@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.59

package/dist/core/provisioning/merge/module.mjs

@@ -0,0 +1,82 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isObject } from "@authup/kit";
+//#region src/core/provisioning/merge/module.ts
+function buildProvisioningEntityKey(attributes) {
+	if (!attributes.name) return void 0;
+	return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
+}
+function mergeProvisioningEntities(target, source, options = {}) {
+	if (!source) return target;
+	if (!target) return [...source];
+	const result = [...target];
+	source.forEach((item) => {
+		const key = buildProvisioningEntityKey(item.attributes);
+		if (!key) {
+			result.push(item);
+			return;
+		}
+		const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);
+		if (idx !== -1) result[idx] = mergeProvisioningEntity(result[idx], item, options);
+		else result.push(item);
+	});
+	return result;
+}
+/**
+* Deep-merge two entries sharing a composite key. The later (source) side
+* wins per attribute, but relations are UNIONED — a later source (e.g. a
+* mounted provisioning file) extending a built-in entry (the default
+* source's master realm) must not silently drop the built-in relations
+* (admin user, system client).
+*
+* Policy extraAttributes merge per key with the later source winning —
+* like attributes, NOT like relations: an EA value (a names denylist,
+* an ATTRIBUTES query tree) is policy configuration, and unioning would
+* make shrinking a list impossible and fabricate predicates neither
+* source authored.
+*/ function mergeProvisioningEntity(target, source, options = {}) {
+	const output = {
+		...target,
+		...source
+	};
+	output.attributes = {
+		...target.attributes,
+		...source.attributes
+	};
+	const inheritStrategy = options.inheritStrategy ?? true;
+	if (target.strategy && !source.strategy) if (inheritStrategy) output.strategy = target.strategy;
+	else delete output.strategy;
+	if (target.relations && source.relations) output.relations = mergeProvisioningRecord(target.relations, source.relations, options);
+	else if (target.relations && !source.relations) output.relations = target.relations;
+	if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
+		...target.extraAttributes,
+		...source.extraAttributes
+	};
+	else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
+	if (target.children && source.children) output.children = mergeProvisioningEntities(target.children, source.children, options);
+	else if (target.children && !source.children) output.children = target.children;
+	return output;
+}
+function mergeProvisioningRecord(target, source, options = {}) {
+	const output = { ...target };
+	for (const key of Object.keys(source)) output[key] = key in target ? mergeProvisioningValue(target[key], source[key], options) : source[key];
+	return output;
+}
+function mergeProvisioningValue(target, source, options = {}) {
+	if (typeof target === "undefined") return source;
+	if (typeof source === "undefined") return target;
+	if (Array.isArray(target) && Array.isArray(source)) {
+		if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) return mergeProvisioningEntities(target, source, options);
+		return [.../* @__PURE__ */ new Set([...target, ...source])];
+	}
+	if (isObject(target) && isObject(source)) return mergeProvisioningRecord(target, source, options);
+	return source;
+}
+function isProvisioningEntityArray(value) {
+	return value.some((item) => isObject(item) && "attributes" in item);
+}
+//#endregion
+export { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/merge/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["isObject","buildProvisioningEntityKey","attributes","name","undefined","realmId","clientId","mergeProvisioningEntities","target","source","options","result","forEach","item","key","push","idx","findIndex","r","mergeProvisioningEntity","output","inheritStrategy","strategy","relations","mergeProvisioningRecord","extraAttributes","children","Object","keys","mergeProvisioningValue","Array","isArray","isProvisioningEntityArray","Set","value","some"],"sources":["../../../../src/core/provisioning/merge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';\n\nexport function buildProvisioningEntityKey(\n    attributes: MergeableProvisioningEntity['attributes'],\n): string | undefined {\n    if (!attributes.name) return undefined;\n    return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n}\n\nexport function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(\n    target: T[] | undefined,\n    source: T[] | undefined,\n    options: MergeProvisioningOptions = {},\n): T[] | undefined {\n    if (!source) return target;\n    if (!target) return [...source];\n\n    const result = [...target];\n    source.forEach((item) => {\n        const key = buildProvisioningEntityKey(item.attributes);\n        if (!key) {\n            result.push(item);\n            return;\n        }\n\n        const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);\n        if (idx !