@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.58

package/dist/core/identity/password-recovery/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","EntityNotFoundError","ValidationError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","eventService","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realmId","where","name","email","id","entity","findOneByWithEmail","merged","merge","resetExpires","Date","now","toISOString","resetHash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","record","scope","IDENTITY","PASSWORD_RESET_REQUESTED","refType","USER","refId","actorType","actorId","actorName","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","resetAt","PASSWORD_RESET_COMPLETED","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    USER_PASSWORD_MAX_LENGTH,\n    USER_PASSWORD_MIN_LENGTH,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.eventService = ctx.eventService;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realmId: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            resetExpires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            resetHash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realmId MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.resetHash!)}` +\n                `&realmId=${encodeURIComponent(entity.realmId)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.resetHash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                resetHash: null,\n                resetExpires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new ValidationError('Password recovery failed. Could not send reset email.');\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_REQUESTED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n\n        return { resetExpires: merged.resetExpires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            resetHash: validated.token,\n            realmId: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.resetExpires || new Date(entity.resetExpires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            resetAt: new Date().toISOString(),\n            resetHash: null,\n            resetExpires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_COMPLETED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n\n        return { resetAt: merged.resetAt! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realmId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realmId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(\n                z.string()\n                    .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n                    .max(USER_PASSWORD_MAX_LENGTH),\n            ),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,IAAakB,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,uBAAuBE,IAAIF;EAChC,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKT,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQW,0BACd,MAAM,IAAIrB,+BAA+B,sEAAA;EAG7C,MAAMsB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAWqB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMoC,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzCI,cAAc,IAAIC,KACdA,KAAKC,IAAG,IAAM,MAAO,KAAA,EAAK7B,CAAAA,CAC5B8B,YAAW;GACbC,WAAWpC,YAAY,EAAA,CAAA,CAAIqC,SAAS,KAAA;EACxC,CAAA;EAEA,MAAM,KAAK7B,WAAW8B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAKhC,QAAQiC,YAC1B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,SAAS,EAAA,WACjCM,mBAAmBd,OAAOL,OAAO,MAC7CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAU1C,iBAAiB2C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKpC,WAAWuB,MAAMD,QAAQ;IAC1BM,WAAW;IACXJ,cAAc;GAClB,CAAA;GACA,MAAM,KAAKxB,WAAW8B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,MAAM,KAAKiB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUsE;GAChBC,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAES,cAAcF,OAAOE,aAAc;CAChD;CAEA,MAAMiC,cAAclD,MAAyD;EACzE,IAAI,CAAC,KAAKR,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,MAAMuB,YAAY,MAAM,KAAK+C,0BAA0BnD,IAAAA;EAEvD,MAAM,KAAKP,WAAW2D,oBAAoBhD,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,WAAWjB,UAAUiD;GACrB7C,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAW6D,UAAU7C,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,IAAI,CAACkC,OAAOI,gBAAgB,IAAIC,KAAKL,OAAOI,YAAY,oBAAI,IAAIC,KAAAA,GAC5D,MAAM,IAAInC,uBAAAA;EAId,MAAMyE,iBAAiB,MAAMD,IADEnE,uBACFmE,CAAAA,CAAmBE,QAAQrD,UAAUsD,QAAQ;EAE1E,MAAM3C,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzC8C,0BAAS,IAAIzC,KAAAA,EAAAA,CAAOE,YAAW;GAC/BC,WAAW;GACXJ,cAAc;GACdyC,UAAUF;EACd,CAAA;EAEA,MAAM,KAAK/D,WAAW8B,KAAKR,MAAAA;EAE3B,MAAM,KAAKlB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUuF;GAChBhB,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAEmD,SAAS5C,OAAO4C,QAAS;CACtC;CAEA,MAActD,2BAA2BL,MAA2B;EAChE,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI1E,IAAAA;CACzB;CAEA,MAAcmD,0BAA0BnD,MAA2B;EAC/D,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHK,IAAI,KAAK9E,QAAQoF,qBAAqBlG,wBAAAA,CAAAA,CACtCiG,IAAIlG,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOoF,UAAUa,IAAI1E,IAAAA;CACzB;AACJ"}
+{"version":3,"file":"service.mjs","names":["EventName","EventRefType","EventScope","IdentityType","USER_PASSWORD_MAX_LENGTH","USER_PASSWORD_MIN_LENGTH","EntityNotFoundError","ValidationError","PasswordRecoveryDisabledError","EmailVerificationRequiredError","ResetTokenExpiredError","createValidator","randomBytes","Container","z","UserCredentialsService","MailTemplateName","PASSWORD_RESET_EXPIRES_IN_MINUTES","PasswordRecoveryService","options","repository","realmRepository","mailClient","mailTemplateRenderer","eventService","ctx","forgotPassword","data","context","passwordRecoveryEnabled","emailVerificationEnabled","validated","runForgotPasswordValidator","realm","resolve","realmId","where","name","email","id","entity","findOneByWithEmail","merged","merge","resetExpires","Date","now","toISOString","resetHash","toString","save","resetUrl","publicUrl","replace","encodeURIComponent","undefined","mail","render","template","PASSWORD_RESET","params","code","url","expiresInMinutes","locale","send","to","record","scope","IDENTITY","PASSWORD_RESET_REQUESTED","refType","USER","refId","actorType","actorId","actorName","resetPassword","runResetPasswordValidator","validateJoinColumns","token","findOneBy","credentialsService","hashedPassword","protect","password","resetAt","PASSWORD_RESET_COMPLETED","validator","oneOfContainer","oneOf","mount","string","trim","toLowerCase","regex","message","min","optional","uuid","nullable","run","max","passwordMinLength"],"sources":["../../../../src/core/identity/password-recovery/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EventName,\n    EventRefType,\n    EventScope,\n    IdentityType,\n    USER_PASSWORD_MAX_LENGTH,\n    USER_PASSWORD_MIN_LENGTH,\n} from '@authup/core-kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport { PasswordRecoveryDisabledError } from './disabled.ts';\nimport { EmailVerificationRequiredError } from './email-verification-required.ts';\nimport { ResetTokenExpiredError } from './token-expired.ts';\nimport { createValidator } from '@validup/zod';\nimport { randomBytes } from 'node:crypto';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { UserCredentialsService } from '../../authentication/credential/entities/user/module.ts';\nimport type {\n    IPasswordRecoveryService,\n    PasswordForgotResult,\n    PasswordRecoveryServiceContext,\n    PasswordRecoveryServiceOptions,\n    PasswordResetResult,\n} from './types.ts';\nimport type { IMailClient, IMailTemplateRenderer } from '../../mail/types.ts';\nimport { MailTemplateName } from '../../mail/index.ts';\nimport type { IEventService, IRealmRepository, IUserRepository } from '../../entities/index.ts';\nimport type { IdentityWorkflowContext } from '../types.ts';\nimport { PASSWORD_RESET_EXPIRES_IN_MINUTES } from './constants.ts';\n\nexport class PasswordRecoveryService implements IPasswordRecoveryService {\n    protected options: PasswordRecoveryServiceOptions;\n\n    protected repository: IUserRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected mailClient: IMailClient;\n\n    protected mailTemplateRenderer: IMailTemplateRenderer;\n\n    protected eventService?: IEventService;\n\n    constructor(ctx: PasswordRecoveryServiceContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.mailClient = ctx.mailClient;\n        this.mailTemplateRenderer = ctx.mailTemplateRenderer;\n        this.eventService = ctx.eventService;\n    }\n\n    async forgotPassword(data: Record<string, any>, context?: IdentityWorkflowContext): Promise<PasswordForgotResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        if (!this.options.emailVerificationEnabled) {\n            throw new EmailVerificationRequiredError('Email verification is not enabled, but required to reset a password.');\n        }\n\n        const validated = await this.runForgotPasswordValidator(data);\n\n        const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            realmId: realm.id,\n        };\n\n        const entity = await this.repository.findOneByWithEmail(where);\n\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        const merged = this.repository.merge(entity, {\n            resetExpires: new Date(\n                Date.now() + (1000 * 60 * PASSWORD_RESET_EXPIRES_IN_MINUTES),\n            ).toISOString(),\n            resetHash: randomBytes(32).toString('hex'),\n        });\n\n        await this.repository.save(merged);\n\n        try {\n            // realmId MUST ride the link: resetPassword resolves the realm\n            // from the request and filters the lookup by it, so a realm-less\n            // link resolves to the master realm and never matches a\n            // non-master user.