npm - @authup/server-core - Versions diffs - 1.0.0-beta.56 → 1.0.0-beta.58 - Mend

@authup/server-core 1.0.0-beta.56 → 1.0.0-beta.58

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (478) hide show

package/dist/core/provisioning/synchronizer/realm/module.mjs CHANGED Viewed

@@ -42,9 +42,16 @@ var RealmProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
+		if (input.relations && input.relations.scopes) {
+			const scopes = input.relations.scopes.map((child) => {
+				child.attributes.realmId = attributes.id;
+				child.attributes.realm = attributes;
+				return child;
+			});
+			await this.scopeSynchronizer.synchronizeMany(scopes);
+		}
 		if (input.relations && input.relations.clients) {
 			const clients = input.relations.clients.map((child) => {
 				child.attributes.realmId = attributes.id;
@@ -77,14 +84,6 @@ var RealmProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			});
 			await this.userSynchronizer.synchronizeMany(users);
 		}
-		if (input.relations && input.relations.scopes) {
-			const scopes = input.relations.scopes.map((child) => {
-				child.attributes.realmId = attributes.id;
-				child.attributes.realm = attributes;
-				return child;
-			});
-			await this.scopeSynchronizer.synchronizeMany(scopes);
-		}
 		return {
 			...input,
 			attributes

package/dist/core/provisioning/synchronizer/realm/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","~~clients~~","map","child","realmId","realm","synchronizeMany","permissions","roles","users"~~,"scopes"~~],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n protected repository : IRealmRepository;\n\n protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n constructor(ctx: RealmProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.clientSynchronizer = ctx.clientSynchronizer;\n this.permissionSynchronizer = ctx.permissionSynchronizer;\n this.roleSynchronizer = ctx.roleSynchronizer;\n this.userSynchronizer = ctx.userSynchronizer;\n this.scopeSynchronizer = ctx.scopeSynchronizer;\n }\n\n async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (input.relations && input.relations.~~clients~~) {\n const ~~clients~~ = input.relations.~~clients~~.map(\n (child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n }~~,\n~~ );\n\n await this.~~clientSynchronizer~~.synchronizeMany(~~clients~~);\n }\n\n if (input.relations && input.relations.~~permissions~~) {\n const ~~permissions~~ = input.relations.~~permissions~~.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.~~permissionSynchronizer~~.synchronizeMany(~~permissions~~);\n }\n\n if (input.relations && input.relations.~~roles~~) {\n const ~~roles~~ = input.relations.~~roles~~.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.~~roleSynchronizer~~.synchronizeMany(~~roles~~);\n }\n\n if (input.relations && input.relations.~~users~~) {\n const ~~users~~ = input.relations.~~users~~.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.~~userSynchronizer~~.synchronizeMany(~~users~~);\n }\n\n if (input.relations && input.relations.~~scopes~~) {\n const ~~scopes~~ = input.relations.~~scopes~~.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.~~scopeSynchronizer~~.synchronizeMany(~~scopes~~);\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKN,aAAaM,IAAIN;EACtB,KAAKC,qBAAqBK,IAAIL;EAC9B,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWd,oCAAoCW,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKV,WAAWY,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKV,WAAWgB,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCP,aAAa,KAAKV,WAAWkB,MACzBR,YACAC,SAASD,aACLf,WAAWa,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKV,WAAWmB,KAAKT,UAAAA;IACxC;GACJ,KAAKd,+BAA+BwB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;~~IAC/E~~;~~EACR;~~OAEAA,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;~~EAGnF~~,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,~~SAAS~~;~~GAC5C~~,MAAMA,~~UAAUhB~~,MAAMe,UAAUC,~~QAAQC~~,~~KACnCC~~,UAAAA;~~IACGA~~,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;~~GAGJ~~,MAAM,~~KAAKzB~~,~~mBAAmB4B~~,gBAAgBL,~~OAAAA~~;~~EAClD~~;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,~~aAAa~~;~~GAChD~~,MAAMA,~~cAActB~~,MAAMe,UAAUO,~~YAAYL~~,~~KAAKC~~,UAAAA;~~IACjDA~~,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;~~GAEA~~,MAAM,~~KAAKxB~~,~~uBAAuB2B~~,gBAAgBC,~~WAAAA~~;~~EACtD~~;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,~~OAAO~~;~~GAC1C~~,MAAMA,~~QAAQvB~~,MAAMe,UAAUQ,~~MAAMN~~,KAAKC,UAAAA;~~IACrCA~~,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,~~KAAKvB~~,~~iBAAiB0B~~,gBAAgBE,~~KAAAA~~;~~EAChD~~;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,~~KAAKtB~~,~~iBAAiByB~~,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,~~QAAQ~~;~~GAC3C~~,MAAMA,~~SAASzB~~,MAAMe,UAAUU,~~OAAOR~~,KAAKC,UAAAA;~~IACvCA~~,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,~~KAAKrB~~,~~kBAAkBwB~~,gBAAgBI,~~MAAAA~~;~~EACjD~~;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","RealmProvisioningSynchronizer","repository","clientSynchronizer","permissionSynchronizer","roleSynchronizer","userSynchronizer","scopeSynchronizer","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","scopes","map","child","realmId","realm","synchronizeMany","clients","permissions","roles","users"],"sources":["../../../../../src/core/provisioning/synchronizer/realm/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IRealmRepository } from '../../../entities/index.ts';\nimport type { ClientProvisioningEntity, ScopeProvisioningEntity } from '../../entities/index.ts';\nimport type { PermissionProvisioningEntity } from '../../entities/permission/index.ts';\nimport type { RealmProvisioningEntity } from '../../entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport type { IProvisioningSynchronizer } from '../../types.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { RealmProvisioningSynchronizerContext } from './types.ts';\n\nexport class RealmProvisioningSynchronizer extends BaseProvisioningSynchronizer<RealmProvisioningEntity> {\n protected repository : IRealmRepository;\n\n protected clientSynchronizer: IProvisioningSynchronizer<ClientProvisioningEntity>;\n\n protected permissionSynchronizer: IProvisioningSynchronizer<PermissionProvisioningEntity>;\n\n protected roleSynchronizer: IProvisioningSynchronizer<RoleProvisioningEntity>;\n\n protected userSynchronizer: IProvisioningSynchronizer<UserProvisioningEntity>;\n\n protected scopeSynchronizer : IProvisioningSynchronizer<ScopeProvisioningEntity>;\n\n constructor(ctx: RealmProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.clientSynchronizer = ctx.clientSynchronizer;\n this.permissionSynchronizer = ctx.permissionSynchronizer;\n this.roleSynchronizer = ctx.roleSynchronizer;\n this.userSynchronizer = ctx.userSynchronizer;\n this.scopeSynchronizer = ctx.scopeSynchronizer;\n }\n\n async synchronize(input: RealmProvisioningEntity): Promise<RealmProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({ name: input.attributes.name });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n // Scopes first: they are leaf entities carrying no relations of their\n // own, and a client below may bind them through `realmScopes`.\n if (input.relations && input.relations.scopes) {\n const scopes = input.relations.scopes.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.scopeSynchronizer.synchronizeMany(scopes);\n }\n\n if (input.relations && input.relations.clients) {\n const clients = input.relations.clients.map(\n (child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n },\n );\n\n await this.clientSynchronizer.synchronizeMany(clients);\n }\n\n if (input.relations && input.relations.permissions) {\n const permissions = input.relations.permissions.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.permissionSynchronizer.synchronizeMany(permissions);\n }\n\n if (input.relations && input.relations.roles) {\n const roles = input.relations.roles.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.roleSynchronizer.synchronizeMany(roles);\n }\n\n if (input.relations && input.relations.users) {\n const users = input.relations.users.map((child) => {\n child.attributes.realmId = attributes.id;\n child.attributes.realm = attributes;\n return child;\n });\n\n await this.userSynchronizer.synchronizeMany(users);\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKN,aAAaM,IAAIN;EACtB,KAAKC,qBAAqBK,IAAIL;EAC9B,KAAKC,yBAAyBI,IAAIJ;EAClC,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,mBAAmBE,IAAIF;EAC5B,KAAKC,oBAAoBC,IAAID;CACjC;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWd,oCAAoCW,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKV,WAAWY,UAAU,EAAEC,MAAML,MAAME,WAAWG,KAAK,CAAA;EAE/E,IAAIF,SAASG,SAASlB,+BAA+BmB,QAAQ;GACzD,IAAIL,YACA,MAAM,KAAKV,WAAWgB,OAAON,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASG,MAAjB;GACI,KAAKlB,+BAA+BqB;IAChCP,aAAa,KAAKV,WAAWkB,MACzBR,YACAC,SAASD,aACLf,WAAWa,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKV,WAAWmB,KAAKT,UAAAA;IACxC;GACJ,KAAKd,+BAA+BwB;IAChCZ,MAAME,WAAWW,KAAKX,WAAWW;IACjCX,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKV,WAAWmB,KAAK,KAAKnB,WAAWsB,OAAOd,MAAME,UAAU,CAAA;EAKnF,IAAIF,MAAMe,aAAaf,MAAMe,UAAUC,QAAQ;GAC3C,MAAMA,SAAShB,MAAMe,UAAUC,OAAOC,KAAKC,UAAAA;IACvCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKrB,kBAAkBwB,gBAAgBL,MAAAA;EACjD;EAEA,IAAIhB,MAAMe,aAAaf,MAAMe,UAAUO,SAAS;GAC5C,MAAMA,UAAUtB,MAAMe,UAAUO,QAAQL,KACnCC,UAAAA;IACGA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAGJ,MAAM,KAAKzB,mBAAmB4B,gBAAgBC,OAAAA;EAClD;EAEA,IAAItB,MAAMe,aAAaf,MAAMe,UAAUQ,aAAa;GAChD,MAAMA,cAAcvB,MAAMe,UAAUQ,YAAYN,KAAKC,UAAAA;IACjDA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKxB,uBAAuB2B,gBAAgBE,WAAAA;EACtD;EAEA,IAAIvB,MAAMe,aAAaf,MAAMe,UAAUS,OAAO;GAC1C,MAAMA,QAAQxB,MAAMe,UAAUS,MAAMP,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKvB,iBAAiB0B,gBAAgBG,KAAAA;EAChD;EAEA,IAAIxB,MAAMe,aAAaf,MAAMe,UAAUU,OAAO;GAC1C,MAAMA,QAAQzB,MAAMe,UAAUU,MAAMR,KAAKC,UAAAA;IACrCA,MAAMhB,WAAWiB,UAAUjB,WAAWW;IACtCK,MAAMhB,WAAWkB,QAAQlB;IACzB,OAAOgB;GACX,CAAA;GAEA,MAAM,KAAKtB,iBAAiByB,gBAAgBI,KAAAA;EAChD;EAEA,OAAO;GACH,GAAGzB;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/role/module.mjs CHANGED Viewed

