@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/core/index.mjs

@@ -45,7 +45,7 @@ import { userRoleSchema } from "./entities/user-role/schema.mjs";
 import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./query/module.mjs";
 import "./query/index.mjs";
 import { ClientService } from "./entities/client/service.mjs";
-import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./entities/client/web-client.mjs";
+import { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes } from "./entities/client/system-clients.mjs";
 import { applyJunctionCreateGrant, buildJunctionUpdateData } from "./identity/permission/junction-grant.mjs";
 import { ClientPermissionService } from "./entities/client-permission/service.mjs";
 import { ClientRoleService } from "./entities/client-role/service.mjs";
@@ -150,6 +150,7 @@ import { RegistrationService } from "./identity/registration/service.mjs";
 import { IdentityResolver } from "./identity/resolver/module.mjs";
 import { IdentityRoleProvider } from "./identity/role/module.mjs";
 import "./identity/index.mjs";
+import { REALM_WILDCARD_NAME } from "./provisioning/constants.mjs";
 import { ProvisioningEntityStrategyType } from "./provisioning/strategy/constants.mjs";
 import { normalizeEntityProvisioningStrategy } from "./provisioning/strategy/normalize.mjs";
 import { ProvisioningStrategyValidator } from "./provisioning/strategy/validator.mjs";
@@ -161,8 +162,10 @@ import { ClientProvisioningValidator } from "./provisioning/entities/client/vali
 import { PolicyProvisioningValidator } from "./provisioning/entities/policy/validator.mjs";
 import { ScopeProvisioningValidator } from "./provisioning/entities/scope/validator.mjs";
 import { UserProvisioningValidator } from "./provisioning/entities/user/validator.mjs";
+import { RealmWildcardProvisioningValidator } from "./provisioning/entities/realm/wildcard-validator.mjs";
 import { RealmProvisioningValidator } from "./provisioning/entities/realm/validator.mjs";
 import { RootProvisioningValidator } from "./provisioning/entities/root/validator.mjs";
+import { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity } from "./provisioning/merge/module.mjs";
 import { ProvisioningEntityResolver } from "./provisioning/synchronizer/entity-resolver.mjs";
 import { ProvisioningJunctionSynchronizer } from "./provisioning/synchronizer/junction-synchronizer.mjs";
 import { ClientProvisioningSynchronizer } from "./provisioning/synchronizer/client/module.mjs";
@@ -173,6 +176,7 @@ import { RoleProvisioningSynchronizer } from "./provisioning/synchronizer/role/m
 import { GraphProvisioningSynchronizer } from "./provisioning/synchronizer/root/module.mjs";
 import { ScopeProvisioningSynchronizer } from "./provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "./provisioning/synchronizer/user/module.mjs";
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./provisioning/wildcard/module.mjs";
 import "./provisioning/index.mjs";
 import "./security/index.mjs";
-export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WEB_CLIENT_SCOPE_NAMES, WRAPPED_KEY_MATERIAL_PREFIX, WebClientProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };
+export { BaseCredentialsAuthenticator, CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientAuthenticator, ClientCertificateValidator, ClientCredentialsGrant, ClientCredentialsService, ClientPermissionService, ClientProvisioningSynchronizer, ClientProvisioningValidator, ClientRoleService, ClientScopeService, ClientService, ConsentService, CredentialsAuthenticator, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, GraphProvisioningSynchronizer, IDENTITY_PROVIDER_LDAP_COLLECTION_AUTHENTICATOR_TOKEN, IdentityGrantType, IdentityPermissionProvider, IdentityProviderAccountBaseMapper, IdentityProviderAccountManager, IdentityProviderAttributeMapper, IdentityProviderFacebookAuthenticator, IdentityProviderGithubAuthenticator, IdentityProviderGoogleAuthenticator, IdentityProviderInstagramAuthenticator, IdentityProviderLdapAuthenticator, IdentityProviderLdapCollectionAuthenticator, IdentityProviderMapperOperation, IdentityProviderOAuth2Authenticator, IdentityProviderOpenIDAuthenticator, IdentityProviderPaypalAuthenticator, IdentityProviderPermissionMapper, IdentityProviderRoleMapper, IdentityProviderRoleMappingService, IdentityResolver, IdentityRoleProvider, KEY_CERTIFICATE_ERROR_INSTANCE, KeyCertificateError, KeyProvisioner, KeyService, LoginThrottleService, MAIL_TEMPLATE_REGISTRY, MailTemplateName, MailTemplateRenderer, NoopAuthFlowMetrics, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PASSWORD_RESET_EXPIRES_IN_MINUTES, PasswordGrantType, PasswordRecoveryService, PermissionBindingPolicyEvaluator, PermissionCheckerService, PermissionPolicyService, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PermissionService, PolicyCheckerService, PolicyEngine, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, PolicyService, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_CIPHER_BLOB_ERROR_INSTANCE, REALM_CIPHER_BLOB_VERSION, REALM_WILDCARD_NAME, RECORD_QUERY_PARAMETERS, RealmCipher, RealmCipherBlobError, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmService, RealmWildcardProvisioningValidator, RegistrationService, RoleAttributeService, RolePermissionService, RoleProvisioningSynchronizer, RoleProvisioningValidator, RoleService, RootProvisioningValidator, SESSION_FILTER_KEYS, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, ScopeService, SessionManager, SessionService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticator, UserAuthenticatorService, UserCredentialsService, UserPermissionService, UserProvisioningSynchronizer, UserProvisioningValidator, UserRoleService, UserService, WRAPPED_KEY_MATERIAL_PREFIX, WildcardRealmProvisioner, appendQueryConditions, applyJunctionCreateGrant, assertCertificateMatchesKey, assertClientCertificateEvidenceValidForBinding, assertClientGrantAllowed, base64URLEncode, buildCertificateJwkFields, buildClientCertificateThumbprint, buildEntityDiff, buildJunctionUpdateData, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, buildProvisioningEntityKey, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, buildX5c, buildX5tS256, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, createIdentityProviderOAuth2Authenticator, createProvisioningEntitiesValidator, createRelationsReadGate, decodeQuery, defineMailTemplate, deriveAmrAcr, describeQuerySchema, eventSchema, expandWildcardRealmEntry, extractWildcardRealmEntry, generateNumericCode, generateOAuth2CodeVerifier, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, isRealmCipherBlobError, isWrappedKeyMaterial, keySchema, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy, parseCertificateChain, parseClientCertificateChain, permissionPolicySchema, permissionSchema, policySchema, queryCodec, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, schemaRegistry, scopeSchema, sessionSchema, toIdentityPolicyData, trustAnchorSchema, unwrapKeyMaterial, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration, wrapKeyMaterial };

package/dist/core/key/types.d.ts

@@ -1,6 +1,7 @@
 import type { Key } from '@authup/core-kit';
 import type { JWKUse } from '@authup/specs';
-export interface IKeyProvisioner {
+import type { IRealmProvisioner } from '../provisioning/types.ts';
+export interface IKeyProvisioner extends IRealmProvisioner {
     /**
      * Ensure the realm holds at least one sig and one enc key row.
      * Idempotent; never throws (provisioning must not fail realm creation

package/dist/core/key/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/key/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,SAAS;IACtB;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAElE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/key/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACtD;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,SAAS;IACtB;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAElE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/oauth2/authorization/code-request/verifier/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AAEpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CAsFhE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAWvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EACR,uCAAuC,EACvC,gDAAgD,EAChD,6CAA6C,EAChD,MAAM,YAAY,CAAC;AAEpB,qBAAa,sCAAuC,YAAW,uCAAuC;IAClG,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC;gBAEtC,GAAG,EAAE,6CAA6C;IAK9D;;;OAGG;IACG,MAAM,CACR,IAAI,EAAE,8BAA8B,GACpC,OAAO,CAAC,gDAAgD,CAAC;CA6FhE"}