\n            const resetUrl = this.options.publicUrl ?\n                `${this.options.publicUrl.replace(/\\/+$/, '')}/password-reset` +\n                `?token=${encodeURIComponent(merged.resetHash!)}` +\n                `&realmId=${encodeURIComponent(entity.realmId)}` :\n                undefined;\n\n            const mail = await this.mailTemplateRenderer.render({\n                template: MailTemplateName.PASSWORD_RESET,\n                params: {\n                    code: merged.resetHash!,\n                    url: resetUrl,\n                    expiresInMinutes: PASSWORD_RESET_EXPIRES_IN_MINUTES,\n                },\n                locale: context?.locale,\n            });\n\n            await this.mailClient.send({\n                to: entity.email,\n                ...mail,\n            });\n        } catch {\n            this.repository.merge(merged, {\n                resetHash: null,\n                resetExpires: null,\n            });\n            await this.repository.save(merged);\n\n            throw new ValidationError('Password recovery failed. Could not send reset email.');\n        }\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_REQUESTED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n\n        return { resetExpires: merged.resetExpires! };\n    }\n\n    async resetPassword(data: Record<string, any>): Promise<PasswordResetResult> {\n        if (!this.options.passwordRecoveryEnabled) {\n            throw new PasswordRecoveryDisabledError();\n        }\n\n        const validated = await this.runResetPasswordValidator(data);\n\n        await this.repository.validateJoinColumns(validated);\n\n        const realm = await this.realmRepository.resolve(validated.realmId, true);\n\n        const where: Record<string, any> = {\n            ...(validated.name ? { name: validated.name } : {}),\n            ...(validated.email ? { email: validated.email } : {}),\n            resetHash: validated.token,\n            realmId: realm.id,\n        };\n\n        const entity = await this.repository.findOneBy(where);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!entity.resetExpires || new Date(entity.resetExpires) < new Date()) {\n            throw new ResetTokenExpiredError();\n        }\n\n        const credentialsService = new UserCredentialsService();\n        const hashedPassword = await credentialsService.protect(validated.password);\n\n        const merged = this.repository.merge(entity, {\n            resetAt: new Date().toISOString(),\n            resetHash: null,\n            resetExpires: null,\n            password: hashedPassword,\n        });\n\n        await this.repository.save(merged);\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.PASSWORD_RESET_COMPLETED,\n            refType: EventRefType.USER,\n            refId: merged.id,\n            actorType: IdentityType.USER,\n            actorId: merged.id,\n            actorName: merged.name,\n            realmId: merged.realmId,\n        });\n\n        return { resetAt: merged.resetAt! };\n    }\n\n    private async runForgotPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realmId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        return validator.run(data);\n    }\n\n    private async runResetPasswordValidator(data: Record<string, any>) {\n        const validator = new Container<any>({});\n\n        const oneOfContainer = new Container({ oneOf: true });\n        oneOfContainer.mount(\n            'email',\n            createValidator(\n                z.string()\n                    .trim()\n                    .toLowerCase()\n                    .email()\n                    .regex(/^[^A-Z]+$/, { message: 'Email must be lowercase.' }),\n            ),\n        );\n        oneOfContainer.mount(\n            'name',\n            createValidator(z.string().trim().toLowerCase().min(1)),\n        );\n\n        validator.mount(oneOfContainer);\n\n        validator.mount(\n            'realmId',\n            { optional: true },\n            createValidator(z.uuid().nullable()),\n        );\n\n        validator.mount(\n            'token',\n            createValidator(z.string().min(3).max(256)),\n        );\n\n        validator.mount(\n            'password',\n            createValidator(\n                z.string()\n                    .min(this.options.passwordMinLength ?? USER_PASSWORD_MIN_LENGTH)\n                    .max(USER_PASSWORD_MAX_LENGTH),\n            ),\n        );\n\n        return validator.run(data);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAqCA,IAAakB,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,UAAUM,IAAIN;EACnB,KAAKC,aAAaK,IAAIL;EACtB,KAAKC,kBAAkBI,IAAIJ;EAC3B,KAAKC,aAAaG,IAAIH;EACtB,KAAKC,uBAAuBE,IAAIF;EAChC,KAAKC,eAAeC,IAAID;CAC5B;CAEA,MAAME,eAAeC,MAA2BC,SAAkE;EAC9G,IAAI,CAAC,KAAKT,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,IAAI,CAAC,KAAKW,QAAQW,0BACd,MAAM,IAAIrB,+BAA+B,sEAAA;EAG7C,MAAMsB,YAAY,MAAM,KAAKC,2BAA2BL,IAAAA;EAExD,MAAMM,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDH,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAWqB,mBAAmBL,KAAAA;EAExD,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,MAAMoC,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzCI,cAAc,IAAIC,KACdA,KAAKC,IAAG,IAAM,IAAY7B,CAAAA,CAC5B8B,YAAW;GACbC,WAAWpC,YAAY,EAAA,CAAA,CAAIqC,SAAS,KAAA;EACxC,CAAA;EAEA,MAAM,KAAK7B,WAAW8B,KAAKR,MAAAA;EAE3B,IAAI;GAKA,MAAMS,WAAW,KAAKhC,QAAQiC,YAC1B,GAAG,KAAKjC,QAAQiC,UAAUC,QAAQ,QAAQ,EAAA,EAAI,wBACpCC,mBAAmBZ,OAAOM,SAAS,EAAA,WACjCM,mBAAmBd,OAAOL,OAAO,MAC7CoB,KAAAA;GAEJ,MAAMC,OAAO,MAAM,KAAKjC,qBAAqBkC,OAAO;IAChDC,UAAU1C,iBAAiB2C;IAC3BC,QAAQ;KACJC,MAAMnB,OAAOM;KACbc,KAAKX;KACLY,kBAAAA;IACJ;IACAC,QAAQpC,SAASoC;GACrB,CAAA;GAEA,MAAM,KAAK1C,WAAW2C,KAAK;IACvBC,IAAI1B,OAAOF;IACX,GAAGkB;GACP,CAAA;EACJ,QAAQ;GACJ,KAAKpC,WAAWuB,MAAMD,QAAQ;IAC1BM,WAAW;IACXJ,cAAc;GAClB,CAAA;GACA,MAAM,KAAKxB,WAAW8B,KAAKR,MAAAA;GAE3B,MAAM,IAAInC,gBAAgB,uDAAA;EAC9B;EAEA,MAAM,KAAKiB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUsE;GAChBC,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAES,cAAcF,OAAOE,aAAc;CAChD;CAEA,MAAMiC,cAAclD,MAAyD;EACzE,IAAI,CAAC,KAAKR,QAAQU,yBACd,MAAM,IAAIrB,8BAAAA;EAGd,MAAMuB,YAAY,MAAM,KAAK+C,0BAA0BnD,IAAAA;EAEvD,MAAM,KAAKP,WAAW2D,oBAAoBhD,SAAAA;EAE1C,MAAME,QAAQ,MAAM,KAAKZ,gBAAgBa,QAAQH,UAAUI,SAAS,IAAA;EAEpE,MAAMC,QAA6B;GAC/B,GAAIL,UAAUM,OAAO,EAAEA,MAAMN,UAAUM,KAAK,IAAI,CAAC;GACjD,GAAIN,UAAUO,QAAQ,EAAEA,OAAOP,UAAUO,MAAM,IAAI,CAAC;GACpDU,WAAWjB,UAAUiD;GACrB7C,SAASF,MAAMM;EACnB;EAEA,MAAMC,SAAS,MAAM,KAAKpB,WAAW6D,UAAU7C,KAAAA;EAC/C,IAAI,CAACI,QACD,MAAM,IAAIlC,oBAAAA;EAGd,IAAI,CAACkC,OAAOI,gBAAgB,IAAIC,KAAKL,OAAOI,YAAY,oBAAI,IAAIC,KAAAA,GAC5D,MAAM,IAAInC,uBAAAA;EAId,MAAMyE,iBAAiB,MAAMD,IADEnE,uBACFmE,CAAAA,CAAmBE,QAAQrD,UAAUsD,QAAQ;EAE1E,MAAM3C,SAAS,KAAKtB,WAAWuB,MAAMH,QAAQ;GACzC8C,0BAAS,IAAIzC,KAAAA,EAAAA,CAAOE,YAAW;GAC/BC,WAAW;GACXJ,cAAc;GACdyC,UAAUF;EACd,CAAA;EAEA,MAAM,KAAK/D,WAAW8B,KAAKR,MAAAA;EAE3B,MAAM,KAAKlB,cAAc2C,OAAO;GAC5BC,OAAOlE,WAAWmE;GAClBhC,MAAMrC,UAAUuF;GAChBhB,SAAStE,aAAauE;GACtBC,OAAO/B,OAAOH;GACdmC,WAAWvE,aAAaqE;GACxBG,SAASjC,OAAOH;GAChBqC,WAAWlC,OAAOL;GAClBF,SAASO,OAAOP;EACpB,CAAA;EAEA,OAAO,EAAEmD,SAAS5C,OAAO4C,QAAS;CACtC;CAEA,MAActD,2BAA2BL,MAA2B;EAChE,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EAEnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAItEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrC,OAAOZ,UAAUa,IAAI1E,IAAAA;CACzB;CAEA,MAAcmD,0BAA0BnD,MAA2B;EAC/D,MAAM6D,YAAY,IAAI3E,UAAe,CAAC,CAAA;EAEtC,MAAM4E,iBAAiB,IAAI5E,UAAU,EAAE6E,OAAO,KAAK,CAAA;EACnDD,eAAeE,MACX,SACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHC,KAAI,CAAA,CACJC,YAAW,CAAA,CACXxD,MAAK,CAAA,CACLyD,MAAM,aAAa,EAAEC,SAAS,2BAA2B,CAAA,CAAA,CAAA;EAGtEP,eAAeE,MACX,QACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGC,KAAI,CAAA,CAAGC,YAAW,CAAA,CAAGG,IAAI,CAAA,CAAA,CAAA;EAGxDT,UAAUG,MAAMF,cAAAA;EAEhBD,UAAUG,MACN,WACA,EAAEO,UAAU,KAAK,GACjBvF,gBAAgBG,EAAEqF,KAAI,CAAA,CAAGC,SAAQ,CAAA,CAAA;EAGrCZ,UAAUG,MACN,SACAhF,gBAAgBG,EAAE8E,OAAM,CAAA,CAAGK,IAAI,CAAA,CAAA,CAAGK,IAAI,GAAA,CAAA,CAAA;EAG1Cd,UAAUG,MACN,YACAhF,gBACIG,EAAE8E,OAAM,CAAA,CACHK,IAAI,KAAK9E,QAAQoF,qBAAqBlG,wBAAAA,CAAAA,CACtCiG,IAAIlG,wBAAAA,CAAAA,CAAAA;EAIjB,OAAOoF,UAAUa,IAAI1E,IAAAA;CACzB;AACJ"}