@@ -46,7 +46,6 @@ var RoleProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
 		if (!input.relations) return {

package/dist/core/provisioning/synchronizer/role/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n protected repository : IRoleRepository;\n\n protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n constructor(ctx: RoleProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.rolePermissionRepository,\n ownerKey: 'roleId',\n ownerRealmKey: 'roleRealmId',\n });\n }\n\n async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n clientId: input.attributes.clientId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes,\n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (!input.relations) {\n return {\n ...input,\n attributes,\n };\n }\n\n let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n const excludeSet = new Set(input.relations.globalPermissionsExclude);\n globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n }\n\n const realmPermissions = attributes.realmId ?\n await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realmId) :\n [];\n\n const permissions = [\n ...globalPermissions,\n ...realmPermissions,\n ];\n\n if (permissions.length > 0) {\n const defaultScope = input.relations.globalPermissionsRealmScope;\n\n if (defaultScope) {\n const overrides = this.buildRealmScopeOverrides(input);\n for (const permission of permissions) {\n const realmScope = overrides.get(permission.name) ?? defaultScope;\n await this.permissionJunction.synchronize(\n attributes,\n [permission],\n 'permissionId',\n 'permissionRealmId',\n { realmScope },\n );\n }\n } else {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permissionId',\n 'permissionRealmId',\n );\n }\n }\n\n return {\n ...input,\n attributes,\n };\n }\n\n private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n const overrides = new Map<string, string>();\n if (input.relations?.globalPermissionsRealmScopeOverrides) {\n for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n if (!permissionNames) {\n continue;\n }\n for (const permName of permissionNames) {\n overrides.set(permName, realmScope);\n }\n }\n }\n return overrides;\n }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;~~IAC/E~~;~~EACR;~~OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,UAChC,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,OAAO,IAC/F,CAAA;EAEJ,MAAMuB,cAAc,CACbX,GAAAA,mBACAS,GAAAA,gBACN;EAED,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAW,GACZ,gBACA,qBACA,EAAEC,WAAW,CAAA;IAErB;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,gBACA,mBAAA;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,IAAIK,IAAAA;EACtB,IAAIrC,MAAMiB,WAAWqB,sCACjB,KAAK,MAAM,CAACH,YAAYI,oBAAoBC,OAAOC,QAAQzC,MAAMiB,UAAUqB,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,iBACnBP,UAAUW,IAAID,UAAUP,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","RoleProvisioningSynchronizer","repository","permissionResolver","permissionJunction","ctx","permissionRepository","rolePermissionRepository","ownerKey","ownerRealmKey","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","clientId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create","relations","globalPermissions","resolveGlobal","globalPermissionsExclude","length","excludeSet","Set","filter","p","has","realmPermissions","resolveRealm","permissions","defaultScope","globalPermissionsRealmScope","overrides","buildRealmScopeOverrides","permission","realmScope","get","Map","globalPermissionsRealmScopeOverrides","permissionNames","Object","entries","permName","set"],"sources":["../../../../../src/core/provisioning/synchronizer/role/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { Permission, RolePermission } from '@authup/core-kit';\nimport type { IRoleRepository } from '../../../entities/index.ts';\nimport type { RoleProvisioningEntity } from '../../entities/role/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { RoleProvisioningSynchronizerContext } from './types.ts';\n\nexport class RoleProvisioningSynchronizer extends BaseProvisioningSynchronizer<RoleProvisioningEntity> {\n protected repository : IRoleRepository;\n\n protected permissionResolver : ProvisioningEntityResolver<Permission>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<RolePermission>;\n\n constructor(ctx: RoleProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.rolePermissionRepository,\n ownerKey: 'roleId',\n ownerRealmKey: 'roleRealmId',\n });\n }\n\n async synchronize(input: RoleProvisioningEntity): Promise<RoleProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n clientId: input.attributes.clientId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes,\n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n if (!input.relations) {\n return {\n ...input,\n attributes,\n };\n }\n\n let globalPermissions = await this.permissionResolver.resolveGlobal(input.relations.globalPermissions);\n\n if (input.relations.globalPermissionsExclude && input.relations.globalPermissionsExclude.length > 0) {\n const excludeSet = new Set(input.relations.globalPermissionsExclude);\n globalPermissions = globalPermissions.filter((p) => !excludeSet.has(p.name));\n }\n\n const realmPermissions = attributes.realmId ?