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { assertClientGrantAllowed } from "../../../client/grant-type.mjs";
 import "../../../client/index.mjs";
-import { isSimpleMatch, isUUID } from "@authup/kit";
+import { isSimpleURLMatch, isUUID } from "@authup/kit";
 import { ScopeName, isClientPublic } from "@authup/core-kit";
 import { OAuth2ClientError, OAuth2GrantError, OAuth2RequestError, OAuth2ScopeError, OAuth2TokenGrant, hasOAuth2Scopes } from "@authup/specs";
 //#region src/core/oauth2/authorization/code-request/verifier/module.ts
@@ -37,7 +37,7 @@ var OAuth2AuthorizationCodeRequestVerifier = class {
 		const redirectUriVerified = !!data.redirect_uri;
 		if (data.redirect_uri) {
 			const redirectUris = client.redirectUri.split(",");
-			if (!isSimpleMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
+			if (!isSimpleURLMatch(data.redirect_uri, redirectUris)) throw OAuth2GrantError.redirectUriMismatch();
 		}
 		return {
 			data,

package/dist/core/oauth2/authorization/code-request/verifier/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ScopeName","isClientPublic","isSimpleMatch","isUUID","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","OAuth2TokenGrant","hasOAuth2Scopes","assertClientGrantAllowed","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","realm_id","malformed","client","findOneByIdOrName","active","inactive","AUTHORIZATION_CODE","redirectUri","redirectUriMismatch","code_challenge","state","id","realmId","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirectUriVerified","redirect_uri","redirectUris","split"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName, isClientPublic } from '@authup/core-kit';\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport {\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    OAuth2TokenGrant,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport { assertClientGrantAllowed } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        // A name-identified client needs a realm hint to resolve deterministically\n        // — every realm has a built-in `web` client, so `client_id=web` without a\n        // realm would bind to an arbitrary realm's client (and, post realm-gate,\n        // produce a confusing mismatch against a random realm). Require the hint.\n        if (!isUUID(data.client_id) && !data.realm_id) {\n            throw OAuth2RequestError.malformed('A realm is required to resolve a client by name.');\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // A non-null grant_types allowlist must cover the code flow — an RP\n        // misconfiguration fails at the front door, not at code redemption.\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        // OAuth 2.1 posture: a client with no registered redirect_uri pattern\n        // can never be matched — reject outright instead of trusting whatever\n        // redirect_uri the request carries (the server would otherwise issue a\n        // code to an attacker-supplied URI).\n        if (!client.redirectUri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        // Public clients MUST use PKCE (RFC 7636 §4.4.1, OAuth 2.1). Without\n        // PKCE a public client's code flow has no second factor — anyone who\n        // intercepts the redirect can redeem the code at /token. The code flow\n        // is the only supported response type, so this holds unconditionally.\n        if (isClientPublic(client) && !data.code_challenge) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (isClientPublic(client) && !data.state) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realmId;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        // Verified only when the request's redirect_uri matched a registered\n        // pattern (pattern-less clients were rejected above). A request without\n        // a redirect_uri (e.g. the GET page render) stays unverified so\n        // consumers never auto-redirect without a match.\n        const redirectUriVerified = !!data.redirect_uri;\n        if (data.redirect_uri) {\n            const redirectUris = client.redirectUri.split(',');\n\n            if (!isSimpleMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n            redirectUriVerified,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMb,kBAAkBc,QAAO;EAOnC,IAAI,CAACf,OAAOa,KAAKC,SAAS,KAAK,CAACD,KAAKG,UACjC,MAAMb,mBAAmBc,UAAU,kDAAA;EAGvC,MAAMC,SAAS,MAAM,KAAKT,iBAAiBU,kBAAkBN,KAAKC,WAAWD,KAAKG,QAAQ;EAC1F,IAAI,CAACE,QACD,MAAMjB,kBAAkBc,QAAO;EAGnC,IAAI,CAACG,OAAOE,QACR,MAAMnB,kBAAkBoB,SAAQ;EAKpCd,yBAAyBW,QAAQb,iBAAiBiB,kBAAkB;EAMpE,IAAI,CAACJ,OAAOK,aACR,MAAMrB,iBAAiBsB,oBAAmB;EAO9C,IAAI1B,eAAeoB,MAAAA,KAAW,CAACL,KAAKY,gBAChC,MAAMtB,mBAAmBc,UAAU,qDAAA;EAOvC,IAAInB,eAAeoB,MAAAA,KAAW,CAACL,KAAKa,OAChC,MAAMvB,mBAAmBc,UAAU,wDAAA;EAGvCJ,KAAKC,YAAYI,OAAOS;EACxBd,KAAKG,WAAWE,OAAOU;EAEvB,MAAMC,SAAS,MAAM,KAAKnB,gBAAgBoB,eAAeZ,OAAOS,EAAE;EAClE,MAAMI,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAIrB,KAAKoB,OAED;OAAA,CAAC3B,gBAAgByB,YAAYlB,KAAKoB,KAAK,KACvC,CAAC3B,gBAAgBO,KAAKoB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAM/B,iBAAiBgC,aAAY;EAAA,OAGvCvB,KAAKoB,QAAQF,WAAWM,KAAK,GAAA;EAOjC,MAAMC,sBAAsB,CAAC,CAACzB,KAAK0B;EACnC,IAAI1B,KAAK0B,cAAc;GACnB,MAAMC,eAAetB,OAAOK,YAAYkB,MAAM,GAAA;GAE9C,IAAI,CAAC1C,cAAcc,KAAK0B,cAAcC,YAAAA,GAClC,MAAMtC,iBAAiBsB,oBAAmB;EAElD;EAEA,OAAO;GACHX;GACAK;GACAW;GACAS;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ScopeName","isClientPublic","isSimpleURLMatch","isUUID","OAuth2ClientError","OAuth2GrantError","OAuth2RequestError","OAuth2ScopeError","OAuth2TokenGrant","hasOAuth2Scopes","assertClientGrantAllowed","OAuth2AuthorizationCodeRequestVerifier","clientRepository","scopeRepository","ctx","verify","data","client_id","invalid","realm_id","malformed","client","findOneByIdOrName","active","inactive","AUTHORIZATION_CODE","redirectUri","redirectUriMismatch","code_challenge","state","id","realmId","scopes","findByClientId","scopeNames","map","scope","name","GLOBAL","insufficient","join","redirectUriVerified","redirect_uri","redirectUris","split"],"sources":["../../../../../../src/core/oauth2/authorization/code-request/verifier/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { OAuth2AuthorizationCodeRequest } from '@authup/core-kit';\nimport { ScopeName, isClientPublic } from '@authup/core-kit';\nimport { isSimpleURLMatch, isUUID } from '@authup/kit';\nimport {\n    OAuth2ClientError,\n    OAuth2GrantError,\n    OAuth2RequestError,\n    OAuth2ScopeError,\n    OAuth2TokenGrant,\n    hasOAuth2Scopes,\n} from '@authup/specs';\nimport type { IOAuth2ClientRepository } from '../../../client/index.ts';\nimport { assertClientGrantAllowed } from '../../../client/index.ts';\nimport type { IOAuth2ScopeRepository } from '../../../scope/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeRequestVerifier,\n    OAuth2AuthorizationCodeRequestVerificationResult,\n    OAuth2AuthorizationCodeRequestVerifierContext,\n} from './types.ts';\n\nexport class OAuth2AuthorizationCodeRequestVerifier implements IOAuth2AuthorizationCodeRequestVerifier {\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected scopeRepository: IOAuth2ScopeRepository;\n\n    constructor(ctx: OAuth2AuthorizationCodeRequestVerifierContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n    }\n\n    /**\n     * Verify validated authorization code request.\n     * @param data\n     */\n    async verify(\n        data: OAuth2AuthorizationCodeRequest,\n    ) : Promise<OAuth2AuthorizationCodeRequestVerificationResult> {\n        if (!data.client_id) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        // A name-identified client needs a realm hint to resolve deterministically\n        // — client names are only unique per realm (every realm carries the\n        // same-named system clients, and a wildcard-provisioned client exists in\n        // every realm), so a bare name would bind to an arbitrary realm's client\n        // (and, post realm-gate, produce a confusing mismatch against a random\n        // realm). Require the hint.\n        if (!isUUID(data.client_id) && !data.realm_id) {\n            throw OAuth2RequestError.malformed('A realm is required to resolve a client by name.');\n        }\n\n        const client = await this.clientRepository.findOneByIdOrName(data.client_id, data.realm_id);\n        if (!client) {\n            throw OAuth2ClientError.invalid();\n        }\n\n        if (!client.active) {\n            throw OAuth2ClientError.inactive();\n        }\n\n        // A non-null grant_types allowlist must cover the code flow — an RP\n        // misconfiguration fails at the front door, not at code redemption.\n        assertClientGrantAllowed(client, OAuth2TokenGrant.AUTHORIZATION_CODE);\n\n        // OAuth 2.1 posture: a client with no registered redirect_uri pattern\n        // can never be matched — reject outright instead of trusting whatever\n        // redirect_uri the request carries (the server would otherwise issue a\n        // code to an attacker-supplied URI).\n        if (!client.redirectUri) {\n            throw OAuth2GrantError.redirectUriMismatch();\n        }\n\n        // Public clients MUST use PKCE (RFC 7636 §4.4.1, OAuth 2.1). Without\n        // PKCE a public client's code flow has no second factor — anyone who\n        // intercepts the redirect can redeem the code at /token. The code flow\n        // is the only supported response type, so this holds unconditionally.\n        if (isClientPublic(client) && !data.code_challenge) {\n            throw OAuth2RequestError.malformed('PKCE code_challenge is required for public clients.');\n        }\n\n        // Public clients SHOULD include state to bind the redirect to the\n        // initiating session and prevent CSRF (RFC 6749 §10.12). Confidential\n        // clients are exempt because the /token exchange already authenticates\n        // them via client_secret.\n        if (isClientPublic(client) && !data.state) {\n            throw OAuth2RequestError.malformed('state is required for public clients in the code flow.');\n        }\n\n        data.client_id = client.id;\n        data.realm_id = client.realmId;\n\n        const scopes = await this.scopeRepository.findByClientId(client.id);\n        const scopeNames = scopes.map((scope) => scope.name);\n        if (data.scope) {\n            if (\n                !hasOAuth2Scopes(scopeNames, data.scope) &&\n                !hasOAuth2Scopes(data.scope, ScopeName.GLOBAL)\n            ) {\n                throw OAuth2ScopeError.insufficient();\n            }\n        } else {\n            data.scope = scopeNames.join(' ');\n        }\n\n        // Verified only when the request's redirect_uri matched a registered\n        // pattern (pattern-less clients were rejected above). A request without\n        // a redirect_uri (e.g. the GET page render) stays unverified so\n        // consumers never auto-redirect without a match.\n        const redirectUriVerified = !!data.redirect_uri;\n        if (data.redirect_uri) {\n            const redirectUris = client.redirectUri.split(',');\n\n            // isSimpleURLMatch, never isSimpleMatch: the raw matcher treats `/`\n            // as its only boundary, so a `*` in a registered pattern's host\n            // absorbs a `?`, `#` or `\\` and the pattern's remaining host\n            // literal lands in the query of a foreign origin. The code would\n            // then be issued to that origin.\n            if (!isSimpleURLMatch(data.redirect_uri, redirectUris)) {\n                throw OAuth2GrantError.redirectUriMismatch();\n            }\n        }\n\n        return {\n            data,\n            client,\n            scopes,\n            redirectUriVerified,\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AA2BA,IAAaW,yCAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAoD;EAC5D,KAAKF,mBAAmBE,IAAIF;EAC5B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;IAMA,MAAME,OACFC,MAC0D;EAC1D,IAAI,CAACA,KAAKC,WACN,MAAMb,kBAAkBc,QAAO;EASnC,IAAI,CAACf,OAAOa,KAAKC,SAAS,KAAK,CAACD,KAAKG,UACjC,MAAMb,mBAAmBc,UAAU,kDAAA;EAGvC,MAAMC,SAAS,MAAM,KAAKT,iBAAiBU,kBAAkBN,KAAKC,WAAWD,KAAKG,QAAQ;EAC1F,IAAI,CAACE,QACD,MAAMjB,kBAAkBc,QAAO;EAGnC,IAAI,CAACG,OAAOE,QACR,MAAMnB,kBAAkBoB,SAAQ;EAKpCd,yBAAyBW,QAAQb,iBAAiBiB,kBAAkB;EAMpE,IAAI,CAACJ,OAAOK,aACR,MAAMrB,iBAAiBsB,oBAAmB;EAO9C,IAAI1B,eAAeoB,MAAAA,KAAW,CAACL,KAAKY,gBAChC,MAAMtB,mBAAmBc,UAAU,qDAAA;EAOvC,IAAInB,eAAeoB,MAAAA,KAAW,CAACL,KAAKa,OAChC,MAAMvB,mBAAmBc,UAAU,wDAAA;EAGvCJ,KAAKC,YAAYI,OAAOS;EACxBd,KAAKG,WAAWE,OAAOU;EAEvB,MAAMC,SAAS,MAAM,KAAKnB,gBAAgBoB,eAAeZ,OAAOS,EAAE;EAClE,MAAMI,aAAaF,OAAOG,KAAKC,UAAUA,MAAMC,IAAI;EACnD,IAAIrB,KAAKoB,OAED;OAAA,CAAC3B,gBAAgByB,YAAYlB,KAAKoB,KAAK,KACvC,CAAC3B,gBAAgBO,KAAKoB,OAAOpC,UAAUsC,MAAM,GAE7C,MAAM/B,iBAAiBgC,aAAY;EAAA,OAGvCvB,KAAKoB,QAAQF,WAAWM,KAAK,GAAA;EAOjC,MAAMC,sBAAsB,CAAC,CAACzB,KAAK0B;EACnC,IAAI1B,KAAK0B,cAAc;GACnB,MAAMC,eAAetB,OAAOK,YAAYkB,MAAM,GAAA;GAO9C,IAAI,CAAC1C,iBAAiBc,KAAK0B,cAAcC,YAAAA,GACrC,MAAMtC,iBAAiBsB,oBAAmB;EAElD;EAEA,OAAO;GACHX;GACAK;GACAW;GACAS;EACJ;CACJ;AACJ"}