package/dist/core/identity/registration/check.mjs

@@ -2,10 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { REGISTRATION_DISABLED_ERROR_INSTANCE } from "./error.mjs";
-import { ErrorCode, hasInstanceof, isAuthupError } from "@authup/errors";
+import { ErrorCode, isAuthupError, matchesInstanceof } from "@authup/errors";
 //#region src/core/identity/registration/check.ts
 function isRegistrationDisabledError(input) {
-	if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;
+	if (matchesInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;
 	if (!isAuthupError(input)) return false;
 	return input.code === ErrorCode.REGISTRATION_DISABLED;
 }

package/dist/core/identity/registration/check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"check.mjs","names":["ErrorCode","hasInstanceof","isAuthupError","REGISTRATION_DISABLED_ERROR_INSTANCE","isRegistrationDisabledError","input","code","REGISTRATION_DISABLED"],"sources":["../../../../src/core/identity/registration/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, hasInstanceof, isAuthupError } from '@authup/errors';\nimport { REGISTRATION_DISABLED_ERROR_INSTANCE, type RegistrationDisabledError } from './error.ts';\n\nexport function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError {\n    if (hasInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.REGISTRATION_DISABLED;\n}\n"],"mappings":";;;;;;AAUA,SAAgBI,4BAA4BC,OAAc;CACtD,IAAIJ,cAAcI,OAAOF,oCAAAA,GAAuC,OAAO;CACvE,IAAI,CAACD,cAAcG,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASN,UAAUO;AACpC"}
+{"version":3,"file":"check.mjs","names":["ErrorCode","isAuthupError","matchesInstanceof","REGISTRATION_DISABLED_ERROR_INSTANCE","isRegistrationDisabledError","input","code","REGISTRATION_DISABLED"],"sources":["../../../../src/core/identity/registration/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ErrorCode, isAuthupError, matchesInstanceof } from '@authup/errors';\nimport { REGISTRATION_DISABLED_ERROR_INSTANCE, type RegistrationDisabledError } from './error.ts';\n\nexport function isRegistrationDisabledError(input: unknown): input is RegistrationDisabledError {\n    if (matchesInstanceof(input, REGISTRATION_DISABLED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.REGISTRATION_DISABLED;\n}\n"],"mappings":";;;;;;AAUA,SAAgBI,4BAA4BC,OAAc;CACtD,IAAIH,kBAAkBG,OAAOF,oCAAAA,GAAuC,OAAO;CAC3E,IAAI,CAACF,cAAcI,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMC,SAASN,UAAUO;AACpC"}

package/dist/core/index.mjs

@@ -7,6 +7,7 @@ import { UserCredentialsService } from "./authentication/credential/entities/use
 import { BaseCredentialsAuthenticator } from "./authentication/base.mjs";
 import { ClientAuthenticator } from "./authentication/entities/client/module.mjs";
 import { UserAuthenticator } from "./authentication/entities/user/module.mjs";
+import { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./entities/event/constants.mjs";
 import { LoginThrottleService } from "./authentication/login-throttle/service.mjs";
 import { CredentialsAuthenticator } from "./authentication/module.mjs";
 import { SessionManager } from "./authentication/session/module.mjs";
@@ -14,6 +15,8 @@ import { SESSION_FILTER_KEYS } from "./authentication/session/types.mjs";
 import "./authentication/index.mjs";
 import { ClientCertificateValidator, assertClientCertificateEvidenceValidForBinding, buildClientCertificateThumbprint, parseClientCertificateChain } from "./client-certificate/module.mjs";
 import "./client-certificate/index.mjs";
+import { CLIENT_READ_PERMISSIONS } from "./entities/client/constants.mjs";
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "./query/describe.mjs";
 import { createRelationsReadGate } from "./query/relations.mjs";
 import { clientSchema } from "./entities/client/schema.mjs";
 import { clientPermissionSchema } from "./entities/client-permission/schema.mjs";
@@ -42,13 +45,12 @@ import { userRoleSchema } from "./entities/user-role/schema.mjs";
 import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./query/module.mjs";
 import "./query/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
-import { WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
+import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./identity/permission/junction-grant.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
 import { ClientScopeService } from "./entities/client-scope/service.mjs";
 import { ConsentService } from "./entities/consent/service.mjs";
-import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./entities/event/constants.mjs";
 import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./entities/event/diff.mjs";
 import { EntityEventHandler } from "./entities/event/entity-event-handler.mjs";
 import { sanitizeEventData } from "./entities/event/sanitize.mjs";
@@ -173,4 +175,4 @@ import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, eventSchema, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WEB_CLIENT_SCOPE_NAMES, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/key/check.mjs

@@ -2,10 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { REALM_CIPHER_BLOB_ERROR_INSTANCE } from "./error.mjs";
-import { hasInstanceof } from "@authup/errors";
+import { matchesInstanceof } from "@authup/errors";
 //#region src/core/key/check.ts
 function isRealmCipherBlobError(input) {
-	return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);
+	return matchesInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);
 }
 //#endregion
 export { isRealmCipherBlobError };

package/dist/core/key/check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"check.mjs","names":["hasInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","isRealmCipherBlobError","input"],"sources":["../../../src/core/key/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { hasInstanceof } from '@authup/errors';\nimport { REALM_CIPHER_BLOB_ERROR_INSTANCE, type RealmCipherBlobError } from './error.ts';\n\nexport function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError {\n    return hasInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;;AAUA,SAAgBE,uBAAuBC,OAAc;CACjD,OAAOH,cAAcG,OAAOF,gCAAAA;AAChC"}
+{"version":3,"file":"check.mjs","names":["matchesInstanceof","REALM_CIPHER_BLOB_ERROR_INSTANCE","isRealmCipherBlobError","input"],"sources":["../../../src/core/key/check.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { matchesInstanceof } from '@authup/errors';\nimport { REALM_CIPHER_BLOB_ERROR_INSTANCE, type RealmCipherBlobError } from './error.ts';\n\nexport function isRealmCipherBlobError(input: unknown): input is RealmCipherBlobError {\n    return matchesInstanceof(input, REALM_CIPHER_BLOB_ERROR_INSTANCE);\n}\n"],"mappings":";;;;;;AAUA,SAAgBE,uBAAuBC,OAAc;CACjD,OAAOH,kBAAkBG,OAAOF,gCAAAA;AACpC"}

package/dist/core/provisioning/entities/client/relations-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAKpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CAkCvB"}
+{"version":3,"file":"relations-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAKpC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IAC5F,SAAS,CAAC,UAAU;CA0CvB"}