== -1) {\n            result[idx] = mergeProvisioningEntity(result[idx], item, options) as T;\n        } else {\n            result.push(item);\n        }\n    });\n    return result;\n}\n\n/**\n * Deep-merge two entries sharing a composite key. The later (source) side\n * wins per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n *\n * Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\nexport function mergeProvisioningEntity(\n    target: MergeableProvisioningEntity,\n    source: MergeableProvisioningEntity,\n    options: MergeProvisioningOptions = {},\n): MergeableProvisioningEntity {\n    const output = { ...target, ...source };\n\n    output.attributes = { ...target.attributes, ...source.attributes };\n\n    const inheritStrategy = options.inheritStrategy ?? true;\n    if (target.strategy && !source.strategy) {\n        if (inheritStrategy) {\n            output.strategy = target.strategy;\n        } else {\n            delete output.strategy;\n        }\n    }\n\n    if (target.relations && source.relations) {\n        output.relations = mergeProvisioningRecord(target.relations, source.relations, options);\n    } else if (target.relations && !source.relations) {\n        output.relations = target.relations;\n    }\n\n    if (target.extraAttributes && source.extraAttributes) {\n        output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n    } else if (target.extraAttributes && !source.extraAttributes) {\n        output.extraAttributes = target.extraAttributes;\n    }\n\n    if (target.children && source.children) {\n        output.children = mergeProvisioningEntities(target.children, source.children, options);\n    } else if (target.children && !source.children) {\n        output.children = target.children;\n    }\n\n    return output;\n}\n\nfunction mergeProvisioningRecord(\n    target: Record<string, unknown>,\n    source: Record<string, unknown>,\n    options: MergeProvisioningOptions = {},\n): Record<string, unknown> {\n    const output : Record<string, unknown> = { ...target };\n    for (const key of Object.keys(source)) {\n        output[key] = key in target ?\n            mergeProvisioningValue(target[key], source[key], options) :\n            source[key];\n    }\n    return output;\n}\n\nfunction mergeProvisioningValue(\n    target: unknown,\n    source: unknown,\n    options: MergeProvisioningOptions = {},\n): unknown {\n    if (typeof target === 'undefined') return source;\n    if (typeof source === 'undefined') return target;\n\n    if (Array.isArray(target) && Array.isArray(source)) {\n        if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) {\n            return mergeProvisioningEntities(\n                target as MergeableProvisioningEntity[],\n                source as MergeableProvisioningEntity[],\n                options,\n            );\n        }\n        return [...new Set([...target, ...source])];\n    }\n\n    if (isObject(target) && isObject(source)) {\n        return mergeProvisioningRecord(target, source, options);\n    }\n\n    return source;\n}\n\nfunction isProvisioningEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n    return value.some(\n        (item) => isObject(item) && 'attributes' in item,\n    );\n}\n"],"mappings":";;;;;AAUA,SAAgBC,2BACZC,YAAqD;CAErD,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;CAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;AACpF;AAEA,SAAgBC,0BACZC,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,CAACD,QAAQ,OAAOD;CACpB,IAAI,CAACA,QAAQ,OAAO,CAAIC,GAAAA,MAAO;CAE/B,MAAME,SAAS,CAAIH,GAAAA,MAAO;CAC1BC,OAAOG,SAASC,SAAAA;EACZ,MAAMC,MAAMb,2BAA2BY,KAAKX,UAAU;EACtD,IAAI,CAACY,KAAK;GACNH,OAAOI,KAAKF,IAAAA;GACZ;EACJ;EAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAMjB,2BAA2BiB,EAAEhB,UAAU,MAAMY,GAAAA;EACjF,IAAIE,QAAQ,IACRL,OAAOK,OAAOG,wBAAwBR,OAAOK,MAAMH,MAAMH,OAAAA;OAEzDC,OAAOI,KAAKF,IAAAA;CAEpB,CAAA;CACA,OAAOF;AACX;;;;;;;;;;;;;GAeA,SAAgBQ,wBACZX,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAS;EAAE,GAAGZ;EAAQ,GAAGC;CAAO;CAEtCW,OAAOlB,aAAa;EAAE,GAAGM,OAAON;EAAY,GAAGO,OAAOP;CAAW;CAEjE,MAAMmB,kBAAkBX,QAAQW,mBAAmB;CACnD,IAAIb,OAAOc,YAAY,CAACb,OAAOa,UAC3B,IAAID,iBACAD,OAAOE,WAAWd,OAAOc;MAEzB,OAAOF,OAAOE;CAItB,IAAId,OAAOe,aAAad,OAAOc,WAC3BH,OAAOG,YAAYC,wBAAwBhB,OAAOe,WAAWd,OAAOc,WAAWb,OAAAA;MAC5E,IAAIF,OAAOe,aAAa,CAACd,OAAOc,WACnCH,OAAOG,YAAYf,OAAOe;CAG9B,IAAIf,OAAOiB,mBAAmBhB,OAAOgB,iBACjCL,OAAOK,kBAAkB;EAAE,GAAGjB,OAAOiB;EAAiB,GAAGhB,OAAOgB;CAAgB;MAC7E,IAAIjB,OAAOiB,mBAAmB,CAAChB,OAAOgB,iBACzCL,OAAOK,kBAAkBjB,OAAOiB;CAGpC,IAAIjB,OAAOkB,YAAYjB,OAAOiB,UAC1BN,OAAOM,WAAWnB,0BAA0BC,OAAOkB,UAAUjB,OAAOiB,UAAUhB,OAAAA;MAC3E,IAAIF,OAAOkB,YAAY,CAACjB,OAAOiB,UAClCN,OAAOM,WAAWlB,OAAOkB;CAG7B,OAAON;AACX;AAEA,SAASI,wBACLhB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAmC,EAAE,GAAGZ,OAAO;CACrD,KAAK,MAAMM,OAAOa,OAAOC,KAAKnB,MAAAA,GAC1BW,OAAON,OAAOA,OAAON,SACjBqB,uBAAuBrB,OAAOM,MAAML,OAAOK,MAAMJ,OAAAA,IACjDD,OAAOK;CAEf,OAAOM;AACX;AAEA,SAASS,uBACLrB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,OAAOF,WAAW,aAAa,OAAOC;CAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOD;CAE1C,IAAIsB,MAAMC,QAAQvB,MAAAA,KAAWsB,MAAMC,QAAQtB,MAAAA,GAAS;EAChD,IAAIuB,0BAA0BxB,MAAAA,KAAWwB,0BAA0BvB,MAAAA,GAC/D,OAAOF,0BACHC,QACAC,QACAC,OAAAA;EAGR,OAAO,CAAI,mBAAA,IAAIuB,IAAI,CAAIzB,GAAAA,QAAWC,GAAAA,MAAO,CAAA,CAAE;CAC/C;CAEA,IAAIT,SAASQ,MAAAA,KAAWR,SAASS,MAAAA,GAC7B,OAAOe,wBAAwBhB,QAAQC,QAAQC,OAAAA;CAGnD,OAAOD;AACX;AAEA,SAASuB,0BAA0BE,OAAgB;CAC/C,OAAOA,MAAMC,MACRtB,SAASb,SAASa,IAAAA,KAAS,gBAAgBA,IAAAA;AAEpD"}