package/dist/core/oauth2/end-session/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IASzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+GtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CAkBb"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/end-session/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EACR,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EACjC,MAAM,YAAY,CAAC;AAEpB,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAEpD,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;gBAEtB,GAAG,EAAE,8BAA8B;IASzC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAgHtE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2B/E;;;;;OAKG;IACH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAcvE;;;;OAIG;IACH,SAAS,CAAC,yBAAyB,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GAClB,OAAO;CAsBb"}

package/dist/core/oauth2/end-session/service.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { isSimpleMatch, isUUID } from "@authup/kit";
+import { isSimpleURLMatch, isUUID } from "@authup/kit";
 import { EventName, EventRefType, EventScope } from "@authup/core-kit";
 import { OAuth2TokenKind } from "@authup/specs";
 //#region src/core/oauth2/end-session/service.ts
@@ -121,7 +121,7 @@ var OAuth2EndSessionService = class {
 		}
 		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
 		if (!registered) return false;
-		return isSimpleMatch(candidate, registered.split(","));
+		return isSimpleURLMatch(candidate, registered.split(","));
 	}
 };
 //#endregion

package/dist/core/oauth2/end-session/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["isSimpleMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","postLogoutRedirectUri","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revokedSessionId","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n    IOAuth2EndSessionService,\n    OAuth2EndSessionRequest,\n    OAuth2EndSessionResult,\n    OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected sessionManager: ISessionManager;\n\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    protected hintGracePeriod: number;\n\n    constructor(ctx: OAuth2EndSessionServiceContext) {\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.clientRepository = ctx.clientRepository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n        this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n    }\n\n    async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n        let hintVerified = false;\n        let sub: string | undefined;\n        let subKind: string | undefined;\n        let sessionId: string | undefined;\n        let hintRealmId: string | undefined;\n        let audiences: string[] = [];\n\n        if (data.id_token_hint) {\n            try {\n                // Signature + kind are the anchors; exp is skipped (a logout hint\n                // is routinely expired) and the cache blocklist is irrelevant.\n                const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n                    ignoreExpiry: true,\n                    skipActiveCheck: true,\n                });\n\n                // MUST be an id_token — access/refresh tokens also carry\n                // session_id, so accepting them would let a leaked access token\n                // act as a logout weapon.\n                if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n                    hintVerified = true;\n                    sub = payload.sub;\n                    subKind = payload.sub_kind;\n                    sessionId = payload.sid ?? payload.session_id ?? undefined;\n                    hintRealmId = payload.realm_id ?? undefined;\n                    // aud may be a single string or an array (JWT spec).\n                    const { aud } = payload;\n                    if (Array.isArray(aud)) {\n                        audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n                    } else if (typeof aud === 'string') {\n                        audiences = [aud];\n                    }\n                }\n            } catch {\n                // forged / unverifiable hint → stays unverified (no revoke)\n            }\n        }\n\n        // Resolve a single client for the aud cross-check and redirect\n        // validation: the request's client_id, else the hint's sole audience\n        // (ambiguous for a multi-aud hint).\n        const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n        let client: Client | null = null;\n        if (clientId) {\n            // Scope a name-identified client to the request's realm hint; a\n            // VERIFIED hint's own realm claim serves as fallback (claims from an\n            // unverified hint are never trusted). No master fallback here\n            // (unlike /token): a bogus hint must NOT silently resolve a\n            // same-named client in master → null realm.\n            const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n            const realm = await this.realmRepository.resolve(realmKey, false);\n\n            // Fail closed instead of dropping the realm predicate: a supplied\n            // realm key that does not resolve never degrades to an unscoped\n            // lookup, and a NAME-form client_id without any realm key is\n            // ambiguous (every realm has a built-in `web` client — same rule as\n            // the /authorize verifier). A UUID is globally unique and needs no\n            // scope; the sole-aud-derived clientId is always a UUID.\n            if (realm) {\n                client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n            } else if (!realmKey && isUUID(clientId)) {\n                client = await this.clientRepository.findOneByIdOrName(clientId);\n            }\n        }\n\n        // aud/client_id cross-check: when the request supplies a client_id on a\n        // verified hint, it MUST denote one of the hint's audiences. The aud is\n        // the client UUID, so a name-form client_id is compared via its resolved\n        // client's id. Fail closed: an aud-less hint, or a name that did not\n        // resolve, counts as unverified.\n        if (hintVerified && data.client_id) {\n            const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n            if (audiences.length === 0 || !expected || !audiences.includes(expected)) {\n                hintVerified = false;\n                sub = undefined;\n                subKind = undefined;\n                sessionId = undefined;\n            }\n        }\n\n        let clientName: string | undefined;\n        let redirectUri: string | undefined;\n\n        // Redirect validation is independent of hint verification — the\n        // click-gated confirm page (unverified hint / hint-less request) still\n        // honors a registered post-logout redirect.\n        if (client) {\n            clientName = client.name;\n            if (\n                data.post_logout_redirect_uri &&\n                this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)\n            ) {\n                redirectUri = data.post_logout_redirect_uri;\n            }\n        }\n\n        return {\n            hintVerified,\n            ...(hintVerified ? {\n                sub,\n                subKind,\n                sessionId,\n            } : {}),\n            ...(clientId ? { clientId } : {}),\n            ...(clientName ? { clientName } : {}),\n            ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n        };\n    }\n\n    async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n        const session = await this.sessionManager.findOneById(sessionId);\n        if (!session) {\n            return false;\n        }\n\n        // Never revoke a session that does not belong to the hint's subject.\n        if (session.sub !== sub || session.subKind !