\n await this.permissionResolver.resolveRealm(input.relations.realmPermissions, attributes.realmId) :\n [];\n\n const permissions = [\n ...globalPermissions,\n ...realmPermissions,\n ];\n\n if (permissions.length > 0) {\n const defaultScope = input.relations.globalPermissionsRealmScope;\n\n if (defaultScope) {\n const overrides = this.buildRealmScopeOverrides(input);\n for (const permission of permissions) {\n const realmScope = overrides.get(permission.name) ?? defaultScope;\n await this.permissionJunction.synchronize(\n attributes,\n [permission],\n 'permissionId',\n 'permissionRealmId',\n { realmScope },\n );\n }\n } else {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permissionId',\n 'permissionRealmId',\n );\n }\n }\n\n return {\n ...input,\n attributes,\n };\n }\n\n private buildRealmScopeOverrides(input: RoleProvisioningEntity): Map<string, string> {\n const overrides = new Map<string, string>();\n if (input.relations?.globalPermissionsRealmScopeOverrides) {\n for (const [realmScope, permissionNames] of Object.entries(input.relations.globalPermissionsRealmScopeOverrides)) {\n if (!permissionNames) {\n continue;\n }\n for (const permName of permissionNames) {\n overrides.set(permName, realmScope);\n }\n }\n }\n return overrides;\n }\n}\n"],"mappings":";;;;;;;;;;;AAiBA,IAAaM,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,qBAAqB,IAAIJ,2BAA2BM,IAAIC,oBAAoB;EACjF,KAAKF,qBAAqB,IAAIJ,iCAAiC;GAC3DE,YAAYG,IAAIE;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAMC,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWjB,oCAAoCc,MAAMG,QAAQ;EACnE,IAAID,aAAa,MAAM,KAAKX,WAAWa,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;GACrCC,UAAUP,MAAME,WAAWK,YAAY;EAC3C,CAAA;EAEA,IAAIJ,SAASK,SAASvB,+BAA+BwB,QAAQ;GACzD,IAAIP,YACA,MAAM,KAAKX,WAAWmB,OAAOR,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASK,MAAjB;GACI,KAAKvB,+BAA+B0B;IAChCT,aAAa,KAAKX,WAAWqB,MACzBV,YACAC,SAASD,aACLlB,WAAWgB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKX,WAAWsB,KAAKX,UAAAA;IACxC;GACJ,KAAKjB,+BAA+B6B;IAChCd,MAAME,WAAWa,KAAKb,WAAWa;IACjCb,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKX,WAAWsB,KAAK,KAAKtB,WAAWyB,OAAOhB,MAAME,UAAU,CAAA;EAGnF,IAAI,CAACF,MAAMiB,WACP,OAAO;GACH,GAAGjB;GACHE;EACJ;EAGJ,IAAIgB,oBAAoB,MAAM,KAAK1B,mBAAmB2B,cAAcnB,MAAMiB,UAAUC,iBAAiB;EAErG,IAAIlB,MAAMiB,UAAUG,4BAA4BpB,MAAMiB,UAAUG,yBAAyBC,SAAS,GAAG;GACjG,MAAMC,aAAa,IAAIC,IAAIvB,MAAMiB,UAAUG,wBAAwB;GACnEF,oBAAoBA,kBAAkBM,QAAQC,MAAM,CAACH,WAAWI,IAAID,EAAEpB,IAAI,CAAA;EAC9E;EAEA,MAAMsB,mBAAmBzB,WAAWI,UAChC,MAAM,KAAKd,mBAAmBoC,aAAa5B,MAAMiB,UAAUU,kBAAkBzB,WAAWI,OAAO,IAC/F,CAAA;EAEJ,MAAMuB,cAAc,CACbX,GAAAA,mBACAS,GAAAA,gBACN;EAED,IAAIE,YAAYR,SAAS,GAAG;GACxB,MAAMS,eAAe9B,MAAMiB,UAAUc;GAErC,IAAID,cAAc;IACd,MAAME,YAAY,KAAKC,yBAAyBjC,KAAAA;IAChD,KAAK,MAAMkC,cAAcL,aAAa;KAClC,MAAMM,aAAaH,UAAUI,IAAIF,WAAW7B,IAAI,KAAKyB;KACrD,MAAM,KAAKrC,mBAAmBM,YAC1BG,YACA,CAACgC,UAAW,GACZ,gBACA,qBACA,EAAEC,WAAW,CAAA;IAErB;GACJ,OACI,MAAM,KAAK1C,mBAAmBM,YAC1BG,YACA2B,aACA,gBACA,mBAAA;EAGZ;EAEA,OAAO;GACH,GAAG7B;GACHE;EACJ;CACJ;CAEQ+B,yBAAyBjC,OAAoD;EACjF,MAAMgC,4BAAY,IAAIK,IAAAA;EACtB,IAAIrC,MAAMiB,WAAWqB,sCACjB,KAAK,MAAM,CAACH,YAAYI,oBAAoBC,OAAOC,QAAQzC,MAAMiB,UAAUqB,oCAAoC,GAAG;GAC9G,IAAI,CAACC,iBACD;GAEJ,KAAK,MAAMG,YAAYH,iBACnBP,UAAUW,IAAID,UAAUP,UAAAA;EAEhC;EAEJ,OAAOH;CACX;AACJ"}

package/dist/core/provisioning/synchronizer/scope/module.mjs CHANGED Viewed

@@ -35,7 +35,6 @@ var ScopeProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 			case ProvisioningEntityStrategyType.REPLACE:
 				input.attributes.id = attributes.id;
 				attributes = await this.repository.save(this.repository.create(input.attributes));
-				break;
 		}
 		else attributes = await this.repository.save(this.repository.create(input.attributes));
 		return {

package/dist/core/provisioning/synchronizer/scope/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n protected repository : IScopeRepository;\n\n constructor(ctx: ScopeProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n }\n\n async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;~~IAC/E~~;~~EACR;~~OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ScopeProvisioningSynchronizer","repository","ctx","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","merge","save","REPLACE","id","create"],"sources":["../../../../../src/core/provisioning/synchronizer/scope/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { pickRecord } from '@authup/kit';\nimport type { IScopeRepository } from '../../../entities/index.ts';\nimport type { ScopeProvisioningEntity } from '../../entities/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport type { ScopeProvisioningSynchronizerContext } from './types.ts';\n\nexport class ScopeProvisioningSynchronizer extends BaseProvisioningSynchronizer<ScopeProvisioningEntity> {\n protected repository : IScopeRepository;\n\n constructor(ctx: ScopeProvisioningSynchronizerContext) {\n super();\n\n this.repository = ctx.repository;\n }\n\n async synchronize(input: ScopeProvisioningEntity): Promise<ScopeProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.repository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.repository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n attributes = this.repository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.repository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.id = attributes.id;\n attributes = await this.repository.save(this.repository.create(input.attributes));\n break;\n }\n } else {\n attributes = await this.repository.save(this.repository.create(input.attributes));\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,gCAAb,cAAmDD,6BAAAA;CACrCE;CAEV,YAAYC,KAA2C;EACnD,MAAK;EAEL,KAAKD,aAAaC,IAAID;CAC1B;CAEA,MAAME,YAAYC,OAAkE;EAChF,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWT,oCAAoCM,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKL,WAAWO,UAAU;GAC7CC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAASd,+BAA+Be,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKL,WAAWY,OAAOP,UAAAA;GAEjC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAKd,+BAA+BiB;IAChCR,aAAa,KAAKL,WAAWc,MACzBT,YACAC,SAASD,aACLV,WAAWQ,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKL,WAAWe,KAAKV,UAAAA;IACxC;GACJ,KAAKT,+BAA+BoB;IAChCb,MAAME,WAAWY,KAAKZ,WAAWY;IACjCZ,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAEvF;OAEAA,aAAa,MAAM,KAAKL,WAAWe,KAAK,KAAKf,WAAWkB,OAAOf,MAAME,UAAU,CAAA;EAGnF,OAAO;GACH,GAAGF;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/provisioning/synchronizer/types.d.ts ADDED Viewed