package/dist/core/provisioning/entities/client/relations-validator.mjs

@@ -21,6 +21,8 @@ var ClientProvisioningRelationsValidator = class extends Container {
 		this.mount("roles", { optional: true }, createValidator(z.array(z.any()).check(createProvisioningEntitiesValidator(roleValidator))));
 		this.mount("realmRoles", { optional: true }, createValidator(z.array(z.string())));
 		this.mount("globalRoles", { optional: true }, createValidator(z.array(z.string())));
+		this.mount("realmScopes", { optional: true }, createValidator(z.array(z.string())));
+		this.mount("globalScopes", { optional: true }, createValidator(z.array(z.string())));
 	}
 };
 //#endregion

package/dist/core/provisioning/entities/client/relations-validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningValidator","RoleProvisioningValidator","createProvisioningEntitiesValidator","ClientProvisioningRelationsValidator","initialize","permissionValidator","roleValidator","mount","optional","array","any","check","string"],"sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { ClientProvisioningRelations } from './types.ts';\n\nexport class ClientProvisioningRelationsValidator extends Container<ClientProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const permissionValidator = new PermissionProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n\n        this.mount('permissions', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(permissionValidator)),\n        ));\n\n        this.mount('realmPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('roles', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(roleValidator)),\n        ));\n\n        this.mount('realmRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAaM,uCAAb,cAA0DL,UAAAA;CAC5CM,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,sBAAsB,IAAIL,gCAAAA;EAChC,MAAMM,gBAAgB,IAAIL,0BAAAA;EAE1B,KAAKM,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCG,mBAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKE,MAAM,oBAAoB,EAAEC,UAAU,KAAK,GAAGX,gBAC/CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,qBAAqB,EAAEC,UAAU,KAAK,GAAGX,gBAChDE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGX,gBACpCE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCI,aAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKC,MAAM,cAAc,EAAEC,UAAU,KAAK,GAAGX,gBACzCE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;CAExB;AACJ"}
+{"version":3,"file":"relations-validator.mjs","names":["createValidator","Container","z","PermissionProvisioningValidator","RoleProvisioningValidator","createProvisioningEntitiesValidator","ClientProvisioningRelationsValidator","initialize","permissionValidator","roleValidator","mount","optional","array","any","check","string"],"sources":["../../../../../src/core/provisioning/entities/client/relations-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createValidator } from '@validup/zod';\nimport { Container } from 'validup';\nimport { z } from 'zod';\nimport { PermissionProvisioningValidator } from '../permission/index.ts';\nimport { RoleProvisioningValidator } from '../role/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { ClientProvisioningRelations } from './types.ts';\n\nexport class ClientProvisioningRelationsValidator extends Container<ClientProvisioningRelations> {\n    protected initialize() {\n        super.initialize();\n\n        const permissionValidator = new PermissionProvisioningValidator();\n        const roleValidator = new RoleProvisioningValidator();\n\n        this.mount('permissions', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(permissionValidator)),\n        ));\n\n        this.mount('realmPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalPermissions', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('roles', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(roleValidator)),\n        ));\n\n        this.mount('realmRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalRoles', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('realmScopes', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n\n        this.mount('globalScopes', { optional: true }, createValidator(\n            z.array(z.string()),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAaM,uCAAb,cAA0DL,UAAAA;CAC5CM,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,sBAAsB,IAAIL,gCAAAA;EAChC,MAAMM,gBAAgB,IAAIL,0BAAAA;EAE1B,KAAKM,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCG,mBAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKE,MAAM,oBAAoB,EAAEC,UAAU,KAAK,GAAGX,gBAC/CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,qBAAqB,EAAEC,UAAU,KAAK,GAAGX,gBAChDE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,SAAS,EAAEC,UAAU,KAAK,GAAGX,gBACpCE,EACKU,MAAMV,EAAEW,IAAG,CAAA,CAAA,CACXC,MAAMT,oCAAoCI,aAAAA,CAAAA,CAAAA,CAAAA;EAGnD,KAAKC,MAAM,cAAc,EAAEC,UAAU,KAAK,GAAGX,gBACzCE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,eAAe,EAAEC,UAAU,KAAK,GAAGX,gBAC1CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;EAGpB,KAAKL,MAAM,gBAAgB,EAAEC,UAAU,KAAK,GAAGX,gBAC3CE,EAAEU,MAAMV,EAAEa,OAAM,CAAA,CAAA,CAAA;CAExB;AACJ"}

package/dist/core/provisioning/entities/client/types.d.ts

@@ -27,6 +27,14 @@ export type ClientProvisioningRelations = {
      * Assign client to global roles.
      */
     globalRoles?: string[];
+    /**
+     * Assign client to scopes of same realm.
+     */
+    realmScopes?: string[];
+    /**
+     * Assign client to global scopes.
+     */
+    globalScopes?: string[];
 };
 export type ClientProvisioningEntity = BaseProvisioningEntity<Client> & {
     attributes: Partial<Client>;

package/dist/core/provisioning/entities/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAE7C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAI7B;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAE1B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG;IACpE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5B,SAAS,CAAC,EAAE,2BAA2B,CAAA;CAC1C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/client/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAE7C;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAI7B;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAEjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAIvB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CAE3B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG;IACpE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5B,SAAS,CAAC,EAAE,2BAA2B,CAAA;CAC1C,CAAC"}

package/dist/core/provisioning/synchronizer/client/module.d.ts

@@ -1,4 +1,4 @@
-import type { ClientPermission, ClientRole, Permission, Role } from '@authup/core-kit';
+import type { ClientPermission, ClientRole, ClientScope, Permission, Role, Scope } from '@authup/core-kit';
 import type { IClientRepository } from '../../../entities/index.ts';
 import type { ClientProvisioningEntity } from '../../entities/client';
 import type { PermissionProvisioningEntity } from '../../entities/permission';
@@ -12,8 +12,10 @@ export declare class ClientProvisioningSynchronizer extends BaseProvisioningSync
     protected clientRepository: IClientRepository;
     protected permissionResolver: ProvisioningEntityResolver<Permission>;
     protected roleResolver: ProvisioningEntityResolver<Role>;
+    protected scopeResolver: ProvisioningEntityResolver<Scope>;
     protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;
     protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;
+    protected scopeJunction: ProvisioningJunctionSynchronizer<ClientScope>;
     protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
     protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
     constructor(ctx: ClientProvisioningSynchronizerContext);

package/dist/core/provisioning/synchronizer/client/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,IAAI,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEjF,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;gBAElE,GAAG,EAAE,qCAAqC;IAuBhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CA+GxF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,UAAU,EACV,IAAI,EACJ,KAAK,EACR,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,8BAA+B,SAAQ,4BAA4B,CAAC,wBAAwB,CAAC;IACtG,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEzD,SAAS,CAAC,aAAa,EAAE,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAE3D,SAAS,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,gBAAgB,CAAC,CAAC;IAEjF,SAAS,CAAC,YAAY,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErE,SAAS,CAAC,aAAa,EAAE,gCAAgC,CAAC,WAAW,CAAC,CAAC;IAEvE,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;gBAElE,GAAG,EAAE,qCAAqC;IA6BhD,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAsIxF"}

package/dist/core/provisioning/synchronizer/client/module.mjs

@@ -13,8 +13,10 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 	clientRepository;
 	permissionResolver;
 	roleResolver;
+	scopeResolver;
 	permissionJunction;
 	roleJunction;
+	scopeJunction;
 	permissionSynchronizer;
 	roleSynchronizer;
 	constructor(ctx) {
@@ -22,6 +24,7 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 		this.clientRepository = ctx.clientRepository;
 		this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);
 		this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);
+		this.scopeResolver = new ProvisioningEntityResolver(ctx.scopeRepository, { clientScoped: false });
 		this.permissionJunction = new ProvisioningJunctionSynchronizer({
 			repository: ctx.clientPermissionRepository,
 			ownerKey: "clientId",
@@ -32,6 +35,11 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 			ownerKey: "clientId",
 			ownerRealmKey: "clientRealmId"
 		});
+		this.scopeJunction = new ProvisioningJunctionSynchronizer({
+			repository: ctx.clientScopeRepository,
+			ownerKey: "clientId",
+			ownerRealmKey: "clientRealmId"
+		});
 		this.permissionSynchronizer = ctx.permissionSynchronizer;
 		this.roleSynchronizer = ctx.roleSynchronizer;
 	}
@@ -57,13 +65,14 @@ var ClientProvisioningSynchronizer = class extends BaseProvisioningSynchronizer
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));
 		const permissions = [...await this.permissionResolver.resolveGlobal(input.relations && input.relations.globalPermissions), ...attributes.realmId ? await this.permissionResolver.resolveRealm(input.relations && input.relations.realmPermissions, attributes.realmId) : []];
 		if (permissions.length > 0) await this.permissionJunction.synchronize(attributes, permissions, "permissionId", "permissionRealmId");
 		const roles = [...await this.roleResolver.resolveGlobal(input.relations && input.relations.globalRoles), ...attributes.realmId ? await this.roleResolver.resolveRealm(input.relations && input.relations.realmRoles, attributes.realmId) : []];
 		if (roles.length > 0) await this.roleJunction.synchronize(attributes, roles, "roleId", "roleRealmId");
+		const scopes = [...await this.scopeResolver.resolveGlobal(input.relations && input.relations.globalScopes), ...attributes.realmId ? await this.scopeResolver.resolveRealm(input.relations && input.relations.realmScopes, attributes.realmId) : []];
+		if (scopes.length > 0) await this.scopeJunction.synchronize(attributes, scopes, "scopeId", "scopeRealmId");
 		if (input.relations && input.relations.permissions) {
 			const children = input.relations.permissions.map((child) => {
 				child.attributes.clientId = attributes.id;