package/dist/core/provisioning/merge/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Structural view of a provisioning entity used by the deep merge.
+ * Covers every entity shape (realm, client, user, role, permission, scope,
+ * policy): the composite-key attribute bag plus the deep-mergeable groups.
+ */
+export type MergeProvisioningOptions = {
+    /**
+     * May a source entry that declares no `strategy` inherit the target's?
+     *
+     * True for the composite source, where target/source are "earlier file"
+     * and "later file" and inheriting an unspecified strategy is the
+     * documented rule.
+     *
+     * False for the wildcard expansion, where the precedence is INVERTED:
+     * the target is the wildcard (low precedence) and the source is an
+     * explicit realm block (high precedence). Inheriting there would let a
+     * wildcard child supply the lifecycle of an entity the operator declared
+     * explicitly, and `absent` is part of that vocabulary, so a wildcard
+     * sweep would delete the very row the explicit block declares.
+     */
+    inheritStrategy?: boolean;
+};
+export type MergeableProvisioningEntity = {
+    attributes: {
+        name?: string;
+        realmId?: string | null;
+        clientId?: string | null;
+    };
+    strategy?: unknown;
+    relations?: Record<string, unknown>;
+    children?: MergeableProvisioningEntity[];
+    extraAttributes?: Record<string, unknown>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/merge/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/merge/types.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C,CAAC"}

package/dist/core/provisioning/merge/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/types.d.ts