@@ -0,0 +1,11 @@
+export type ProvisioningEntityResolverOptions = {
+    /**
+     * Whether the resolved entity carries a `clientId` column.
+     *
+     * Permissions and roles are client-ownable, so their lookups pin the
+     * client dimension. Scopes have none, so leaving the predicate in would
+     * make the query fail against the table. Defaults to true.
+     */
+    clientScoped?: boolean;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/synchronizer/types.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/synchronizer/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iCAAiC,GAAG;IAC5C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC"}

package/dist/core/provisioning/synchronizer/types.mjs ADDED Viewed

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/synchronizer/user/module.mjs CHANGED Viewed

@@ -58,7 +58,6 @@ var UserProvisioningSynchronizer = class extends BaseProvisioningSynchronizer {
 				input.attributes.email = input.attributes.email || attributes.email || (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : void 0);
 				input.attributes.id = attributes.id;
 				attributes = await this.userRepository.save(this.userRepository.create(input.attributes));
-				break;
 		}
 		else {
 			if (!input.attributes.email && input.attributes.name) input.attributes.email = buildUserFakeEmail(input.attributes.name);

package/dist/core/provisioning/synchronizer/user/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n Permission, \n Role, \n UserPermission, \n UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n IClientRepository,\n IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n protected userRepository: IUserRepository;\n\n protected clientRepository: IClientRepository;\n\n protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n protected roleResolver: ProvisioningEntityResolver<Role>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n constructor(ctx: UserProvisioningSynchronizerContext) {\n super();\n\n this.userRepository = ctx.userRepository;\n this.clientRepository = ctx.clientRepository;\n\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userPermissionRepository,\n ownerKey: 'userId',\n ownerRealmKey: 'userRealmId',\n });\n this.roleJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userRoleRepository,\n ownerKey: 'userId',\n ownerRealmKey: 'userRealmId',\n });\n }\n\n async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.userRepository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.userRepository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n if (\n strategy.attributes &&\n strategy.attributes.includes('email')\n ) {\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n buildUserFakeEmail(input.attributes.name \|\| attributes.name);\n }\n\n attributes = this.userRepository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.userRepository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n input.attributes.id = attributes.id;\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n break;\n }\n } else {\n if (!input.attributes.email && input.attributes.name) {\n input.attributes.email = buildUserFakeEmail(input.attributes.name);\n }\n\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n }\n\n // Permissions (Global, Realm & Client)\n const permissions : Permission[] = [\n ...await this.permissionResolver.resolveGlobal(\n input.relations && input.relations.globalPermissions,\n ),\n ...(attributes.realmId ?\n await this.permissionResolver.resolveRealm(\n input.relations && input.relations.realmPermissions,\n attributes.realmId,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientPermissions) {\n const clientKeys = Object.keys(input.relations.clientPermissions);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realmId: attributes.realmId,\n });\n\n if (client) {\n const entities = await this.permissionResolver.resolveClient(\n input.relations.clientPermissions[clientKey],\n attributes.realmId,\n client.id,\n );\n permissions.push(...entities);\n }\n }\n }\n\n if (permissions.length > 0) {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permissionId',\n 'permissionRealmId',\n );\n }\n\n // Roles (Global, Realm & Client)\n const roles : Role[] = [\n ...await this.roleResolver.resolveGlobal(\n input.relations && input.relations.globalRoles,\n ),\n ...(attributes.realmId ?\n await this.roleResolver.resolveRealm(\n input.relations && input.relations.realmRoles,\n attributes.realmId,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientRoles) {\n const clientKeys = Object.keys(input.relations.clientRoles);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realmId: attributes.realmId,\n });\n\n if (client) {\n const entities = await this.roleResolver.resolveClient(\n input.relations.clientRoles[clientKey],\n attributes.realmId,\n client.id,\n );\n roles.push(...entities);\n }\n }\n }\n\n if (roles.length > 0) {\n await this.roleJunction.synchronize(\n attributes,\n roles,\n 'roleId',\n 'roleRealmId',\n );\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;IACvF;EACR;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAC5B,GAAA,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAEpDpB,GAAAA,WAAWI,UACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,gBACA,mBAAA;EAKR,MAAMgB,QAAiB,CAChB,GAAA,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAE9ClC,GAAAA,WAAWI,UACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,UACA,aAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["buildUserFakeEmail","pickRecord","ProvisioningEntityStrategyType","normalizeEntityProvisioningStrategy","BaseProvisioningSynchronizer","ProvisioningEntityResolver","ProvisioningJunctionSynchronizer","UserProvisioningSynchronizer","userRepository","clientRepository","permissionResolver","roleResolver","permissionJunction","roleJunction","ctx","permissionRepository","roleRepository","repository","userPermissionRepository","ownerKey","ownerRealmKey","userRoleRepository","synchronize","input","canonicalizeName","attributes","strategy","findOneBy","name","realmId","type","ABSENT","remove","MERGE","includes","email","merge","save","REPLACE","undefined","id","create","permissions","resolveGlobal","relations","globalPermissions","resolveRealm","realmPermissions","clientPermissions","clientKeys","Object","keys","clientKey","client","entities","resolveClient","push","length","roles","globalRoles","realmRoles","clientRoles"],"sources":["../../../../../src/core/provisioning/synchronizer/user/module.ts"],"sourcesContent":["/\n Copyright (c) 2026-2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n Permission, \n Role, \n UserPermission, \n UserRole,\n} from '@authup/core-kit';\nimport { buildUserFakeEmail } from '@authup/core-kit';\nimport { pickRecord } from '@authup/kit';\nimport type {\n IClientRepository,\n IUserRepository,\n} from '../../../entities/index.ts';\nimport type { UserProvisioningEntity } from '../../entities/user/index.ts';\nimport { ProvisioningEntityStrategyType, normalizeEntityProvisioningStrategy } from '../../strategy/index.ts';\nimport { BaseProvisioningSynchronizer } from '../base.ts';\nimport { ProvisioningEntityResolver } from '../entity-resolver.ts';\nimport { ProvisioningJunctionSynchronizer } from '../junction-synchronizer.ts';\nimport type { UserProvisioningSynchronizerContext } from './types.ts';\n\nexport class UserProvisioningSynchronizer extends BaseProvisioningSynchronizer<UserProvisioningEntity> {\n protected