package/dist/core/provisioning/synchronizer/client/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","children","map","child","clientId","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission, \n    ClientRole, \n    Permission, \n    Role,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AAyBA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKP,mBAAmBO,IAAIP;EAE5B,KAAKC,qBAAqB,IAAIJ,2BAA2BU,IAAIC,oBAAoB;EACjF,KAAKN,eAAe,IAAIL,2BAA2BU,IAAIE,cAAc;EAErE,KAAKN,qBAAqB,IAAIL,iCAAiC;GAC3DY,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKT,eAAe,IAAIN,iCAAiC;GACrDY,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;EAEA,KAAKR,yBAAyBE,IAAIF;EAClC,KAAKC,mBAAmBC,IAAID;CAChC;CAEA,MAAMS,YAAYC,OAAoE;EAClF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWxB,oCAAoCqB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKlB,iBAAiBoB,UAAU;GACnDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS7B,+BAA+B8B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKlB,iBAAiByB,OAAOP,UAAAA;GAEvC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK7B,+BAA+BgC;IAChCR,aAAa,KAAKlB,iBAAiB2B,MAC/BT,YACAC,SAASD,aACLzB,WAAWuB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAExBA,aAAa,MAAM,KAAKlB,iBAAiB4B,KAAKV,UAAAA;IAC9C;GACJ,KAAKxB,+BAA+BmC;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKlB,iBAAiB4B,KAAK,KAAK5B,iBAAiB+B,OAAOf,MAAME,UAAU,CAAA;IAC3F;EACR;OAEAA,aAAa,MAAM,KAAKlB,iBAAiB4B,KAAK,KAAK5B,iBAAiB+B,OAAOf,MAAME,UAAU,CAAA;EAI/F,MAAMc,cAAc,CACb,GAAA,MAAM,KAAK/B,mBAAmBgC,cAC7BjB,MAAMkB,aAAalB,MAAMkB,UAAUC,iBAAiB,GAEpDjB,GAAAA,WAAWI,UACX,MAAM,KAAKrB,mBAAmBmC,aAC1BpB,MAAMkB,aAAalB,MAAMkB,UAAUG,kBACnCnB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKnC,mBAAmBY,YAC1BG,YACAc,aACA,gBACA,mBAAA;EAKR,MAAMO,QAAQ,CACP,GAAA,MAAM,KAAKrC,aAAa+B,cACvBjB,MAAMkB,aAAalB,MAAMkB,UAAUM,WAAW,GAE9CtB,GAAAA,WAAWI,UACX,MAAM,KAAKpB,aAAakC,aACpBpB,MAAMkB,aAAalB,MAAMkB,UAAUO,YACnCvB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKlC,aAAaW,YACpBG,YACAqB,OACA,UACA,aAAA;EAMR,IAAIvB,MAAMkB,aAAalB,MAAMkB,UAAUF,aAAa;GAChD,MAAMU,WAAW1B,MAAMkB,UAAUF,YAAYW,KAAKC,UAAAA;IAC9CA,MAAM1B,WAAW2B,WAAW3B,WAAWY;IACvCc,MAAM1B,WAAW4B,SAAS5B;IAC1B,OAAO0B;GACX,CAAA;GAEA,MAAM,KAAKvC,uBAAuB0C,gBAAgBL,QAAAA;EACtD;EAEA,IAAI1B,MAAMkB,aAAalB,MAAMkB,UAAUK,OAAO;GAC1C,MAAMG,WAAW1B,MAAMkB,UAAUK,MAAMI,KAAKC,UAAAA;IACxCA,MAAM1B,WAAW2B,WAAW3B,WAAWY;IACvCc,MAAM1B,WAAW4B,SAAS5B;IAC1B,OAAO0B;GACX,CAAA;GAEA,MAAM,KAAKtC,iBAAiByC,gBAAgBL,QAAAA;EAChD;EAEA,OAAO;GACH,GAAG1B;GACHE;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","ClientProvisioningSynchronizer","clientRepository","permissionResolver","roleResolver","scopeResolver","permissionJunction","roleJunction","scopeJunction","permissionSynchronizer","roleSynchronizer","ctx","permissionRepository","roleRepository","scopeRepository","clientScoped","repository","clientPermissionRepository","ownerKey","ownerRealmKey","clientRoleRepository","clientScopeRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","length","roles","globalRoles","realmRoles","scopes","globalScopes","realmScopes","children","map","child","clientId","client","synchronizeMany"],"sources":["../../../../../src/core/provisioning/synchronizer/client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    Permission,\n    Role,\n    Scope,\n} from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type { IClientRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity } from '../../entities/client';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport type { RoleProvisioningEntity } from '../../entities/role';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { ClientProvisioningSynchronizerContext } from './types.ts';\n\nexport class ClientProvisioningSynchronizer extends BaseProvisioningSynchronizer<ClientProvisioningEntity> {\n    protected clientRepository: IClientRepository;\n\n    protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n    protected roleResolver: ProvisioningEntityResolver<Role>;\n\n    protected scopeResolver: ProvisioningEntityResolver<Scope>;\n\n    protected permissionJunction: ProvisioningJunctionSynchronizer<ClientPermission>;\n\n    protected roleJunction: ProvisioningJunctionSynchronizer<ClientRole>;\n\n    protected scopeJunction: ProvisioningJunctionSynchronizer<ClientScope>;\n\n    protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n    protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n    constructor(ctx: ClientProvisioningSynchronizerContext) {\n        super();\n\n        this.clientRepository = ctx.clientRepository;\n\n        this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n        this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n        this.scopeResolver = new ProvisioningEntityResolver(ctx.scopeRepository, { clientScoped: false });\n\n        this.permissionJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientPermissionRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.roleJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientRoleRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n        this.scopeJunction = new ProvisioningJunctionSynchronizer({\n            repository: ctx.clientScopeRepository,\n            ownerKey: 'clientId',\n            ownerRealmKey: 'clientRealmId',\n        });\n\n        this.permissionSynchronizer = ctx.permissionSynchronizer;\n        this.roleSynchronizer = ctx.roleSynchronizer;\n    }\n\n    async synchronize(input: ClientProvisioningEntity): Promise<ClientProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.clientRepository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.clientRepository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes, \n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.clientRepository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n                    attributes = await this.clientRepository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.clientRepository.save(this.clientRepository.create(input.attributes));\n        }\n\n        // Permissions (Global + Realm)\n        const permissions = [\n            ...await this.permissionResolver.resolveGlobal(\n                input.relations && input.relations.globalPermissions,\n            ),\n            ...(attributes.realmId ?\n                await this.permissionResolver.resolveRealm(\n                    input.relations && input.relations.realmPermissions,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (permissions.length > 0) {\n            await this.permissionJunction.synchronize(\n                attributes,\n                permissions,\n                'permissionId',\n                'permissionRealmId',\n            );\n        }\n\n        // Roles (Global + Realm)\n        const roles = [\n            ...await this.roleResolver.resolveGlobal(\n                input.relations && input.relations.globalRoles,\n            ),\n            ...(attributes.realmId ?\n                await this.roleResolver.resolveRealm(\n                    input.relations && input.relations.realmRoles,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (roles.length > 0) {\n            await this.roleJunction.synchronize(\n                attributes,\n                roles,\n                'roleId',\n                'roleRealmId',\n            );\n        }\n\n        // Scopes (Global + Realm). The junction is the only source the\n        // /authorize code-request verifier reads scopes from.\n        const scopes = [\n            ...await this.scopeResolver.resolveGlobal(\n                input.relations && input.relations.globalScopes,\n            ),\n            ...(attributes.realmId ?\n                await this.scopeResolver.resolveRealm(\n                    input.relations && input.relations.realmScopes,\n                    attributes.realmId,\n                ) :\n                []),\n        ];\n\n        if (scopes.length > 0) {\n            await this.scopeJunction.synchronize(\n                attributes,\n                scopes,\n                'scopeId',\n                'scopeRealmId',\n            );\n        }\n\n        // Containers\n\n        if (input.relations && input.relations.permissions) {\n            const children = input.relations.permissions.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.permissionSynchronizer.synchronizeMany(children);\n        }\n\n        if (input.relations && input.relations.roles) {\n            const children = input.relations.roles.map((child) => {\n                child.attributes.clientId = attributes.id;\n                child.attributes.client = attributes;\n                return child;\n            });\n\n            await this.roleSynchronizer.synchronizeMany(children);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;AA2BA,IAAaM,iCAAb,cAAoDH,6BAAAA;CACtCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EAEL,KAAKT,mBAAmBS,IAAIT;EAE5B,KAAKC,qBAAqB,IAAIJ,2BAA2BY,IAAIC,oBAAoB;EACjF,KAAKR,eAAe,IAAIL,2BAA2BY,IAAIE,cAAc;EACrE,KAAKR,gBAAgB,IAAIN,2BAA2BY,IAAIG,iBAAiB,EAAEC,cAAc,MAAM,CAAA;EAE/F,KAAKT,qBAAqB,IAAIN,iCAAiC;GAC3DgB,YAAYL,IAAIM;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKZ,eAAe,IAAIP,iCAAiC;GACrDgB,YAAYL,IAAIS;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKX,gBAAgB,IAAIR,iCAAiC;GACtDgB,YAAYL,IAAIU;GAChBH,UAAU;GACVC,eAAe;EACnB,CAAA;EAEA,KAAKV,yBAAyBE,IAAIF;EAClC,KAAKC,mBAAmBC,IAAID;CAChC;CAEA,MAAMY,YAAYC,OAAoE;EAClF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAW7B,oCAAoC0B,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKvB,iBAAiByB,UAAU;GACnDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASlC,+BAA+BmC,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKvB,iBAAiB8B,OAAOP,UAAAA;GAEvC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKlC,+BAA+BqC;IAChCR,aAAa,KAAKvB,iBAAiBgC,MAC/BT,YACAC,SAASD,aACL9B,WAAW4B,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAExBA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAKV,UAAAA;IAC9C;GACJ,KAAK7B,+BAA+BwC;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;EAEnG;OAEAA,aAAa,MAAM,KAAKvB,iBAAiBiC,KAAK,KAAKjC,iBAAiBoC,OAAOf,MAAME,UAAU,CAAA;EAI/F,MAAMc,cAAc,CACb,GAAA,MAAM,KAAKpC,mBAAmBqC,cAC7BjB,MAAMkB,aAAalB,MAAMkB,UAAUC,iBAAiB,GAEpDjB,GAAAA,WAAWI,UACX,MAAM,KAAK1B,mBAAmBwC,aAC1BpB,MAAMkB,aAAalB,MAAMkB,UAAUG,kBACnCnB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIU,YAAYM,SAAS,GACrB,MAAM,KAAKvC,mBAAmBgB,YAC1BG,YACAc,aACA,gBACA,mBAAA;EAKR,MAAMO,QAAQ,CACP,GAAA,MAAM,KAAK1C,aAAaoC,cACvBjB,MAAMkB,aAAalB,MAAMkB,UAAUM,WAAW,GAE9CtB,GAAAA,WAAWI,UACX,MAAM,KAAKzB,aAAauC,aACpBpB,MAAMkB,aAAalB,MAAMkB,UAAUO,YACnCvB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIiB,MAAMD,SAAS,GACf,MAAM,KAAKtC,aAAae,YACpBG,YACAqB,OACA,UACA,aAAA;EAMR,MAAMG,SAAS,CACR,GAAA,MAAM,KAAK5C,cAAcmC,cACxBjB,MAAMkB,aAAalB,MAAMkB,UAAUS,YAAY,GAE/CzB,GAAAA,WAAWI,UACX,MAAM,KAAKxB,cAAcsC,aACrBpB,MAAMkB,aAAalB,MAAMkB,UAAUU,aACnC1B,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIoB,OAAOJ,SAAS,GAChB,MAAM,KAAKrC,cAAcc,YACrBG,YACAwB,QACA,WACA,cAAA;EAMR,IAAI1B,MAAMkB,aAAalB,MAAMkB,UAAUF,aAAa;GAChD,MAAMa,WAAW7B,MAAMkB,UAAUF,YAAYc,KAAKC,UAAAA;IAC9CA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK7C,uBAAuBgD,gBAAgBL,QAAAA;EACtD;EAEA,IAAI7B,MAAMkB,aAAalB,MAAMkB,UAAUK,OAAO;GAC1C,MAAMM,WAAW7B,MAAMkB,UAAUK,MAAMO,KAAKC,UAAAA;IACxCA,MAAM7B,WAAW8B,WAAW9B,WAAWY;IACvCiB,MAAM7B,WAAW+B,SAAS/B;IAC1B,OAAO6B;GACX,CAAA;GAEA,MAAM,KAAK5C,iBAAiB+C,gBAAgBL,QAAAA;EAChD;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/client/types.d.ts