== subKind) {\n            return false;\n        }\n\n        await this.sessionManager.revoke(sessionId);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGOUT,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            actorType: session.subKind as `${IdentityType}`,\n            actorId: session.sub,\n            realmId: session.realmId,\n            data: { revokedSessionId: sessionId },\n        });\n\n        return true;\n    }\n\n    /**\n     * With a positive `hintGracePeriod`, an expired hint is honored only within\n     * the window past `exp` — beyond it a leaked id_token stops being a\n     * replayable remote logout (the hint counts as unverified; the click-gated\n     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n     */\n    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n        if (this.hintGracePeriod <= 0) {\n            return true;\n        }\n\n        // a bounded window without an exp claim to judge against fails closed\n        if (typeof payload.exp !== 'number') {\n            return false;\n        }\n\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return nowSeconds - payload.exp <= this.hintGracePeriod;\n    }\n\n    /**\n     * A post-logout redirect is honored only when it is an absolute http(s) URL\n     * that matches a registered client redirect pattern (defense against open\n     * redirects to attacker-controlled URLs).\n     */\n    protected isValidPostLogoutRedirect(\n        registered: string | null | undefined,\n        candidate: string,\n    ): boolean {\n        let parsed: URL;\n        try {\n            parsed = new URL(candidate);\n        } catch {\n            return false;\n        }\n\n        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n            return false;\n        }\n\n        if (!registered) {\n            return false;\n        }\n\n        return isSimpleMatch(candidate, registered.split(','));\n    }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAI;GAEzB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAQ3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOc,uBAAuBzC,KAAKuC,wBAAwB,GAE1FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOvC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMyC,UAAU,MAAM,KAAKnD,eAAeoD,YAAYzC,SAAAA;EACtD,IAAI,CAACwC,SACD,OAAO;EAIX,IAAIA,QAAQ1C,QAAQA,OAAO0C,QAAQzC,YAAYA,SAC3C,OAAO;EAGX,MAAM,KAAKV,eAAekD,OAAOvC,SAAAA;EAEjC,MAAM,KAAKR,cAAckD,OAAO;GAC5BC,OAAO1D,WAAW2D;GAClBV,MAAMnD,UAAU8D;GAChBC,SAAS9D,aAAa+D;GACtBC,OAAOhD;GACPiD,WAAWT,QAAQzC;GACnBmD,SAASV,QAAQ1C;GACjBqD,SAASX,QAAQW;GACjBvD,MAAM,EAAEwD,kBAAkBpD,UAAU;EACxC,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQiD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAalD,QAAQiD,OAAO,KAAK5D;CAC5C;;;;;IAOA,0BACIkE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAGX,OAAO9E,cAAc+E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACrD;AACJ"}
+{"version":3,"file":"service.mjs","names":["isSimpleURLMatch","isUUID","EventName","EventRefType","EventScope","OAuth2TokenKind","OAuth2EndSessionService","tokenVerifier","sessionManager","clientRepository","realmRepository","eventService","hintGracePeriod","ctx","verify","data","hintVerified","sub","subKind","sessionId","hintRealmId","audiences","id_token_hint","payload","ignoreExpiry","skipActiveCheck","kind","ID_TOKEN","isWithinHintGraceWindow","sub_kind","sid","session_id","undefined","realm_id","aud","Array","isArray","filter","entry","clientId","client_id","length","client","realmKey","realm_name","realm","resolve","findOneByIdOrName","id","expected","includes","clientName","redirectUri","name","post_logout_redirect_uri","isValidPostLogoutRedirect","postLogoutRedirectUri","state","revoke","session","findOneById","record","scope","OAUTH2","LOGOUT","refType","SESSION","refId","actorType","actorId","realmId","revokedSessionId","exp","nowSeconds","Math","floor","Date","now","registered","candidate","parsed","URL","protocol","split"],"sources":["../../../../src/core/oauth2/end-session/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleURLMatch, isUUID } from '@authup/kit';\nimport type { Client, IdentityType } from '@authup/core-kit';\nimport { EventName, EventRefType, EventScope } from '@authup/core-kit';\nimport type { OAuth2TokenPayload } from '@authup/specs';\nimport { OAuth2TokenKind } from '@authup/specs';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { ISessionManager } from '../../authentication/index.ts';\nimport type { IOAuth2ClientRepository } from '../client/index.ts';\nimport type { IOAuth2TokenVerifier } from '../token/index.ts';\nimport type {\n    IOAuth2EndSessionService,\n    OAuth2EndSessionRequest,\n    OAuth2EndSessionResult,\n    OAuth2EndSessionServiceContext,\n} from './types.ts';\n\nexport class OAuth2EndSessionService implements IOAuth2EndSessionService {\n    protected tokenVerifier: IOAuth2TokenVerifier;\n\n    protected sessionManager: ISessionManager;\n\n    protected clientRepository: IOAuth2ClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected eventService?: IEventService;\n\n    protected hintGracePeriod: number;\n\n    constructor(ctx: OAuth2EndSessionServiceContext) {\n        this.tokenVerifier = ctx.tokenVerifier;\n        this.sessionManager = ctx.sessionManager;\n        this.clientRepository = ctx.clientRepository;\n        this.realmRepository = ctx.realmRepository;\n        this.eventService = ctx.eventService;\n        this.hintGracePeriod = ctx.hintGracePeriod ?? 0;\n    }\n\n    async verify(data: OAuth2EndSessionRequest): Promise<OAuth2EndSessionResult> {\n        let hintVerified = false;\n        let sub: string | undefined;\n        let subKind: string | undefined;\n        let sessionId: string | undefined;\n        let hintRealmId: string | undefined;\n        let audiences: string[] = [];\n\n        if (data.id_token_hint) {\n            try {\n                // Signature + kind are the anchors; exp is skipped (a logout hint\n                // is routinely expired) and the cache blocklist is irrelevant.\n                const payload = await this.tokenVerifier.verify(data.id_token_hint, {\n                    ignoreExpiry: true,\n                    skipActiveCheck: true,\n                });\n\n                // MUST be an id_token — access/refresh tokens also carry\n                // session_id, so accepting them would let a leaked access token\n                // act as a logout weapon.\n                if (payload.kind === OAuth2TokenKind.ID_TOKEN && this.isWithinHintGraceWindow(payload)) {\n                    hintVerified = true;\n                    sub = payload.sub;\n                    subKind = payload.sub_kind;\n                    sessionId = payload.sid ?? payload.session_id ?? undefined;\n                    hintRealmId = payload.realm_id ?? undefined;\n                    // aud may be a single string or an array (JWT spec).\n                    const { aud } = payload;\n                    if (Array.isArray(aud)) {\n                        audiences = aud.filter((entry): entry is string => typeof entry === 'string');\n                    } else if (typeof aud === 'string') {\n                        audiences = [aud];\n                    }\n                }\n            } catch {\n                // forged / unverifiable hint → stays unverified (no revoke)\n            }\n        }\n\n        // Resolve a single client for the aud cross-check and redirect\n        // validation: the request's client_id, else the hint's sole audience\n        // (ambiguous for a multi-aud hint).\n        const clientId = data.client_id ?? (audiences.length === 1 ? audiences[0] : undefined);\n\n        let client: Client | null = null;\n        if (clientId) {\n            // Scope a name-identified client to the request's realm hint; a\n            // VERIFIED hint's own realm claim serves as fallback (claims from an\n            // unverified hint are never trusted). No master fallback here\n            // (unlike /token): a bogus hint must NOT silently resolve a\n            // same-named client in master → null realm.