userRepository: IUserRepository;\n\n protected clientRepository: IClientRepository;\n\n protected permissionResolver: ProvisioningEntityResolver<Permission>;\n\n protected roleResolver: ProvisioningEntityResolver<Role>;\n\n protected permissionJunction: ProvisioningJunctionSynchronizer<UserPermission>;\n\n protected roleJunction: ProvisioningJunctionSynchronizer<UserRole>;\n\n constructor(ctx: UserProvisioningSynchronizerContext) {\n super();\n\n this.userRepository = ctx.userRepository;\n this.clientRepository = ctx.clientRepository;\n\n this.permissionResolver = new ProvisioningEntityResolver(ctx.permissionRepository);\n this.roleResolver = new ProvisioningEntityResolver(ctx.roleRepository);\n\n this.permissionJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userPermissionRepository,\n ownerKey: 'userId',\n ownerRealmKey: 'userRealmId',\n });\n this.roleJunction = new ProvisioningJunctionSynchronizer({\n repository: ctx.userRoleRepository,\n ownerKey: 'userId',\n ownerRealmKey: 'userRealmId',\n });\n }\n\n async synchronize(input: UserProvisioningEntity): Promise<UserProvisioningEntity> {\n this.canonicalizeName(input.attributes);\n\n const strategy = normalizeEntityProvisioningStrategy(input.strategy);\n\n let attributes = await this.userRepository.findOneBy({\n name: input.attributes.name,\n realmId: input.attributes.realmId \|\| null,\n });\n\n if (strategy.type === ProvisioningEntityStrategyType.ABSENT) {\n if (attributes) {\n await this.userRepository.remove(attributes);\n }\n return {\n ...input,\n attributes: attributes \|\| input.attributes, \n };\n }\n\n if (attributes) {\n switch (strategy.type) {\n case ProvisioningEntityStrategyType.MERGE:\n if (\n strategy.attributes &&\n strategy.attributes.includes('email')\n ) {\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n buildUserFakeEmail(input.attributes.name \|\| attributes.name);\n }\n\n attributes = this.userRepository.merge(\n attributes,\n strategy.attributes ?\n pickRecord(input.attributes, strategy.attributes) :\n input.attributes,\n );\n\n attributes = await this.userRepository.save(attributes);\n break;\n case ProvisioningEntityStrategyType.REPLACE:\n input.attributes.email = input.attributes.email \|\|\n attributes.email \|\|\n (input.attributes.name ? buildUserFakeEmail(input.attributes.name) : undefined);\n\n input.attributes.id = attributes.id;\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n break;\n }\n } else {\n if (!input.attributes.email && input.attributes.name) {\n input.attributes.email = buildUserFakeEmail(input.attributes.name);\n }\n\n attributes = await this.userRepository.save(this.userRepository.create(input.attributes));\n }\n\n // Permissions (Global, Realm & Client)\n const permissions : Permission[] = [\n ...await this.permissionResolver.resolveGlobal(\n input.relations && input.relations.globalPermissions,\n ),\n ...(attributes.realmId ?\n await this.permissionResolver.resolveRealm(\n input.relations && input.relations.realmPermissions,\n attributes.realmId,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientPermissions) {\n const clientKeys = Object.keys(input.relations.clientPermissions);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realmId: attributes.realmId,\n });\n\n if (client) {\n const entities = await this.permissionResolver.resolveClient(\n input.relations.clientPermissions[clientKey],\n attributes.realmId,\n client.id,\n );\n permissions.push(...entities);\n }\n }\n }\n\n if (permissions.length > 0) {\n await this.permissionJunction.synchronize(\n attributes,\n permissions,\n 'permissionId',\n 'permissionRealmId',\n );\n }\n\n // Roles (Global, Realm & Client)\n const roles : Role[] = [\n ...await this.roleResolver.resolveGlobal(\n input.relations && input.relations.globalRoles,\n ),\n ...(attributes.realmId ?\n await this.roleResolver.resolveRealm(\n input.relations && input.relations.realmRoles,\n attributes.realmId,\n ) :\n []),\n ];\n\n if (input.relations && input.relations.clientRoles) {\n const clientKeys = Object.keys(input.relations.clientRoles);\n for (const clientKey of clientKeys) {\n const client = await this.clientRepository.findOneBy({\n name: clientKey,\n realmId: attributes.realmId,\n });\n\n if (client) {\n const entities = await this.roleResolver.resolveClient(\n input.relations.clientRoles[clientKey],\n attributes.realmId,\n client.id,\n );\n roles.push(...entities);\n }\n }\n }\n\n if (roles.length > 0) {\n await this.roleJunction.synchronize(\n attributes,\n roles,\n 'roleId',\n 'roleRealmId',\n );\n }\n\n return {\n ...input,\n attributes,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAaO,+BAAb,cAAkDH,6BAAAA;CACpCI;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0C;EAClD,MAAK;EAEL,KAAKN,iBAAiBM,IAAIN;EAC1B,KAAKC,mBAAmBK,IAAIL;EAE5B,KAAKC,qBAAqB,IAAIL,2BAA2BS,IAAIC,oBAAoB;EACjF,KAAKJ,eAAe,IAAIN,2BAA2BS,IAAIE,cAAc;EAErE,KAAKJ,qBAAqB,IAAIN,iCAAiC;GAC3DW,YAAYH,IAAII;GAChBC,UAAU;GACVC,eAAe;EACnB,CAAA;EACA,KAAKP,eAAe,IAAIP,iCAAiC;GACrDW,YAAYH,IAAIO;GAChBF,UAAU;GACVC,eAAe;EACnB,CAAA;CACJ;CAEA,MAAME,YAAYC,OAAgE;EAC9E,KAAKC,iBAAiBD,MAAME,UAAU;EAEtC,MAAMC,WAAWvB,oCAAoCoB,MAAMG,QAAQ;EAEnE,IAAID,aAAa,MAAM,KAAKjB,eAAemB,UAAU;GACjDC,MAAML,MAAME,WAAWG;GACvBC,SAASN,MAAME,WAAWI,WAAW;EACzC,CAAA;EAEA,IAAIH,SAASI,SAAS5B,+BAA+B6B,QAAQ;GACzD,IAAIN,YACA,MAAM,KAAKjB,eAAewB,OAAOP,UAAAA;GAErC,OAAO;IACH,GAAGF;IACHE,YAAYA,cAAcF,MAAME;GACpC;EACJ;EAEA,IAAIA,YACA,QAAQC,SAASI,MAAjB;GACI,KAAK5B,+BAA+B+B;IAChC,IACIP,SAASD,cACTC,SAASD,WAAWS,SAAS,OAAA,GAE7BX,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,SACXnC,mBAAmBuB,MAAME,WAAWG,QAAQH,WAAWG,IAAI;IAGnEH,aAAa,KAAKjB,eAAe4B,MAC7BX,YACAC,SAASD,aACLxB,WAAWsB,MAAME,YAAYC,SAASD,UAAU,IAChDF,MAAME,UAAU;IAGxBA,aAAa,MAAM,KAAKjB,eAAe6B,KAAKZ,UAAAA;IAC5C;GACJ,KAAKvB,+BAA+BoC;IAChCf,MAAME,WAAWU,QAAQZ,MAAME,WAAWU,SACtCV,WAAWU,UACVZ,MAAME,WAAWG,OAAO5B,mBAAmBuB,MAAME,WAAWG,IAAI,IAAIW,KAAAA;IAEzEhB,MAAME,WAAWe,KAAKf,WAAWe;IACjCf,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAE/F;OACG;GACH,IAAI,CAACF,MAAME,WAAWU,SAASZ,MAAME,WAAWG,MAC5CL,MAAME,WAAWU,QAAQnC,mBAAmBuB,MAAME,WAAWG,IAAI;GAGrEH,aAAa,MAAM,KAAKjB,eAAe6B,KAAK,KAAK7B,eAAeiC,OAAOlB,MAAME,UAAU,CAAA;EAC3F;EAGA,MAAMiB,cAA6B,CAC5B,GAAA,MAAM,KAAKhC,mBAAmBiC,cAC7BpB,MAAMqB,aAAarB,MAAMqB,UAAUC,iBAAiB,GAEpDpB,GAAAA,WAAWI,UACX,MAAM,KAAKnB,mBAAmBoC,aAC1BvB,MAAMqB,aAAarB,MAAMqB,UAAUG,kBACnCtB,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUI,mBAAmB;GACtD,MAAMC,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUI,iBAAiB;GAChE,KAAK,MAAMI,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK5C,mBAAmB6C,cAC3ChC,MAAMqB,UAAUI,kBAAkBI,YAClC3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbE,YAAYc,KAAI,GAAIF,QAAAA;IACxB;GACJ;EACJ;EAEA,IAAIZ,YAAYe,SAAS,GACrB,MAAM,KAAK7C,mBAAmBU,YAC1BG,YACAiB,aACA,gBACA,mBAAA;EAKR,MAAMgB,QAAiB,CAChB,GAAA,MAAM,KAAK/C,aAAagC,cACvBpB,MAAMqB,aAAarB,MAAMqB,UAAUe,WAAW,GAE9ClC,GAAAA,WAAWI,UACX,MAAM,KAAKlB,aAAamC,aACpBvB,MAAMqB,aAAarB,MAAMqB,UAAUgB,YACnCnC,WAAWI,OAAO,IAEtB,CAAA,CACP;EAED,IAAIN,MAAMqB,aAAarB,MAAMqB,UAAUiB,aAAa;GAChD,MAAMZ,aAAaC,OAAOC,KAAK5B,MAAMqB,UAAUiB,WAAW;GAC1D,KAAK,MAAMT,aAAaH,YAAY;IAChC,MAAMI,SAAS,MAAM,KAAK5C,iBAAiBkB,UAAU;KACjDC,MAAMwB;KACNvB,SAASJ,WAAWI;IACxB,CAAA;IAEA,IAAIwB,QAAQ;KACR,MAAMC,WAAW,MAAM,KAAK3C,aAAa4C,cACrChC,MAAMqB,UAAUiB,YAAYT,YAC5B3B,WAAWI,SACXwB,OAAOb,EAAE;KAEbkB,MAAMF,KAAI,GAAIF,QAAAA;IAClB;GACJ;EACJ;EAEA,IAAII,MAAMD,SAAS,GACf,MAAM,KAAK5C,aAAaS,YACpBG,YACAiC,OACA,UACA,aAAA;EAIR,OAAO;GACH,GAAGnC;GACHE;EACJ;CACJ;AACJ"}