@@ -1,4 +1,4 @@
-import type { IClientPermissionRepository, IClientRepository, IClientRoleRepository, IPermissionRepository, IRoleRepository } from '../../../entities/index.ts';
+import type { IClientPermissionRepository, IClientRepository, IClientRoleRepository, IClientScopeRepository, IPermissionRepository, IRoleRepository, IScopeRepository } from '../../../entities/index.ts';
 import type { PermissionProvisioningEntity } from '../../entities/permission';
 import type { RoleProvisioningEntity } from '../../entities/role';
 import type { IProvisioningSynchronizer } from '../../types.ts';
@@ -6,8 +6,10 @@ export type ClientProvisioningSynchronizerContext = {
     clientRepository: IClientRepository;
     clientRoleRepository: IClientRoleRepository;
     clientPermissionRepository: IClientPermissionRepository;
+    clientScopeRepository: IClientScopeRepository;
     roleRepository: IRoleRepository;
     permissionRepository: IPermissionRepository;
+    scopeRepository: IScopeRepository;
     roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;
     permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;
 };

package/dist/core/provisioning/synchronizer/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IAExD,cAAc,EAAE,eAAe,CAAC;IAChC,oBAAoB,EAAE,qBAAqB,CAAC;IAE5C,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;CACnF,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,MAAM,qCAAqC,GAAG;IAChD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,0BAA0B,EAAE,2BAA2B,CAAC;IACxD,qBAAqB,EAAE,sBAAsB,CAAC;IAE9C,cAAc,EAAE,eAAe,CAAC;IAChC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,eAAe,EAAE,gBAAgB,CAAC;IAElC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IACpE,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;CACnF,CAAC"}

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts

@@ -1,10 +1,13 @@
 import type { ObjectLiteral } from '@authup/kit';
 import type { IEntityRepository } from '@authup/server-kit';
+import type { ProvisioningEntityResolverOptions } from './types.ts';
 export declare class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {
     protected repository: IEntityRepository<T>;
-    constructor(repository: IEntityRepository<T>);
+    protected clientScoped: boolean;
+    constructor(repository: IEntityRepository<T>, options?: ProvisioningEntityResolverOptions);
     resolveGlobal(names?: string[]): Promise<T[]>;
     resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]>;
     resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]>;
+    protected resolve(names: string[] | undefined, where: Record<string, any>, clientId?: string | null): Promise<T[]>;
 }
 //# sourceMappingURL=entity-resolver.d.ts.map

package/dist/core/provisioning/synchronizer/entity-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,qBAAa,0BAA0B,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC3E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAE/B,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAItC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAsB7C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAsBxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;CAqBpG"}
+{"version":3,"file":"entity-resolver.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEpE,qBAAa,0BAA0B,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IAC3E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC;gBAEpB,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,iCAAsC;IAKvF,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAI7C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIxE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;cAIjF,OAAO,CACnB,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,QAAQ,GAAE,MAAM,GAAG,IAAW,GAC/B,OAAO,CAAC,CAAC,EAAE,CAAC;CA0BlB"}