\n            const realmKey = data.realm_id ?? data.realm_name ?? (hintVerified ? hintRealmId : undefined);\n            const realm = await this.realmRepository.resolve(realmKey, false);\n\n            // Fail closed instead of dropping the realm predicate: a supplied\n            // realm key that does not resolve never degrades to an unscoped\n            // lookup, and a NAME-form client_id without any realm key is\n            // ambiguous (client names are only unique per realm, and every\n            // realm carries the same-named system clients — same rule as the\n            // /authorize verifier). A UUID is globally unique and needs no\n            // scope; the sole-aud-derived clientId is always a UUID.\n            if (realm) {\n                client = await this.clientRepository.findOneByIdOrName(clientId, realm.id);\n            } else if (!realmKey && isUUID(clientId)) {\n                client = await this.clientRepository.findOneByIdOrName(clientId);\n            }\n        }\n\n        // aud/client_id cross-check: when the request supplies a client_id on a\n        // verified hint, it MUST denote one of the hint's audiences. The aud is\n        // the client UUID, so a name-form client_id is compared via its resolved\n        // client's id. Fail closed: an aud-less hint, or a name that did not\n        // resolve, counts as unverified.\n        if (hintVerified && data.client_id) {\n            const expected = isUUID(data.client_id) ? data.client_id : client?.id;\n            if (audiences.length === 0 || !expected || !audiences.includes(expected)) {\n                hintVerified = false;\n                sub = undefined;\n                subKind = undefined;\n                sessionId = undefined;\n            }\n        }\n\n        let clientName: string | undefined;\n        let redirectUri: string | undefined;\n\n        // Redirect validation is independent of hint verification — the\n        // click-gated confirm page (unverified hint / hint-less request) still\n        // honors a registered post-logout redirect.\n        if (client) {\n            clientName = client.name;\n            if (\n                data.post_logout_redirect_uri &&\n                this.isValidPostLogoutRedirect(client.postLogoutRedirectUri, data.post_logout_redirect_uri)\n            ) {\n                redirectUri = data.post_logout_redirect_uri;\n            }\n        }\n\n        return {\n            hintVerified,\n            ...(hintVerified ? {\n                sub,\n                subKind,\n                sessionId,\n            } : {}),\n            ...(clientId ? { clientId } : {}),\n            ...(clientName ? { clientName } : {}),\n            ...(redirectUri ? { redirectUri, ...(data.state ? { state: data.state } : {}) } : {}),\n        };\n    }\n\n    async revoke(sessionId: string, sub: string, subKind: string): Promise<boolean> {\n        const session = await this.sessionManager.findOneById(sessionId);\n        if (!session) {\n            return false;\n        }\n\n        // Never revoke a session that does not belong to the hint's subject.\n        if (session.sub !== sub || session.subKind !== subKind) {\n            return false;\n        }\n\n        await this.sessionManager.revoke(sessionId);\n\n        await this.eventService?.record({\n            scope: EventScope.OAUTH2,\n            name: EventName.LOGOUT,\n            refType: EventRefType.SESSION,\n            refId: sessionId,\n            actorType: session.subKind as `${IdentityType}`,\n            actorId: session.sub,\n            realmId: session.realmId,\n            data: { revokedSessionId: sessionId },\n        });\n\n        return true;\n    }\n\n    /**\n     * With a positive `hintGracePeriod`, an expired hint is honored only within\n     * the window past `exp` — beyond it a leaked id_token stops being a\n     * replayable remote logout (the hint counts as unverified; the click-gated\n     * confirm page still works). 0 keeps spec/Keycloak parity: any expired hint.\n     */\n    protected isWithinHintGraceWindow(payload: OAuth2TokenPayload): boolean {\n        if (this.hintGracePeriod <= 0) {\n            return true;\n        }\n\n        // a bounded window without an exp claim to judge against fails closed\n        if (typeof payload.exp !== 'number') {\n            return false;\n        }\n\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return nowSeconds - payload.exp <= this.hintGracePeriod;\n    }\n\n    /**\n     * A post-logout redirect is honored only when it is an absolute http(s) URL\n     * that matches a registered client redirect pattern (defense against open\n     * redirects to attacker-controlled URLs).\n     */\n    protected isValidPostLogoutRedirect(\n        registered: string | null | undefined,\n        candidate: string,\n    ): boolean {\n        let parsed: URL;\n        try {\n            parsed = new URL(candidate);\n        } catch {\n            return false;\n        }\n\n        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n            return false;\n        }\n\n        if (!registered) {\n            return false;\n        }\n\n        // isSimpleURLMatch, never isSimpleMatch: matched against the raw\n        // string, a `*` in a registered pattern's host absorbs a `?`, `#` or\n        // `\\`, which would turn this endpoint into a server-issued open\n        // redirect carrying `state`.\n        return isSimpleURLMatch(candidate, registered.split(','));\n    }\n}\n"],"mappings":";;;;;;;AAuBA,IAAaM,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAAqC;EAC7C,KAAKN,gBAAgBM,IAAIN;EACzB,KAAKC,iBAAiBK,IAAIL;EAC1B,KAAKC,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,kBAAkBC,IAAID,mBAAmB;CAClD;CAEA,MAAME,OAAOC,MAAgE;EACzE,IAAIC,eAAe;EACnB,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAIC,YAAsB,CAAA;EAE1B,IAAIN,KAAKO,eACL,IAAI;GAGA,MAAMC,UAAU,MAAM,KAAKhB,cAAcO,OAAOC,KAAKO,eAAe;IAChEE,cAAc;IACdC,iBAAiB;GACrB,CAAA;GAKA,IAAIF,QAAQG,SAASrB,gBAAgBsB,YAAY,KAAKC,wBAAwBL,OAAAA,GAAU;IACpFP,eAAe;IACfC,MAAMM,QAAQN;IACdC,UAAUK,QAAQM;IAClBV,YAAYI,QAAQO,OAAOP,QAAQQ,cAAcC,KAAAA;IACjDZ,cAAcG,QAAQU,YAAYD,KAAAA;IAElC,MAAM,EAAEE,QAAQX;IAChB,IAAIY,MAAMC,QAAQF,GAAAA,GACdb,YAAYa,IAAIG,QAAQC,UAA2B,OAAOA,UAAU,QAAA;SACjE,IAAI,OAAOJ,QAAQ,UACtBb,YAAY,CAACa,GAAI;GAEzB;EACJ,QAAQ,CAER;EAMJ,MAAMK,WAAWxB,KAAKyB,cAAcnB,UAAUoB,WAAW,IAAIpB,UAAU,KAAKW,KAAAA;EAE5E,IAAIU,SAAwB;EAC5B,IAAIH,UAAU;GAMV,MAAMI,WAAW5B,KAAKkB,YAAYlB,KAAK6B,eAAe5B,eAAeI,cAAcY,KAAAA;GACnF,MAAMa,QAAQ,MAAM,KAAKnC,gBAAgBoC,QAAQH,UAAU,KAAA;GAS3D,IAAIE,OACAH,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,UAAUM,MAAMG,EAAE;QACtE,IAAI,CAACL,YAAY1C,OAAOsC,QAAAA,GAC3BG,SAAS,MAAM,KAAKjC,iBAAiBsC,kBAAkBR,QAAAA;EAE/D;EAOA,IAAIvB,gBAAgBD,KAAKyB,WAAW;GAChC,MAAMS,WAAWhD,OAAOc,KAAKyB,SAAS,IAAIzB,KAAKyB,YAAYE,QAAQM;GACnE,IAAI3B,UAAUoB,WAAW,KAAK,CAACQ,YAAY,CAAC5B,UAAU6B,SAASD,QAAAA,GAAW;IACtEjC,eAAe;IACfC,MAAMe,KAAAA;IACNd,UAAUc,KAAAA;IACVb,YAAYa,KAAAA;GAChB;EACJ;EAEA,IAAImB;EACJ,IAAIC;EAKJ,IAAIV,QAAQ;GACRS,aAAaT,OAAOW;GACpB,IACItC,KAAKuC,4BACL,KAAKC,0BAA0Bb,OAAOc,uBAAuBzC,KAAKuC,wBAAwB,GAE1FF,cAAcrC,KAAKuC;EAE3B;EAEA,OAAO;GACHtC;GACA,GAAIA,eAAe;IACfC;IACAC;IACAC;GACJ,IAAI,CAAC;GACL,GAAIoB,WAAW,EAAEA,SAAS,IAAI,CAAC;GAC/B,GAAIY,aAAa,EAAEA,WAAW,IAAI,CAAC;GACnC,GAAIC,cAAc;IAAEA;IAAa,GAAIrC,KAAK0C,QAAQ,EAAEA,OAAO1C,KAAK0C,MAAM,IAAI,CAAC;GAAG,IAAI,CAAC;EACvF;CACJ;CAEA,MAAMC,OAAOvC,WAAmBF,KAAaC,SAAmC;EAC5E,MAAMyC,UAAU,MAAM,KAAKnD,eAAeoD,YAAYzC,SAAAA;EACtD,IAAI,CAACwC,SACD,OAAO;EAIX,IAAIA,QAAQ1C,QAAQA,OAAO0C,QAAQzC,YAAYA,SAC3C,OAAO;EAGX,MAAM,KAAKV,eAAekD,OAAOvC,SAAAA;EAEjC,MAAM,KAAKR,cAAckD,OAAO;GAC5BC,OAAO1D,WAAW2D;GAClBV,MAAMnD,UAAU8D;GAChBC,SAAS9D,aAAa+D;GACtBC,OAAOhD;GACPiD,WAAWT,QAAQzC;GACnBmD,SAASV,QAAQ1C;GACjBqD,SAASX,QAAQW;GACjBvD,MAAM,EAAEwD,kBAAkBpD,UAAU;EACxC,CAAA;EAEA,OAAO;CACX;;;;;;IAQA,wBAAkCI,SAAsC;EACpE,IAAI,KAAKX,mBAAmB,GACxB,OAAO;EAIX,IAAI,OAAOW,QAAQiD,QAAQ,UACvB,OAAO;EAIX,OADmBE,KAAKC,MAAMC,KAAKC,IAAG,IAAK,GACpCJ,IAAalD,QAAQiD,OAAO,KAAK5D;CAC5C;;;;;IAOA,0BACIkE,YACAC,WACO;EACP,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIC,IAAIF,SAAAA;EACrB,QAAQ;GACJ,OAAO;EACX;EAEA,IAAIC,OAAOE,aAAa,WAAWF,OAAOE,aAAa,UACnD,OAAO;EAGX,IAAI,CAACJ,YACD,OAAO;EAOX,OAAO9E,iBAAiB+E,WAAWD,WAAWK,MAAM,GAAA,CAAA;CACxD;AACJ"}