package/dist/core/query/describe.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+import { Parameter } from '@rapiq/core';
+import type { Schema, SchemaDescription } from '@rapiq/core';
+/**
+ * The parameter subset advertised on single-record reads: a record
+ * response never advertises filter/sort/pagination vocabulary (no
+ * single read processes those). NOTE: today only the user/client
+ * single reads actually decode `fields`/`relations`
+ * (`decodeQuery(..., { parameters: ['fields', 'relations'] })`); the
+ * other record endpoints ignore the query entirely, so for them this
+ * advertisement is the TARGET vocabulary, not current behavior —
+ * converging them is tracked in plan 076.
+ */
+export declare const RECORD_QUERY_PARAMETERS: `${Parameter}`[];
+/**
+ * Serialize an entity schema's declared query constraints for the
+ * response `meta.schema` key (issue #1649) — the static upper bound of
+ * the queryable vocabulary. Relation capabilities are not expanded
+ * inline: `relations.schemas` names each relation's target schema,
+ * whose own endpoints carry its description. Actor-dependent gates
+ * (relations read gate, field visibility conditions) are deliberately
+ * not reflected. Descriptions are immutable per (schema, parameters),
+ * so they are memoized — callers MUST NOT mutate the returned object.
+ */
+export declare function describeQuerySchema(schema: Schema<any>, parameters?: `${Parameter}`[]): SchemaDescription;
+//# sourceMappingURL=describe.d.ts.map

package/dist/core/query/describe.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../../src/core/query/describe.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE7D;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,GAAG,SAAS,EAAE,EAGnD,CAAC;AAgBF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EACnB,UAAU,CAAC,EAAE,GAAG,SAAS,EAAE,EAAE,GAC7B,iBAAiB,CAgBpB"}

package/dist/core/query/describe.mjs ADDED Viewed

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { Parameter } from "@rapiq/core";
+//#region src/core/query/describe.ts
+/**
+* The parameter subset advertised on single-record reads: a record
+* response never advertises filter/sort/pagination vocabulary (no
+* single read processes those). NOTE: today only the user/client
+* single reads actually decode `fields`/`relations`
+* (`decodeQuery(..., { parameters: ['fields', 'relations'] })`); the
+* other record endpoints ignore the query entirely, so for them this
+* advertisement is the TARGET vocabulary, not current behavior —
+* converging them is tracked in plan 076.
+*/ const RECORD_QUERY_PARAMETERS = [Parameter.FIELDS, Parameter.RELATIONS];
+const cache = /* @__PURE__ */ new WeakMap();
+function deepFreeze(input) {
+	if (input !== null && typeof input === "object") {
+		for (const value of Object.values(input)) deepFreeze(value);
+		Object.freeze(input);
+	}
+	return input;
+}
+/**
+* Serialize an entity schema's declared query constraints for the
+* response `meta.schema` key (issue #1649) — the static upper bound of
+* the queryable vocabulary. Relation capabilities are not expanded
+* inline: `relations.schemas` names each relation's target schema,
+* whose own endpoints carry its description. Actor-dependent gates
+* (relations read gate, field visibility conditions) are deliberately
+* not reflected. Descriptions are immutable per (schema, parameters),
+* so they are memoized — callers MUST NOT mutate the returned object.
+*/ function describeQuerySchema(schema, parameters) {
+	let bySignature = cache.get(schema);
+	if (!bySignature) {
+		bySignature = /* @__PURE__ */ new Map();
+		cache.set(schema, bySignature);
+	}
+	const signature = parameters ? [...parameters].sort().join(",") : "*";
+	let output = bySignature.get(signature);
+	if (!output) {
+		output = deepFreeze(schema.describe(parameters ? { parameters } : {}));
+		bySignature.set(signature, output);
+	}
+	return output;
+}
+//#endregion
+export { RECORD_QUERY_PARAMETERS, describeQuerySchema };
+//# sourceMappingURL=describe.mjs.map

package/dist/core/query/describe.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"describe.mjs","names":["Parameter","RECORD_QUERY_PARAMETERS","FIELDS","RELATIONS","cache","WeakMap","deepFreeze","input","value","Object","values","freeze","describeQuerySchema","schema","parameters","bySignature","get","Map","set","signature","sort","join","output","describe"],"sources":["../../../src/core/query/describe.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Parameter } from '@rapiq/core';\nimport type { Schema, SchemaDescription } from '@rapiq/core';\n\n/**\n * The parameter subset advertised on single-record reads: a record\n * response never advertises filter/sort/pagination vocabulary (no\n * single read processes those). NOTE: today only the user/client\n * single reads actually decode `fields`/`relations`\n * (`decodeQuery(..., { parameters: ['fields', 'relations'] })`); the\n * other record endpoints ignore the query entirely, so for them this\n * advertisement is the TARGET vocabulary, not current behavior —\n * converging them is tracked in plan 076.\n */\nexport const RECORD_QUERY_PARAMETERS: `${Parameter}`[] = [\n Parameter.FIELDS,\n Parameter.RELATIONS,\n];\n\nconst cache = new WeakMap<Schema<any>, Map<string, SchemaDescription>>();\n\nfunction deepFreeze<T>(input: T) : T {\n if (input !== null && typeof input === 'object') {\n for (const value of Object.values(input)) {\n deepFreeze(value);\n }\n\n Object.freeze(input);\n }\n\n return input;\n}\n\n/**\n * Serialize an entity schema's declared query constraints for the\n * response `meta.schema` key (issue #1649) — the static upper bound of\n * the queryable vocabulary. Relation capabilities are not expanded\n * inline: `relations.schemas` names each relation's target schema,\n * whose own endpoints carry its description. Actor-dependent gates\n * (relations read gate, field visibility conditions) are deliberately\n * not reflected. Descriptions are immutable per (schema, parameters),\n * so they are memoized — callers MUST NOT mutate the returned object.\n */\nexport function describeQuerySchema(\n schema: Schema<any>,\n parameters?: `${Parameter}`[],\n) : SchemaDescription {\n let bySignature = cache.get(schema);\n if (!bySignature) {\n bySignature = new Map();\n cache.set(schema, bySignature);\n }\n\n const signature = parameters ? [...parameters].sort().join(',') : '*';\n\n let output = bySignature.get(signature);\n if (!output) {\n output = deepFreeze(schema.describe(parameters ? { parameters } : {}));\n bySignature.set(signature, output);\n }\n\n return output;\n}\n"],"mappings":";;;;;;;;;;;;;;GAoBA,MAAaC,0BAA4C,CACrDD,UAAUE,QACVF,UAAUG,SACb;AAED,MAAMC,wBAAQ,IAAIC,QAAAA;AAElB,SAASC,WAAcC,OAAQ;CAC3B,IAAIA,UAAU,QAAQ,OAAOA,UAAU,UAAU;EAC7C,KAAK,MAAMC,SAASC,OAAOC,OAAOH,KAAAA,GAC9BD,WAAWE,KAAAA;EAGfC,OAAOE,OAAOJ,KAAAA;CAClB;CAEA,OAAOA;AACX;;;;;;;;;;GAYA,SAAgBK,oBACZC,QACAC,YAA6B;CAE7B,IAAIC,cAAcX,MAAMY,IAAIH,MAAAA;CAC5B,IAAI,CAACE,aAAa;EACdA,8BAAc,IAAIE,IAAAA;EAClBb,MAAMc,IAAIL,QAAQE,WAAAA;CACtB;CAEA,MAAMI,YAAYL,aAAa,CAAIA,GAAAA,UAAW,CAAA,CAACM,KAAI,CAAA,CAAGC,KAAK,GAAA,IAAO;CAElE,IAAIC,SAASP,YAAYC,IAAIG,SAAAA;CAC7B,IAAI,CAACG,QAAQ;EACTA,SAAShB,WAAWO,OAAOU,SAAST,aAAa,EAAEA,WAAW,IAAI,CAAC,CAAA,CAAA;EACnEC,YAAYG,IAAIC,WAAWG,MAAAA;CAC/B;CAEA,OAAOA;AACX"}