package/dist/core/provisioning/synchronizer/entity-resolver.mjs

@@ -4,46 +4,31 @@ import.meta.url;
 //#region src/core/provisioning/synchronizer/entity-resolver.ts
 var ProvisioningEntityResolver = class {
 	repository;
-	constructor(repository) {
+	clientScoped;
+	constructor(repository, options = {}) {
 		this.repository = repository;
+		this.clientScoped = options.clientScoped ?? true;
 	}
 	async resolveGlobal(names) {
-		if (!names || names.length === 0) return [];
-		names = names.map((name) => name.trim().toLowerCase());
-		if (names.includes("*")) return this.repository.findManyBy({
-			realmId: null,
-			clientId: null
-		});
-		return this.repository.findManyBy({
-			name: names,
-			realmId: null,
-			clientId: null
-		});
+		return this.resolve(names, { realmId: null });
 	}
 	async resolveRealm(names, realmId) {
-		if (!names || names.length === 0) return [];
-		names = names.map((name) => name.trim().toLowerCase());
-		if (names.includes("*")) return this.repository.findManyBy({
-			realmId,
-			clientId: null
-		});
-		return this.repository.findManyBy({
-			name: names,
-			realmId,
-			clientId: null
-		});
+		return this.resolve(names, { realmId });
 	}
 	async resolveClient(names, realmId, clientId) {
+		return this.resolve(names, { realmId }, clientId);
+	}
+	async resolve(names, where, clientId = null) {
 		if (!names || names.length === 0) return [];
 		names = names.map((name) => name.trim().toLowerCase());
-		if (names.includes("*")) return this.repository.findManyBy({
-			realmId,
+		const conditions = this.clientScoped ? {
+			...where,
 			clientId
-		});
+		} : where;
+		if (names.includes("*")) return this.repository.findManyBy(conditions);
 		return this.repository.findManyBy({
-			name: names,
-			realmId,
-			clientId
+			...conditions,
+			name: names
 		});
 	}
 };

package/dist/core/provisioning/synchronizer/entity-resolver.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity-resolver.mjs","names":["ProvisioningEntityResolver","repository","resolveGlobal","names","length","map","name","trim","toLowerCase","hasWildcard","includes","findManyBy","realmId","clientId","resolveRealm","resolveClient"],"sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '@authup/server-kit';\n\nexport class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {\n    protected repository: IEntityRepository<T>;\n\n    constructor(repository: IEntityRepository<T>) {\n        this.repository = repository;\n    }\n\n    async resolveGlobal(names?: string[]): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realmId: null,\n                clientId: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realmId: null,\n            clientId: null,\n        });\n    }\n\n    async resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realmId,\n                clientId: null,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realmId,\n            clientId: null,\n        });\n    }\n\n    async resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        const hasWildcard = names.includes('*');\n        if (hasWildcard) {\n            return this.repository.findManyBy({\n                realmId,\n                clientId,\n            });\n        }\n\n        return this.repository.findManyBy({\n            name: names,\n            realmId,\n            clientId,\n        });\n    }\n}\n"],"mappings":";;;;AAUA,IAAaA,6BAAb,MAAaA;CACCC;CAEV,YAAYA,YAAkC;EAC1C,KAAKA,aAAaA;CACtB;CAEA,MAAMC,cAAcC,OAAgC;EAChD,IAAI,CAACA,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAGXD,QAAQA,MAAME,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAGnD,IADoBL,MAAMO,SAAS,GAC/BD,GACA,OAAO,KAAKR,WAAWU,WAAW;GAC9BC,SAAS;GACTC,UAAU;EACd,CAAA;EAGJ,OAAO,KAAKZ,WAAWU,WAAW;GAC9BL,MAAMH;GACNS,SAAS;GACTC,UAAU;EACd,CAAA;CACJ;CAEA,MAAMC,aAAaX,OAA6BS,SAA+B;EAC3E,IAAI,CAACT,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAGXD,QAAQA,MAAME,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAGnD,IADoBL,MAAMO,SAAS,GAC/BD,GACA,OAAO,KAAKR,WAAWU,WAAW;GAC9BC;GACAC,UAAU;EACd,CAAA;EAGJ,OAAO,KAAKZ,WAAWU,WAAW;GAC9BL,MAAMH;GACNS;GACAC,UAAU;EACd,CAAA;CACJ;CAEA,MAAME,cAAcZ,OAA6BS,SAAiBC,UAAgC;EAC9F,IAAI,CAACV,SAASA,MAAMC,WAAW,GAC3B,OAAO,CAAA;EAGXD,QAAQA,MAAME,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAGnD,IADoBL,MAAMO,SAAS,GAC/BD,GACA,OAAO,KAAKR,WAAWU,WAAW;GAC9BC;GACAC;EACJ,CAAA;EAGJ,OAAO,KAAKZ,WAAWU,WAAW;GAC9BL,MAAMH;GACNS;GACAC;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"entity-resolver.mjs","names":["ProvisioningEntityResolver","repository","clientScoped","options","resolveGlobal","names","resolve","realmId","resolveRealm","resolveClient","clientId","where","length","map","name","trim","toLowerCase","conditions","includes","findManyBy"],"sources":["../../../../src/core/provisioning/synchronizer/entity-resolver.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@authup/kit';\nimport type { IEntityRepository } from '@authup/server-kit';\nimport type { ProvisioningEntityResolverOptions } from './types.ts';\n\nexport class ProvisioningEntityResolver<T extends ObjectLiteral = ObjectLiteral> {\n    protected repository: IEntityRepository<T>;\n\n    protected clientScoped: boolean;\n\n    constructor(repository: IEntityRepository<T>, options: ProvisioningEntityResolverOptions = {}) {\n        this.repository = repository;\n        this.clientScoped = options.clientScoped ?? true;\n    }\n\n    async resolveGlobal(names?: string[]): Promise<T[]> {\n        return this.resolve(names, { realmId: null });\n    }\n\n    async resolveRealm(names: string[] | undefined, realmId: string): Promise<T[]> {\n        return this.resolve(names, { realmId });\n    }\n\n    async resolveClient(names: string[] | undefined, realmId: string, clientId: string): Promise<T[]> {\n        return this.resolve(names, { realmId }, clientId);\n    }\n\n    protected async resolve(\n        names: string[] | undefined,\n        where: Record<string, any>,\n        clientId: string | null = null,\n    ): Promise<T[]> {\n        if (!names || names.length === 0) {\n            return [];\n        }\n\n        names = names.map((name) => name.trim().toLowerCase());\n\n        // A client-ownable entity must never resolve another owner's rows, so\n        // the client dimension is always pinned. Entities without one (scope)\n        // opt out, because the predicate would not compile against the table.\n        const conditions = this.clientScoped ?\n            {\n                ...where,\n                clientId,\n            } :\n            where;\n\n        if (names.includes('*')) {\n            return this.repository.findManyBy(conditions);\n        }\n\n        return this.repository.findManyBy({\n            ...conditions,\n            name: names,\n        });\n    }\n}\n"],"mappings":";;;;AAWA,IAAaA,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAkCE,UAA6C,CAAC,GAAG;EAC3F,KAAKF,aAAaA;EAClB,KAAKC,eAAeC,QAAQD,gBAAgB;CAChD;CAEA,MAAME,cAAcC,OAAgC;EAChD,OAAO,KAAKC,QAAQD,OAAO,EAAEE,SAAS,KAAK,CAAA;CAC/C;CAEA,MAAMC,aAAaH,OAA6BE,SAA+B;EAC3E,OAAO,KAAKD,QAAQD,OAAO,EAAEE,QAAQ,CAAA;CACzC;CAEA,MAAME,cAAcJ,OAA6BE,SAAiBG,UAAgC;EAC9F,OAAO,KAAKJ,QAAQD,OAAO,EAAEE,QAAQ,GAAGG,QAAAA;CAC5C;CAEA,MAAgBJ,QACZD,OACAM,OACAD,WAA0B,MACd;EACZ,IAAI,CAACL,SAASA,MAAMO,WAAW,GAC3B,OAAO,CAAA;EAGXP,QAAQA,MAAMQ,KAAKC,SAASA,KAAKC,KAAI,CAAA,CAAGC,YAAW,CAAA;EAKnD,MAAMC,aAAa,KAAKf,eACpB;GACI,GAAGS;GACHD;EACJ,IACAC;EAEJ,IAAIN,MAAMa,SAAS,GAAA,GACf,OAAO,KAAKjB,WAAWkB,WAAWF,UAAAA;EAGtC,OAAO,KAAKhB,WAAWkB,WAAW;GAC9B,GAAGF;GACHH,MAAMT;EACV,CAAA;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/index.d.ts

@@ -7,5 +7,6 @@ export * from './realm/index.ts';
 export * from './role/index.ts';
 export * from './root/index.ts';
 export * from './scope/index.ts';
+export * from './types.ts';
 export * from './user/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/synchronizer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/core/provisioning/synchronizer/permission/module.mjs