@@ -1,8 +1,18 @@
+import type { Realm } from '@authup/core-kit';
 import type { RootProvisioningEntity } from './entities/index.ts';
 import type { IContainer } from 'eldin';
 export interface IProvisioningSource {
     load(container: IContainer): Promise<RootProvisioningEntity>;
 }
+/**
+ * A provisioner invoked for one realm: at startup (backfill over every
+ * existing realm) and on runtime realm creation (`RealmService.save`).
+ * Implementations must be idempotent; a failure must never fail realm
+ * creation (the caller logs and continues).
+ */
+export interface IRealmProvisioner {
+    ensureForRealm(realm: Realm): Promise<void>;
+}
 export interface IProvisioningSynchronizer<T> {
     synchronize(input: T): Promise<T>;
     synchronizeMany(input: T[]): Promise<T[]>;

package/dist/core/provisioning/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C"}

package/dist/core/provisioning/wildcard/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/wildcard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/wildcard/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./module.mjs";
+export { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry };

package/dist/core/provisioning/wildcard/module.d.ts

@@ -0,0 +1,53 @@
+import type { Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { RealmProvisioningEntity, RealmProvisioningRelations } from '../entities/index.ts';
+import type { IProvisioningSynchronizer, IRealmProvisioner } from '../types.ts';
+import type { WildcardRealmProvisionerContext } from './types.ts';
+/**
+ * Split the wildcard entries (attributes.name === '*') out of
+ * `data.realms`, folding multiples (several files, several entries) into
+ * one via the composite merge rules. The folded entry is stripped to a
+ * relations-only shape: a wildcard entry is a SELECTOR over realms, so
+ * realm-level attributes and a realm-level strategy carry no meaning
+ * (validated away on the file path; discarded structurally here so
+ * programmatic sources get the same semantics).
+ */
+export declare function extractWildcardRealmEntry(data: {
+    realms?: RealmProvisioningEntity[];
+}): RealmProvisioningEntity | undefined;
+/**
+ * Deep-merge the wildcard entry UNDER every explicit realm entry (explicit
+ * wins per attribute, relation lists union, the explicit child's strategy
+ * wins when it carries one) so the graph sync covers those realms in
+ * one pass. Returns the merged relations per canonical realm name, kept
+ * PRISTINE (cloned before the sync mutates anything) for the runtime
+ * creation hook.
+ */
+export declare function expandWildcardRealmEntry(wildcard: RealmProvisioningEntity, data: {
+    realms?: RealmProvisioningEntity[];
+}): Map<string, RealmProvisioningRelations>;
+/**
+ * Applies the wildcard entry's relations to ONE realm, by synthesizing a
+ * realm provisioning entity and pushing it through the regular realm
+ * synchronizer (scopes -> clients -> permissions -> roles -> users; the
+ * realm row itself is resolved by name and, carrying no strategy, is
+ * never modified). The entry is deep-cloned per application: the
+ * synchronizer mutates its input (realmId stamping, `replace` writes the
+ * resolved row id back), so a shared object would leak one realm's ids
+ * into the next realm's sync.
+ */
+export declare class WildcardRealmProvisioner implements IRealmProvisioner {
+    protected relations: RealmProvisioningRelations;
+    protected relationsByRealmName?: Map<string, RealmProvisioningRelations>;
+    protected synchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;
+    protected logger?: Logger;
+    constructor(ctx: WildcardRealmProvisionerContext);
+    /**
+     * True when the loaded config also declares this realm explicitly:
+     * the startup graph sync already covers it (expansion), so the boot
+     * backfill loop skips it.
+     */
+    hasExplicitEntry(realm: Realm): boolean;
+    ensureForRealm(realm: Realm): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/wildcard/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEhG,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAMlE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACrC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;CAAE,GAC7C,uBAAuB,GAAG,SAAS,CAyBrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACpC,QAAQ,EAAE,uBAAuB,EACjC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;CAAE,GAC7C,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CA8BzC;AAED;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAC9D,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAEhD,SAAS,CAAC,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAE3E,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,+BAA+B;IAOhD;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO;IAOjC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBpD"}