package/dist/core/query/fields.d.ts ADDED Viewed

@@ -0,0 +1,44 @@
+import type { KeyValidationVerdict, KeyValidatorMany } from '@rapiq/core';
+import type { ActorContext } from '@authup/server-kit';
+import type { QueryDecodeContext } from './types.ts';
+/**
+ * Per-field read gate: given the acting identity, answer with a
+ * {@link KeyValidationVerdict} for one gated column — `true` to project
+ * it, `false` to strip it, or an `ICondition` to project it visible
+ * only on rows satisfying the condition (rapiq attaches it to the
+ * `Field` node; the repository layer enforces it after the fetch via
+ * `redactFieldConditions`).
+ *
+ * A returned condition must be authored FAIL-CLOSED over incomplete
+ * rows: `@rapiq/adapter-memory` unifies a missing column with `null`, so a
+ * negative predicate (`not(...)`, `ne(...)`) over an unselected column
+ * evaluates true and ships the value. The SQL adapter force-selects
+ * every column a condition references (rapiq#830's operand
+ * projection), so this is defense in depth — but prefer positive legs
+ * (`eq(x, true)`) plus an outer presence guard (`ne('realmId', null)`)
+ * over negated trees.
+ */
+export type FieldReadGate = (actor: ActorContext) => Promise<KeyValidationVerdict> | KeyValidationVerdict;
+/**
+ * Build a rapiq `fields.validateMany` hook gating individual columns on
+ * a per-actor verdict (issue #3322): invoked once per (governing
+ * schema, relation path) with every client-requested field, so a gate
+ * can compile the actor's permission tree once per query instead of
+ * once per field. The batched form matters because the gate applies
+ * uniformly at the query ROOT and under any relation path — the
+ * position where `ClientPermissionService` & co. serve
+ * `include=client&fields[client]=secret` never runs the client
+ * service's own read path.
+ *
+ * Ungated fields accept. Schema defaults never reach the hook, so an
+ * unqualified list request costs no evaluation. Caller classes mirror
+ * the relations read gate: a SYSTEM decode (no actor in the context)
+ * is unrestricted; every REQUEST decode carries an actor (anonymous
+ * ones hold no grants). A gate failure fails closed (strip).
+ *
+ * NOTE: schemas import this file DIRECTLY (never the `core/query`
+ * barrel) — the barrel reaches `module.ts`, which imports every
+ * schema; importing it from a schema would create a TDZ cycle.
+ */
+export declare function createFieldsReadGate(gates: Record<string, FieldReadGate>): KeyValidatorMany<QueryDecodeContext | undefined>;
+//# sourceMappingURL=fields.d.ts.map

package/dist/core/query/fields.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/core/query/fields.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,oBAAoB,EAEpB,gBAAgB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GACpC,gBAAgB,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAoBnD"}

package/dist/core/query/fields.mjs ADDED Viewed

@@ -0,0 +1,46 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/query/fields.ts
+/**
+* Build a rapiq `fields.validateMany` hook gating individual columns on
+* a per-actor verdict (issue #3322): invoked once per (governing
+* schema, relation path) with every client-requested field, so a gate
+* can compile the actor's permission tree once per query instead of
+* once per field. The batched form matters because the gate applies
+* uniformly at the query ROOT and under any relation path — the
+* position where `ClientPermissionService` & co. serve
+* `include=client&fields[client]=secret` never runs the client
+* service's own read path.
+*
+* Ungated fields accept. Schema defaults never reach the hook, so an
+* unqualified list request costs no evaluation. Caller classes mirror
+* the relations read gate: a SYSTEM decode (no actor in the context)
+* is unrestricted; every REQUEST decode carries an actor (anonymous
+* ones hold no grants). A gate failure fails closed (strip).
+*
+* NOTE: schemas import this file DIRECTLY (never the `core/query`
+* barrel) — the barrel reaches `module.ts`, which imports every
+* schema; importing it from a schema would create a TDZ cycle.
+*/ function createFieldsReadGate(gates) {
+	return async (names, context) => {
+		const record = {};
+		for (const name of names) {
+			const gate = gates[name];
+			if (!gate || !context || !context.actor) {
+				record[name] = true;
+				continue;
+			}
+			try {
+				record[name] = await gate(context.actor);
+			} catch {
+				record[name] = false;
+			}
+		}
+		return record;
+	};
+}
+//#endregion
+export { createFieldsReadGate };
+//# sourceMappingURL=fields.mjs.map

package/dist/core/query/fields.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"fields.mjs","names":["createFieldsReadGate","gates","names","context","record","name","gate","actor"],"sources":["../../../src/core/query/fields.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n KeyValidationVerdict,\n KeyValidationVerdictRecord,\n KeyValidatorMany,\n} from '@rapiq/core';\nimport type { ActorContext } from '@authup/server-kit';\nimport type { QueryDecodeContext } from './types.ts';\n\n/**\n * Per-field read gate: given the acting identity, answer with a\n * {@link KeyValidationVerdict} for one gated column — `true` to project\n * it, `false` to strip it, or an `ICondition` to project it visible\n * only on rows satisfying the condition (rapiq attaches it to the\n * `Field` node; the repository layer enforces it after the fetch via\n * `redactFieldConditions`).\n *\n * A returned condition must be authored FAIL-CLOSED over incomplete\n * rows: `@rapiq/adapter-memory` unifies a missing column with `null`, so a\n * negative predicate (`not(...)`, `ne(...)`) over an unselected column\n * evaluates true and ships the value. The SQL adapter force-selects\n * every column a condition references (rapiq#830's operand\n * projection), so this is defense in depth — but prefer positive legs\n * (`eq(x, true)`) plus an outer presence guard (`ne('realmId', null)`)\n * over negated trees.\n */\nexport type FieldReadGate = (actor: ActorContext) => Promise<KeyValidationVerdict> | KeyValidationVerdict;\n\n/**\n * Build a rapiq `fields.validateMany` hook gating individual columns on\n * a per-actor verdict (issue #3322): invoked once per (governing\n * schema, relation path) with every client-requested field, so a gate\n * can compile the actor's permission tree once per query instead of\n * once per field. The batched form matters because the gate applies\n * uniformly at the query ROOT and under any relation path — the\n * position where `ClientPermissionService` & co. serve\n * `include=client&fields[client]=secret` never runs the client\n * service's own read path.\n *\n * Ungated fields accept. Schema defaults never reach the hook, so an\n * unqualified list request costs no evaluation. Caller classes mirror\n * the relations read gate: a SYSTEM decode (no actor in the context)\n * is unrestricted; every REQUEST decode carries an actor (anonymous\n * ones hold no grants). A gate failure fails closed (strip).\n *\n * NOTE: schemas import this file DIRECTLY (never the `core/query`\n * barrel) — the barrel reaches `module.ts`, which imports every\n * schema; importing it from a schema would create a TDZ cycle.\n */\nexport function createFieldsReadGate(\n gates: Record<string, FieldReadGate>,\n) : KeyValidatorMany<QueryDecodeContext | undefined> {\n return async (names, context) => {\n const record : KeyValidationVerdictRecord = {};\n\n for (const name of names) {\n const gate = gates[name];\n if (!gate || !context || !context.actor) {\n record[name] = true;\n continue;\n }\n\n try {\n record[name] = await gate(context.actor);\n } catch {\n record[name] = false;\n }\n }\n\n return record;\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;GAuDA,SAAgBA,qBACZC,OAAoC;CAEpC,OAAO,OAAOC,OAAOC,YAAAA;EACjB,MAAMC,SAAsC,CAAC;EAE7C,KAAK,MAAMC,QAAQH,OAAO;GACtB,MAAMI,OAAOL,MAAMI;GACnB,IAAI,CAACC,QAAQ,CAACH,WAAW,CAACA,QAAQI,OAAO;IACrCH,OAAOC,QAAQ;IACf;GACJ;GAEA,IAAI;IACAD,OAAOC,QAAQ,MAAMC,KAAKH,QAAQI,KAAK;GAC3C,QAAQ;IACJH,OAAOC,QAAQ;GACnB;EACJ;EAEA,OAAOD;CACX;AACJ"}