package/dist/core/provisioning/constants.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A realm provisioning entry declared with this name is a WILDCARD entry:
+ * its relations are ensured in every realm (existing at boot, new at
+ * creation) instead of declaring one specific realm. Literal only; partial
+ * patterns (`tenant-*`) are not supported.
+ */
+export declare const REALM_WILDCARD_NAME = "*";
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/provisioning/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/constants.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC"}

package/dist/core/provisioning/constants.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/provisioning/constants.ts
+/**
+* A realm provisioning entry declared with this name is a WILDCARD entry:
+* its relations are ensured in every realm (existing at boot, new at
+* creation) instead of declaring one specific realm. Literal only; partial
+* patterns (`tenant-*`) are not supported.
+*/ const REALM_WILDCARD_NAME = "*";
+//#endregion
+export { REALM_WILDCARD_NAME };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/provisioning/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["REALM_WILDCARD_NAME"],"sources":["../../../src/core/provisioning/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * A realm provisioning entry declared with this name is a WILDCARD entry:\n * its relations are ensured in every realm (existing at boot, new at\n * creation) instead of declaring one specific realm. Literal only; partial\n * patterns (`tenant-*`) are not supported.\n */\nexport const REALM_WILDCARD_NAME = '*';\n"],"mappings":";;;;;;;;;GAaA,MAAaA,sBAAsB"}

package/dist/core/provisioning/entities/index.mjs

@@ -15,8 +15,9 @@ import { ScopeProvisioningValidator } from "./scope/validator.mjs";
 import "./scope/index.mjs";
 import { UserProvisioningValidator } from "./user/validator.mjs";
 import "./user/index.mjs";
+import { RealmWildcardProvisioningValidator } from "./realm/wildcard-validator.mjs";
 import { RealmProvisioningValidator } from "./realm/validator.mjs";
 import "./realm/index.mjs";
 import { RootProvisioningValidator } from "./root/validator.mjs";
 import "./root/index.mjs";
-export { ClientProvisioningValidator, PermissionProvisioningRelationsValidator, PermissionProvisioningValidator, PolicyProvisioningValidator, RealmProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator, createProvisioningEntitiesValidator };
+export { ClientProvisioningValidator, PermissionProvisioningRelationsValidator, PermissionProvisioningValidator, PolicyProvisioningValidator, RealmProvisioningValidator, RealmWildcardProvisioningValidator, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningValidator, UserProvisioningValidator, createProvisioningEntitiesValidator };

package/dist/core/provisioning/entities/realm/index.d.ts

@@ -1,3 +1,4 @@
 export * from './types.ts';
 export * from './validator.ts';
+export * from './wildcard-validator.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/entities/realm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC"}

package/dist/core/provisioning/entities/realm/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { RealmWildcardProvisioningValidator } from "./wildcard-validator.mjs";
 import { RealmProvisioningValidator } from "./validator.mjs";
-export { RealmProvisioningValidator };
+export { RealmProvisioningValidator, RealmWildcardProvisioningValidator };

package/dist/core/provisioning/entities/realm/validator.d.ts

@@ -1,6 +1,17 @@
+import type { ContainerInput, ContainerRunOptions } from 'validup';
 import { Container } from 'validup';
+import { RealmWildcardProvisioningValidator } from './wildcard-validator.ts';
 import type { RealmProvisioningEntity } from './types.ts';
 export declare class RealmProvisioningValidator extends Container<RealmProvisioningEntity> {
+    protected wildcardValidator: RealmWildcardProvisioningValidator;
     protected initialize(): void;
+    /**
+     * A realm entry named with the literal wildcard ('*') is a selector
+     * over all realms and follows its own, stricter contract — dispatch it
+     * to the wildcard validator. Anything else (including partial patterns
+     * like 'tenant-*') runs the regular realm validation, where a
+     * non-name-safe character fails the name check.
+     */
+    run(input?: ContainerInput<RealmProvisioningEntity>, options?: ContainerRunOptions<RealmProvisioningEntity>): Promise<RealmProvisioningEntity>;
 }
 //# sourceMappingURL=validator.d.ts.map

package/dist/core/provisioning/entities/realm/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,qBAAa,0BAA2B,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IAC9E,SAAS,CAAC,UAAU;CAYvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,qBAAa,0BAA2B,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IAC9E,SAAS,CAAC,iBAAiB,qCAA4C;IAEvE,SAAS,CAAC,UAAU;IAapB;;;;;;OAMG;IACY,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,uBAAuB,CAAC,EAC/C,OAAO,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,GACvD,OAAO,CAAC,uBAAuB,CAAC;CAWtC"}

package/dist/core/provisioning/entities/realm/validator.mjs

@@ -1,13 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "../../constants.mjs";
 import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
 import "../../strategy/index.mjs";
 import { RealmProvisioningRelationsValidator } from "./relations-validator.mjs";
+import { RealmWildcardProvisioningValidator } from "./wildcard-validator.mjs";
+import { isObject } from "@authup/kit";
 import { RealmValidator } from "@authup/core-kit";
 import { Container } from "validup";
 //#region src/core/provisioning/entities/realm/validator.ts
 var RealmProvisioningValidator = class extends Container {
+	wildcardValidator = new RealmWildcardProvisioningValidator();
 	initialize() {
 		super.initialize();
 		const strategyValidator = new ProvisioningStrategyValidator();
@@ -17,6 +21,16 @@ var RealmProvisioningValidator = class extends Container {
 		const relationsValidator = new RealmProvisioningRelationsValidator();
 		this.mount("relations", { optional: true }, relationsValidator);
 	}
+	/**
+	* A realm entry named with the literal wildcard ('*') is a selector
+	* over all realms and follows its own, stricter contract — dispatch it
+	* to the wildcard validator. Anything else (including partial patterns
+	* like 'tenant-*') runs the regular realm validation, where a
+	* non-name-safe character fails the name check.
+	*/ async run(input, options) {
+		if (isObject(input) && isObject(input.attributes) && input.attributes.name === "*") return this.wildcardValidator.run(input, options);
+		return super.run(input, options);
+	}
 };
 //#endregion
 export { RealmProvisioningValidator };

