gates: Record<string, FieldReadGate>): KeyValidatorMany<QueryDecodeContext | undefined>;
+//# sourceMappingURL=fields.d.ts.map

package/dist/core/query/fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/core/query/fields.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,oBAAoB,EAEpB,gBAAgB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GACpC,gBAAgB,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAoBnD"}

package/dist/core/query/fields.mjs

@@ -0,0 +1,46 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/query/fields.ts
+/**
+* Build a rapiq `fields.validateMany` hook gating individual columns on
+* a per-actor verdict (issue #3322): invoked once per (governing
+* schema, relation path) with every client-requested field, so a gate
+* can compile the actor's permission tree once per query instead of
+* once per field. The batched form matters because the gate applies
+* uniformly at the query ROOT and under any relation path — the
+* position where `ClientPermissionService` & co. serve
+* `include=client&fields[client]=secret` never runs the client
+* service's own read path.
+*
+* Ungated fields accept. Schema defaults never reach the hook, so an
+* unqualified list request costs no evaluation. Caller classes mirror
+* the relations read gate: a SYSTEM decode (no actor in the context)
+* is unrestricted; every REQUEST decode carries an actor (anonymous
+* ones hold no grants). A gate failure fails closed (strip).
+*
+* NOTE: schemas import this file DIRECTLY (never the `core/query`
+* barrel) — the barrel reaches `module.ts`, which imports every
+* schema; importing it from a schema would create a TDZ cycle.
+*/ function createFieldsReadGate(gates) {
+	return async (names, context) => {
+		const record = {};
+		for (const name of names) {
+			const gate = gates[name];
+			if (!gate || !context || !context.actor) {
+				record[name] = true;
+				continue;
+			}
+			try {
+				record[name] = await gate(context.actor);
+			} catch {
+				record[name] = false;
+			}
+		}
+		return record;
+	};
+}
+//#endregion
+export { createFieldsReadGate };
+
+//# sourceMappingURL=fields.mjs.map

package/dist/core/query/fields.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.mjs","names":["createFieldsReadGate","gates","names","context","record","name","gate","actor"],"sources":["../../../src/core/query/fields.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    KeyValidationVerdict,\n    KeyValidationVerdictRecord,\n    KeyValidatorMany,\n} from '@rapiq/core';\nimport type { ActorContext } from '@authup/server-kit';\nimport type { QueryDecodeContext } from './types.ts';\n\n/**\n * Per-field read gate: given the acting identity, answer with a\n * {@link KeyValidationVerdict} for one gated column — `true` to project\n * it, `false` to strip it, or an `ICondition` to project it visible\n * only on rows satisfying the condition (rapiq attaches it to the\n * `Field` node; the repository layer enforces it after the fetch via\n * `redactFieldConditions`).\n *\n * A returned condition must be authored FAIL-CLOSED over incomplete\n * rows: `@rapiq/adapter-memory` unifies a missing column with `null`, so a\n * negative predicate (`not(...)`, `ne(...)`) over an unselected column\n * evaluates true and ships the value. The SQL adapter force-selects\n * every column a condition references (rapiq#830's operand\n * projection), so this is defense in depth — but prefer positive legs\n * (`eq(x, true)`) plus an outer presence guard (`ne('realmId', null)`)\n * over negated trees.\n */\nexport type FieldReadGate = (actor: ActorContext) => Promise<KeyValidationVerdict> | KeyValidationVerdict;\n\n/**\n * Build a rapiq `fields.validateMany` hook gating individual columns on\n * a per-actor verdict (issue #3322): invoked once per (governing\n * schema, relation path) with every client-requested field, so a gate\n * can compile the actor's permission tree once per query instead of\n * once per field. The batched form matters because the gate applies\n * uniformly at the query ROOT and under any relation path — the\n * position where `ClientPermissionService` & co. serve\n * `include=client&fields[client]=secret` never runs the client\n * service's own read path.\n *\n * Ungated fields accept. Schema defaults never reach the hook, so an\n * unqualified list request costs no evaluation. Caller classes mirror\n * the relations read gate: a SYSTEM decode (no actor in the context)\n * is unrestricted; every REQUEST decode carries an actor (anonymous\n * ones hold no grants). A gate failure fails closed (strip).\n *\n * NOTE: schemas import this file DIRECTLY (never the `core/query`\n * barrel) — the barrel reaches `module.ts`, which imports every\n * schema; importing it from a schema would create a TDZ cycle.\n */\nexport function createFieldsReadGate(\n    gates: Record<string, FieldReadGate>,\n) : KeyValidatorMany<QueryDecodeContext | undefined> {\n    return async (names, context) => {\n        const record : KeyValidationVerdictRecord = {};\n\n        for (const name of names) {\n            const gate = gates[name];\n            if (!gate || !context || !context.actor) {\n                record[name] = true;\n                continue;\n            }\n\n            try {\n                record[name] = await gate(context.actor);\n            } catch {\n                record[name] = false;\n            }\n        }\n\n        return record;\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;GAuDA,SAAgBA,qBACZC,OAAoC;CAEpC,OAAO,OAAOC,OAAOC,YAAAA;EACjB,MAAMC,SAAsC,CAAC;EAE7C,KAAK,MAAMC,QAAQH,OAAO;GACtB,MAAMI,OAAOL,MAAMI;GACnB,IAAI,CAACC,QAAQ,CAACH,WAAW,CAACA,QAAQI,OAAO;IACrCH,OAAOC,QAAQ;IACf;GACJ;GAEA,IAAI;IACAD,OAAOC,QAAQ,MAAMC,KAAKH,QAAQI,KAAK;GAC3C,QAAQ;IACJH,OAAOC,QAAQ;GACnB;EACJ;EAEA,OAAOD;CACX;AACJ"}

package/dist/core/query/index.d.ts

@@ -1,3 +1,4 @@
+export * from './describe.ts';
 export * from './module.ts';
 export * from './relations.ts';
 export * from './types.ts';

package/dist/core/query/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/query/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/query/index.ts"],"names":[],"mappings":"AAOA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/core/query/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "./describe.mjs";
 import { createRelationsReadGate } from "./relations.mjs";
 import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./module.mjs";
-export { appendQueryConditions, createRelationsReadGate, decodeQuery, queryCodec, schemaRegistry };
+export { RECORD_QUERY_PARAMETERS, appendQueryConditions, createRelationsReadGate, decodeQuery, describeQuerySchema, queryCodec, schemaRegistry };