package/dist/core/query/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+export * from './describe.ts';
 export * from './module.ts';
 export * from './relations.ts';
 export * from './types.ts';

package/dist/core/query/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/query/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/query/index.ts"],"names":[],"mappings":"AAOA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/core/query/index.mjs CHANGED Viewed

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "./describe.mjs";
 import { createRelationsReadGate } from "./relations.mjs";
 import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./module.mjs";
-export { appendQueryConditions, createRelationsReadGate, decodeQuery, queryCodec, schemaRegistry };
+export { RECORD_QUERY_PARAMETERS, appendQueryConditions, createRelationsReadGate, decodeQuery, describeQuerySchema, queryCodec, schemaRegistry };

package/dist/core/query/module.d.ts CHANGED Viewed

@@ -11,7 +11,7 @@ import type { DecodeQueryOptions } from './types.ts';
  * schemas are security policy over the domain types, and services
  * consume them to decode wire queries into the rapiq IR. A repository
  * layer MAY extend the registry with additional, storage-derived
- * schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`
+ * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`
  * with the `registry` option — already-registered schemas take
  * precedence), but the allow-lists themselves stay explicit and are
  * never auto-derived from entity metadata.

package/dist/core/query/module.mjs CHANGED Viewed

@@ -38,7 +38,7 @@ import { createURLCodec } from "@rapiq/codec-url";
 * schemas are security policy over the domain types, and services
 * consume them to decode wire queries into the rapiq IR. A repository
 * layer MAY extend the registry with additional, storage-derived
-* schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`
+* schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`
 * with the `registry` option — already-registered schemas take
 * precedence), but the allow-lists themselves stay explicit and are
 * never auto-derived from entity metadata.

package/dist/core/query/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n ICondition, \n IQuery, \n ObjectLiteral, \n Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/\n Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n \n The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n /\nexport const schemaRegistry = new SchemaRegistry();\n\nconst schemas : Schema<any>[] = [\n clientSchema,\n clientPermissionSchema,\n clientRoleSchema,\n clientScopeSchema,\n consentSchema,\n eventSchema,\n identityProviderSchema,\n identityProviderRoleMappingSchema,\n keySchema,\n permissionSchema,\n permissionPolicySchema,\n policySchema,\n realmSchema,\n roleSchema,\n roleAttributeSchema,\n rolePermissionSchema,\n scopeSchema,\n sessionSchema,\n trustAnchorSchema,\n userSchema,\n userAttributeSchema,\n userAuthenticatorSchema,\n userPermissionSchema,\n userRoleSchema,\n];\n\nfor (const schema of schemas) {\n schemaRegistry.add(schema);\n}\n\n/\n URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n /\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/\n Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n \n Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n /\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n input: unknown,\n options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n const normalized = isObject(input) \|\| typeof input === 'string' ? input : {};\n\n const parsed = await queryCodec.decodeAsync(normalized, {\n // Schema<RECORD> is invariant; the codec's non-generic options\n // accept Schema<ObjectLiteral>, so collapse the variance here.\n schema: options.schema as Schema<any> \| string,\n parameters: options.parameters,\n context: { actor: options.actor } satisfies QueryDecodeContext,\n });\n\n return parsed ?? new Query({});\n}\n\n/\n Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. The wrap makes\n * the appended scope non-displaceable: unlike a filters merge (per-field\n * replace, flat-root-AND restriction), a client-sent condition on the\n * same field intersects with the scope instead of replacing it, and\n * compound client trees (`or(...)`) are preserved as-is. Same guarantee\n * class as a mandatory `andWhere` at the repository — expressed once in\n * the IR. Appended conditions do not pass through `decodeQuery`, so the\n * schema allow-lists do not constrain them (server-derived context).\n \n Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over by reference, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n return new Query({\n fields: query.fields,\n filters: query.filters.and(...conditions),\n relations: query.relations,\n pagination: query.pagination,\n sorts: query.sorts,\n });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDA,MAAa4B,iBAAiB,IAAI1B,eAAAA;AAElC,MAAM2B,UAA0B;CAC5BzB;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAahC,eAAe4B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAajC,SAAS+B,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAIxC,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;GAmBA,SAAgByC,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI3C,MAAM;EACb4C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n ICondition, \n IQuery, \n ObjectLiteral, \n Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/\n Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n \n The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n /\nexport const schemaRegistry = new SchemaRegistry();\n\nconst schemas : Schema<any>[] = [\n clientSchema,\n clientPermissionSchema,\n clientRoleSchema,\n clientScopeSchema,\n consentSchema,\n eventSchema,\n identityProviderSchema,\n identityProviderRoleMappingSchema,\n keySchema,\n permissionSchema,\n permissionPolicySchema,\n policySchema,\n realmSchema,\n roleSchema,\n roleAttributeSchema,\n rolePermissionSchema,\n scopeSchema,\n sessionSchema,\n trustAnchorSchema,\n userSchema,\n userAttributeSchema,\n userAuthenticatorSchema,\n userPermissionSchema,\n userRoleSchema,\n];\n\nfor (const schema of schemas) {\n schemaRegistry.add(schema);\n}\n\n/\n URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n /\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/\n Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n \n Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n /\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n input: unknown,\n options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n const normalized = isObject(input) \|\| typeof input === 'string' ? input : {};\n\n const parsed = await queryCodec.decodeAsync(normalized, {\n // Schema<RECORD> is invariant; the codec's non-generic options\n // accept Schema<ObjectLiteral>, so collapse the variance here.\n schema: options.schema as Schema<any> \| string,\n parameters: options.parameters,\n context: { actor: options.actor } satisfies QueryDecodeContext,\n });\n\n return parsed ?? new Query({});\n}\n\n/\n Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. The wrap makes\n * the appended scope non-displaceable: unlike a filters merge (per-field\n * replace, flat-root-AND restriction), a client-sent condition on the\n * same field intersects with the scope instead of replacing it, and\n * compound client trees (`or(...)`) are preserved as-is. Same guarantee\n * class as a mandatory `andWhere` at the repository — expressed once in\n * the IR. Appended conditions do not pass through `decodeQuery`, so the\n * schema allow-lists do not constrain them (server-derived context).\n \n Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over by reference, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n return new Query({\n fields: query.fields,\n filters: query.filters.and(...conditions),\n relations: query.relations,\n pagination: query.pagination,\n sorts: query.sorts,\n });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDA,MAAa4B,iBAAiB,IAAI1B,eAAAA;AAElC,MAAM2B,UAA0B;CAC5BzB;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAahC,eAAe4B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAajC,SAAS+B,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAIxC,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;GAmBA,SAAgByC,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI3C,MAAM;EACb4C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}