@@ -40,7 +40,6 @@ var PermissionProvisioningSynchronizer = class extends BaseProvisioningSynchroni
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
 		if (input.relations?.policies && input.relations.policies.length > 0) await this.synchronizePolicies(attributes, input.relations.policies);

package/dist/core/provisioning/synchronizer/permission/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","trim","toLowerCase","existing","permissionId","policyId","entry","permissionRealmId","policyRealmId"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n            clientId: input.attributes.clientId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName.trim().toLowerCase());\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permissionId: permission.id,\n                policyId: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permissionId: permission.id,\n                permissionRealmId: permission.realmId,\n                policyId: policy.id,\n                policyRealmId: policy.realmId,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAA4E;EAC1F,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWX,oCAAoCQ,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKP,WAAWS,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASjB,+BAA+BkB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKP,WAAWe,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKjB,+BAA+BoB;IAChCT,aAAa,KAAKP,WAAWiB,MACzBV,YACAC,SAASD,aACLZ,WAAWU,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKP,WAAWkB,KAAKX,UAAAA;IACxC;GACJ,KAAKX,+BAA+BuB;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;IAC/E;EACR;OAEAA,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMiB,WAAWC,YAAYlB,MAAMiB,UAAUC,SAASC,SAAS,GAC/D,MAAM,KAAKC,oBAAoBlB,YAAYF,MAAMiB,UAAUC,QAAQ;EAGvE,OAAO;GACH,GAAGlB;GACHE;EACJ;CACJ;CAEA,MAAckB,oBAAoBC,YAAwBC,aAAsC;EAC5F,IAAI,CAAC,KAAK1B,oBAAoB,CAAC,KAAKC,4BAChC,MAAM,IAAI0B,MACN,qGAAA;EAIR,KAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK7B,iBAAiB8B,cAAcF,WAAWG,KAAI,CAAA,CAAGC,YAAW,CAAA;GACtF,IAAI,CAACH,QACD,MAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,GAAG;GAQ7F,IAAIwB,MAJmB,KAAKhC,2BAA2BO,UAAU;IAC7D0B,cAAcT,WAAWN;IACzBgB,UAAUN,OAAOV;GACrB,CAAA,GAEI;GAGJ,MAAMiB,QAAQ,KAAKnC,2BAA2BmB,OAAO;IACjDc,cAAcT,WAAWN;IACzBkB,mBAAmBZ,WAAWf;IAC9ByB,UAAUN,OAAOV;IACjBmB,eAAeT,OAAOnB;GAC1B,CAAA;GACA,MAAM,KAAKT,2BAA2BgB,KAAKmB,KAAAA;EAC/C;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","PermissionProvisioningSynchronizer","repository","policyRepository","permissionPolicyRepository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","policies","length","synchronizePolicies","permission","policyNames","Error","policyName","policy","findOneByName","trim","toLowerCase","existing","permissionId","policyId","entry","permissionRealmId","policyRealmId"],"sources":["../../../../../src/core/provisioning/synchronizer/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission } from '@authup/core-kit';\nimport type { IPermissionPolicyRepository } from '../../../entities/permission-policy/types.ts';\nimport type { IPermissionRepository, IPolicyRepository } from '../../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { PermissionProvisioningSynchronizerContext } from './types.ts';\n\nexport class PermissionProvisioningSynchronizer extends BaseProvisioningSynchronizer<PermissionProvisioningEntity> {\n    protected repository : IPermissionRepository;\n\n    protected policyRepository?: IPolicyRepository;\n\n    protected permissionPolicyRepository?: IPermissionPolicyRepository;\n\n    constructor(ctx: PermissionProvisioningSynchronizerContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.policyRepository = ctx.policyRepository;\n        this.permissionPolicyRepository = ctx.permissionPolicyRepository;\n    }\n\n    async synchronize(input: PermissionProvisioningEntity): Promise<PermissionProvisioningEntity> {\n        this.canonicalizeName(input.attributes);\n\n        const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n        let attributes = await this.repository.findOneBy({\n            name: input.attributes.name,\n            realmId: input.attributes.realmId || null,\n            clientId: input.attributes.clientId || null,\n        });\n\n        if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n            if (attributes) {\n                await this.repository.remove(attributes);\n            }\n            return {\n                ...input,\n                attributes: attributes || input.attributes,\n            };\n        }\n\n        if (attributes) {\n            switch (strategy.type) {\n                case ProvisioningEntityStrategyType.MERGE:\n                    attributes = this.repository.merge(\n                        attributes,\n                        strategy.attributes ?\n                            pickRecord(input.attributes, strategy.attributes) :\n                            input.attributes,\n                    );\n\n                    attributes = await this.repository.save(attributes);\n                    break;\n                case ProvisioningEntityStrategyType.REPLACE:\n                    input.attributes.id = attributes.id;\n                    attributes = await this.repository.save(this.repository.create(input.attributes));\n                    break;\n            }\n        } else {\n            attributes = await this.repository.save(this.repository.create(input.attributes));\n        }\n\n        if (input.relations?.policies && input.relations.policies.length > 0) {\n            await this.synchronizePolicies(attributes, input.relations.policies);\n        }\n\n        return {\n            ...input,\n            attributes,\n        };\n    }\n\n    private async synchronizePolicies(permission: Permission, policyNames: string[]): Promise<void> {\n        if (!this.policyRepository || !this.permissionPolicyRepository) {\n            throw new Error(\n                'Provisioning: policy/permissionPolicy repositories must be wired to attach policies to permissions.',\n            );\n        }\n\n        for (const policyName of policyNames) {\n            const policy = await this.policyRepository.findOneByName(policyName.trim().toLowerCase());\n            if (!policy) {\n                throw new Error(\n                    `Provisioning: policy '${policyName}' not found for permission '${permission.name}'.`,\n                );\n            }\n\n            const existing = await this.permissionPolicyRepository.findOneBy({\n                permissionId: permission.id,\n                policyId: policy.id,\n            });\n            if (existing) {\n                continue;\n            }\n\n            const entry = this.permissionPolicyRepository.create({\n                permissionId: permission.id,\n                permissionRealmId: permission.realmId,\n                policyId: policy.id,\n                policyRealmId: policy.realmId,\n            });\n            await this.permissionPolicyRepository.save(entry);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaI,qCAAb,cAAwDD,6BAAAA;CAC1CE;CAEAC;CAEAC;CAEV,YAAYC,KAAgD;EACxD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,6BAA6BC,IAAID;CAC1C;CAEA,MAAME,YAAYC,OAA4E;EAC1F,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWX,oCAAoCQ,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKP,WAAWS,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASjB,+BAA+BkB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKP,WAAWe,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKjB,+BAA+BoB;IAChCT,aAAa,KAAKP,WAAWiB,MACzBV,YACAC,SAASD,aACLZ,WAAWU,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKP,WAAWkB,KAAKX,UAAAA;IACxC;GACJ,KAAKX,+BAA+BuB;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKP,WAAWkB,KAAK,KAAKlB,WAAWqB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAIF,MAAMiB,WAAWC,YAAYlB,MAAMiB,UAAUC,SAASC,SAAS,GAC/D,MAAM,KAAKC,oBAAoBlB,YAAYF,MAAMiB,UAAUC,QAAQ;EAGvE,OAAO;GACH,GAAGlB;GACHE;EACJ;CACJ;CAEA,MAAckB,oBAAoBC,YAAwBC,aAAsC;EAC5F,IAAI,CAAC,KAAK1B,oBAAoB,CAAC,KAAKC,4BAChC,MAAM,IAAI0B,MACN,qGAAA;EAIR,KAAK,MAAMC,cAAcF,aAAa;GAClC,MAAMG,SAAS,MAAM,KAAK7B,iBAAiB8B,cAAcF,WAAWG,KAAI,CAAA,CAAGC,YAAW,CAAA;GACtF,IAAI,CAACH,QACD,MAAM,IAAIF,MACN,yBAAyBC,WAAW,8BAA8BH,WAAWhB,KAAK,GAAG;GAQ7F,IAAIwB,MAJmB,KAAKhC,2BAA2BO,UAAU;IAC7D0B,cAAcT,WAAWN;IACzBgB,UAAUN,OAAOV;GACrB,CAAA,GAEI;GAGJ,MAAMiB,QAAQ,KAAKnC,2BAA2BmB,OAAO;IACjDc,cAAcT,WAAWN;IACzBkB,mBAAmBZ,WAAWf;IAC9ByB,UAAUN,OAAOV;IACjBmB,eAAeT,OAAOnB;GAC1B,CAAA;GACA,MAAM,KAAKT,2BAA2BgB,KAAKmB,KAAAA;EAC/C;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/realm/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;IAExC,SAAS,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAElF,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;gBAErE,GAAG,EAAE,oCAAoC;IAW/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CA8FtF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAEvE,qBAAa,6BAA8B,SAAQ,4BAA4B,CAAC,uBAAuB,CAAC;IACpG,SAAS,CAAC,UAAU,EAAG,gBAAgB,CAAC;IAExC,SAAS,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;IAElF,SAAS,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IAE1F,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAE9E,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;gBAErE,GAAG,EAAE,oCAAoC;IAW/C,WAAW,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAgGtF"}