package/dist/core/provisioning/entities/realm/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["RealmValidator","Container","ProvisioningStrategyValidator","RealmProvisioningRelationsValidator","RealmProvisioningValidator","initialize","strategyValidator","mount","optional","attributesValidator","relationsValidator"],"sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { RealmValidator } from '@authup/core-kit';\nimport { Container } from 'validup';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\n\nimport type { RealmProvisioningEntity } from './types.ts';\n\nexport class RealmProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new RealmValidator();\n        this.mount('attributes', attributesValidator);\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,6BAAb,cAAgDH,UAAAA;CAClCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIJ,8BAAAA;EAC9B,KAAKK,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIT,eAAAA;EAChC,KAAKO,MAAM,cAAcE,mBAAAA;EAEzB,MAAMC,qBAAqB,IAAIP,oCAAAA;EAC/B,KAAKI,MAAM,aAAa,EAAEC,UAAU,KAAK,GAAGE,kBAAAA;CAChD;AACJ"}
+{"version":3,"file":"validator.mjs","names":["RealmValidator","isObject","Container","REALM_WILDCARD_NAME","ProvisioningStrategyValidator","RealmProvisioningRelationsValidator","RealmWildcardProvisioningValidator","RealmProvisioningValidator","wildcardValidator","initialize","strategyValidator","mount","optional","attributesValidator","relationsValidator","run","input","options","attributes","name"],"sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { RealmValidator } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport type { ContainerInput, ContainerRunOptions } from 'validup';\nimport { Container } from 'validup';\nimport { REALM_WILDCARD_NAME } from '../../constants.ts';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\nimport { RealmWildcardProvisioningValidator } from './wildcard-validator.ts';\n\nimport type { RealmProvisioningEntity } from './types.ts';\n\nexport class RealmProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected wildcardValidator = new RealmWildcardProvisioningValidator();\n\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new RealmValidator();\n        this.mount('attributes', attributesValidator);\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n\n    /**\n     * A realm entry named with the literal wildcard ('*') is a selector\n     * over all realms and follows its own, stricter contract — dispatch it\n     * to the wildcard validator. Anything else (including partial patterns\n     * like 'tenant-*') runs the regular realm validation, where a\n     * non-name-safe character fails the name check.\n     */\n    override async run(\n        input?: ContainerInput<RealmProvisioningEntity>,\n        options?: ContainerRunOptions<RealmProvisioningEntity>,\n    ): Promise<RealmProvisioningEntity> {\n        if (\n            isObject(input) &&\n            isObject(input.attributes) &&\n            input.attributes.name === REALM_WILDCARD_NAME\n        ) {\n            return this.wildcardValidator.run(input, options);\n        }\n\n        return super.run(input, options);\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,IAAaO,6BAAb,cAAgDL,UAAAA;CAClCM,oBAAoB,IAAIF,mCAAAA;CAExBG,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIN,8BAAAA;EAC9B,KAAKO,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIb,eAAAA;EAChC,KAAKW,MAAM,cAAcE,mBAAAA;EAEzB,MAAMC,qBAAqB,IAAIT,oCAAAA;EAC/B,KAAKM,MAAM,aAAa,EAAEC,UAAU,KAAK,GAAGE,kBAAAA;CAChD;;;;;;;IASA,MAAeC,IACXC,OACAC,SACgC;EAChC,IACIhB,SAASe,KAAAA,KACTf,SAASe,MAAME,UAAU,KACzBF,MAAME,WAAWC,SAAAA,KAEjB,OAAO,KAAKX,kBAAkBO,IAAIC,OAAOC,OAAAA;EAG7C,OAAO,MAAMF,IAAIC,OAAOC,OAAAA;CAC5B;AACJ"}

package/dist/core/provisioning/entities/realm/wildcard-validator.d.ts

@@ -0,0 +1,19 @@
+import type { ContainerInput, ContainerRunOptions } from 'validup';
+import { Container } from 'validup';
+import type { RealmProvisioningEntity } from './types.ts';
+/**
+ * Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard
+ * entry is a selector over realms, not a realm declaration, so it is
+ * relations-only: `attributes` may carry nothing but the literal wildcard
+ * name, and a realm-level `strategy` is rejected (`absent` would mean
+ * "delete every realm"). Child strategies stay fully supported.
+ *
+ * Reserved client names (system / console clients) are rejected: a
+ * template stamping one into every realm would fight the system client
+ * MERGE on every boot.
+ */
+export declare class RealmWildcardProvisioningValidator extends Container<RealmProvisioningEntity> {
+    protected initialize(): void;
+    run(input?: ContainerInput<RealmProvisioningEntity>, options?: ContainerRunOptions<RealmProvisioningEntity>): Promise<RealmProvisioningEntity>;
+}
+//# sourceMappingURL=wildcard-validator.d.ts.map

package/dist/core/provisioning/entities/realm/wildcard-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildcard-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAS,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAiC,MAAM,SAAS,CAAC;AAInE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IACtF,SAAS,CAAC,UAAU;IA8BL,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,uBAAuB,CAAC,EAC/C,OAAO,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,GACvD,OAAO,CAAC,uBAAuB,CAAC;CAsBtC"}

package/dist/core/provisioning/entities/realm/wildcard-validator.mjs

@@ -0,0 +1,65 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "../../constants.mjs";
+import { RealmProvisioningRelationsValidator } from "./relations-validator.mjs";
+import { CLIENT_RESERVED_NAMES } from "@authup/core-kit";
+import { Container, ValidupError, defineIssueItem } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+//#region src/core/provisioning/entities/realm/wildcard-validator.ts
+/**
+* Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard
+* entry is a selector over realms, not a realm declaration, so it is
+* relations-only: `attributes` may carry nothing but the literal wildcard
+* name, and a realm-level `strategy` is rejected (`absent` would mean
+* "delete every realm"). Child strategies stay fully supported.
+*
+* Reserved client names (system / console clients) are rejected: a
+* template stamping one into every realm would fight the system client
+* MERGE on every boot.
+*/ var RealmWildcardProvisioningValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("attributes", createValidator(z.looseObject({ name: z.literal("*") }).check((ctx) => {
+			if (Object.keys(ctx.value).length > 1) ctx.issues.push({
+				code: "custom",
+				input: ctx.value,
+				message: "A wildcard realm entry is relations-only and can not declare realm attributes."
+			});
+		})));
+		this.mount("strategy", { optional: true }, createValidator(z.any().check((ctx) => {
+			ctx.issues.push({
+				code: "custom",
+				input: ctx.value,
+				message: "A wildcard realm entry can not declare a realm-level strategy."
+			});
+		})));
+		const relationsValidator = new RealmProvisioningRelationsValidator();
+		this.mount("relations", { optional: true }, relationsValidator);
+	}
+	async run(input, options) {
+		const output = await super.run(input, options);
+		const issues = [];
+		(output.relations?.clients ?? []).forEach((client, index) => {
+			const name = client.attributes?.name;
+			if (name && CLIENT_RESERVED_NAMES.includes(name)) issues.push(defineIssueItem({
+				path: [
+					"relations",
+					"clients",
+					index,
+					"attributes",
+					"name"
+				],
+				message: `The client name "${name}" is reserved for system clients and can not be declared in a wildcard realm entry.`,
+				received: name
+			}));
+		});
+		if (issues.length > 0) throw new ValidupError(issues);
+		return output;
+	}
+};
+//#endregion
+export { RealmWildcardProvisioningValidator };
+
+//# sourceMappingURL=wildcard-validator.mjs.map

package/dist/core/provisioning/entities/realm/wildcard-validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildcard-validator.mjs","names":["CLIENT_RESERVED_NAMES","createValidator","Container","ValidupError","defineIssueItem","z","REALM_WILDCARD_NAME","RealmProvisioningRelationsValidator","RealmWildcardProvisioningValidator","initialize","mount","looseObject","name","literal","check","ctx","keys","Object","value","length","issues","push","code","input","message","optional","any","relationsValidator","run","options","output","clients","relations","forEach","client","index","attributes","includes","path","received"],"sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_RESERVED_NAMES } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport type { ContainerInput, ContainerRunOptions, Issue } from 'validup';\nimport { Container, ValidupError, defineIssueItem } from 'validup';\nimport { z } from 'zod';\nimport { REALM_WILDCARD_NAME } from '../../constants.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\nimport type { RealmProvisioningEntity } from './types.ts';\n\n/**\n * Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard\n * entry is a selector over realms, not a realm declaration, so it is\n * relations-only: `attributes` may carry nothing but the literal wildcard\n * name, and a realm-level `strategy` is rejected (`absent` would mean\n * \"delete every realm\"). Child strategies stay fully supported.\n *\n * Reserved client names (system / console clients) are rejected: a\n * template stamping one into every realm would fight the system client\n * MERGE on every boot.\n */\nexport class RealmWildcardProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount('attributes', createValidator(\n            z.looseObject({ name: z.literal(REALM_WILDCARD_NAME) }).check((ctx) => {\n                const keys = Object.keys(ctx.value);\n                if (keys.length > 1) {\n                    ctx.issues.push({\n                        code: 'custom',\n                        input: ctx.value,\n                        message: 'A wildcard realm entry is relations-only and can not declare realm attributes.',\n                    });\n                }\n            }),\n        ));\n\n        this.mount('strategy', { optional: true }, createValidator(\n            z.any().check((ctx) => {\n                ctx.issues.push({\n                    code: 'custom',\n                    input: ctx.value,\n                    message: 'A wildcard realm entry can not declare a realm-level strategy.',\n                });\n            }),\n        ));\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n\n    override async run(\n        input?: ContainerInput<RealmProvisioningEntity>,\n        options?: ContainerRunOptions<RealmProvisioningEntity>,\n    ): Promise<RealmProvisioningEntity> {\n        const output = await super.run(input, options);\n\n        const issues : Issue[] = [];\n        const clients = output.relations?.clients ?? [];\n        clients.forEach((client, index) => {\n            const name = client.attributes?.name;\n            if (name && (CLIENT_RESERVED_NAMES as string[]).includes(name)) {\n                issues.push(defineIssueItem({\n                    path: ['relations', 'clients', index, 'attributes', 'name'],\n                    message: `The client name \"${name}\" is reserved for system clients and can not be declared in a wildcard realm entry.`,\n                    received: name,\n                }));\n            }\n        });\n\n        if (issues.length > 0) {\n            throw new ValidupError(issues);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;GA2BA,IAAaQ,qCAAb,cAAwDN,UAAAA;CAC1CO,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MAAM,cAAcT,gBACrBI,EAAEM,YAAY,EAAEC,MAAMP,EAAEQ,QAAAA,GAAQP,EAAqB,CAAA,CAAA,CAAGQ,OAAOC,QAAAA;GAE3D,IADaE,OAAOD,KAAKD,IAAIG,KACzBF,CAAAA,CAAKG,SAAS,GACdJ,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EAER,CAAA,CAAA,CAAA;EAGJ,KAAKd,MAAM,YAAY,EAAEe,UAAU,KAAK,GAAGxB,gBACvCI,EAAEqB,IAAG,CAAA,CAAGZ,OAAOC,QAAAA;GACXA,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EACJ,CAAA,CAAA,CAAA;EAGJ,MAAMG,qBAAqB,IAAIpB,oCAAAA;EAC/B,KAAKG,MAAM,aAAa,EAAEe,UAAU,KAAK,GAAGE,kBAAAA;CAChD;CAEA,MAAeC,IACXL,OACAM,SACgC;EAChC,MAAMC,SAAS,MAAM,MAAMF,IAAIL,OAAOM,OAAAA;EAEtC,MAAMT,SAAmB,CAAA;EAEzBW,CADgBD,OAAOE,WAAWD,WAAW,CAAA,EAAA,CACrCE,SAASC,QAAQC,UAAAA;GACrB,MAAMvB,OAAOsB,OAAOE,YAAYxB;GAChC,IAAIA,QAAQ,sBAAoCyB,SAASzB,IAAAA,GACrDQ,OAAOC,KAAKjB,gBAAgB;IACxBkC,MAAM;KAAC;KAAa;KAAWH;KAAO;KAAc;IAAO;IAC3DX,SAAS,oBAAoBZ,KAAK;IAClC2B,UAAU3B;GACd,CAAA,CAAA;EAER,CAAA;EAEA,IAAIQ,OAAOD,SAAS,GAChB,MAAM,IAAIhB,aAAaiB,MAAAA;EAG3B,OAAOU;CACX;AACJ"}

package/dist/core/provisioning/index.d.ts

@@ -1,5 +1,8 @@
+export * from './constants.ts';
 export * from './entities/index.ts';
+export * from './merge/index.ts';
 export * from './strategy/index.ts';
 export * from './synchronizer/index.ts';
 export * from './types.ts';
+export * from './wildcard/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC"}

package/dist/core/provisioning/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { REALM_WILDCARD_NAME } from "./constants.mjs";
 import { ProvisioningEntityStrategyType } from "./strategy/constants.mjs";
 import { normalizeEntityProvisioningStrategy } from "./strategy/normalize.mjs";
 import { ProvisioningStrategyValidator } from "./strategy/validator.mjs";
@@ -13,9 +14,12 @@ import { ClientProvisioningValidator } from "./entities/client/validator.mjs";
 import { PolicyProvisioningValidator } from "./entities/policy/validator.mjs";
 import { ScopeProvisioningValidator } from "./entities/scope/validator.mjs";
 import { UserProvisioningValidator } from "./entities/user/validator.mjs";
+import { RealmWildcardProvisioningValidator } from "./entities/realm/wildcard-validator.mjs";
 import { RealmProvisioningValidator } from "./entities/realm/validator.mjs";
 import { RootProvisioningValidator } from "./entities/root/validator.mjs";
 import "./entities/index.mjs";
+import { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity } from "./merge/module.mjs";
+import "./merge/index.mjs";
 import { ProvisioningEntityResolver } from "./synchronizer/entity-resolver.mjs";
 import { ProvisioningJunctionSynchronizer } from "./synchronizer/junction-synchronizer.mjs";
 import { ClientProvisioningSynchronizer } from "./synchronizer/client/module.mjs";
@@ -27,4 +31,6 @@ import { GraphProvisioningSynchronizer } from "./synchronizer/root/module.mjs";
 import { ScopeProvisioningSynchronizer } from "./synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "./synchronizer/user/module.mjs";
 import "./synchronizer/index.mjs";
-export { ClientProvisioningSynchronizer, ClientProvisioningValidator, GraphProvisioningSynchronizer, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RoleProvisioningSynchronizer, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, UserProvisioningSynchronizer, UserProvisioningValidator, createProvisioningEntitiesValidator, normalizeEntityProvisioningStrategy };
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./wildcard/module.mjs";
+import "./wildcard/index.mjs";
+export { ClientProvisioningSynchronizer, ClientProvisioningValidator, GraphProvisioningSynchronizer, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_WILDCARD_NAME, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmWildcardProvisioningValidator, RoleProvisioningSynchronizer, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, UserProvisioningSynchronizer, UserProvisioningValidator, WildcardRealmProvisioner, buildProvisioningEntityKey, createProvisioningEntitiesValidator, expandWildcardRealmEntry, extractWildcardRealmEntry, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy };

package/dist/core/provisioning/merge/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/merge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/merge/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/merge/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity } from "./module.mjs";
+export { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity };

package/dist/core/provisioning/merge/module.d.ts

@@ -0,0 +1,18 @@
+import type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';
+export declare function buildProvisioningEntityKey(attributes: MergeableProvisioningEntity['attributes']): string | undefined;
+export declare function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(target: T[] | undefined, source: T[] | undefined, options?: MergeProvisioningOptions): T[] | undefined;
+/**
+ * Deep-merge two entries sharing a composite key. The later (source) side
+ * wins per attribute, but relations are UNIONED — a later source (e.g. a
+ * mounted provisioning file) extending a built-in entry (the default
+ * source's master realm) must not silently drop the built-in relations
+ * (admin user, system client).
+ *
+ * Policy extraAttributes merge per key with the later source winning —
+ * like attributes, NOT like relations: an EA value (a names denylist,
+ * an ATTRIBUTES query tree) is policy configuration, and unioning would
+ * make shrinking a list impossible and fabricate predicates neither
+ * source authored.
+ */
+export declare function mergeProvisioningEntity(target: MergeableProvisioningEntity, source: MergeableProvisioningEntity, options?: MergeProvisioningOptions): MergeableProvisioningEntity;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/merge/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/merge/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAExF,wBAAgB,0BAA0B,CACtC,UAAU,EAAE,2BAA2B,CAAC,YAAY,CAAC,GACtD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,2BAA2B,EAC3E,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,EACvB,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,EACvB,OAAO,GAAE,wBAA6B,GACvC,CAAC,EAAE,GAAG,SAAS,CAoBjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,2BAA2B,EACnC,MAAM,EAAE,2BAA2B,EACnC,OAAO,GAAE,wBAA6B,GACvC,2BAA2B,CAiC7B"}