package/dist/core/provisioning/wildcard/module.mjs

@@ -0,0 +1,91 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "../constants.mjs";
+import { mergeProvisioningEntity } from "../merge/module.mjs";
+import "../merge/index.mjs";
+//#region src/core/provisioning/wildcard/module.ts
+function canonicalizeRealmName(name) {
+	return name.trim().toLowerCase();
+}
+/**
+* Split the wildcard entries (attributes.name === '*') out of
+* `data.realms`, folding multiples (several files, several entries) into
+* one via the composite merge rules. The folded entry is stripped to a
+* relations-only shape: a wildcard entry is a SELECTOR over realms, so
+* realm-level attributes and a realm-level strategy carry no meaning
+* (validated away on the file path; discarded structurally here so
+* programmatic sources get the same semantics).
+*/ function extractWildcardRealmEntry(data) {
+	if (!data.realms || data.realms.length === 0) return;
+	const wildcards = data.realms.filter((entry) => entry.attributes.name === "*");
+	if (wildcards.length === 0) return;
+	data.realms = data.realms.filter((entry) => entry.attributes.name !== "*");
+	let folded = wildcards[0];
+	for (let i = 1; i < wildcards.length; i++) folded = mergeProvisioningEntity(folded, wildcards[i]);
+	return {
+		attributes: { name: "*" },
+		relations: folded.relations ?? {}
+	};
+}
+/**
+* Deep-merge the wildcard entry UNDER every explicit realm entry (explicit
+* wins per attribute, relation lists union, the explicit child's strategy
+* wins when it carries one) so the graph sync covers those realms in
+* one pass. Returns the merged relations per canonical realm name, kept
+* PRISTINE (cloned before the sync mutates anything) for the runtime
+* creation hook.
+*/ function expandWildcardRealmEntry(wildcard, data) {
+	const variants = /* @__PURE__ */ new Map();
+	if (data.realms) data.realms = data.realms.map((entry) => {
+		const merged = mergeProvisioningEntity(structuredClone(wildcard), entry, { inheritStrategy: false });
+		if (entry.attributes.name) variants.set(canonicalizeRealmName(entry.attributes.name), structuredClone(merged.relations ?? {}));
+		return merged;
+	});
+	return variants;
+}
+/**
+* Applies the wildcard entry's relations to ONE realm, by synthesizing a
+* realm provisioning entity and pushing it through the regular realm
+* synchronizer (scopes -> clients -> permissions -> roles -> users; the
+* realm row itself is resolved by name and, carrying no strategy, is
+* never modified). The entry is deep-cloned per application: the
+* synchronizer mutates its input (realmId stamping, `replace` writes the
+* resolved row id back), so a shared object would leak one realm's ids
+* into the next realm's sync.
+*/ var WildcardRealmProvisioner = class {
+	relations;
+	relationsByRealmName;
+	synchronizer;
+	logger;
+	constructor(ctx) {
+		this.relations = ctx.relations;
+		this.relationsByRealmName = ctx.relationsByRealmName;
+		this.synchronizer = ctx.synchronizer;
+		this.logger = ctx.logger;
+	}
+	/**
+	* True when the loaded config also declares this realm explicitly:
+	* the startup graph sync already covers it (expansion), so the boot
+	* backfill loop skips it.
+	*/ hasExplicitEntry(realm) {
+		if (!this.relationsByRealmName || !realm.name) return false;
+		return this.relationsByRealmName.has(canonicalizeRealmName(realm.name));
+	}
+	async ensureForRealm(realm) {
+		if (!realm.name) {
+			this.logger?.warn(`Skipping wildcard realm provisioning for realm ${realm.id}: the realm carries no name.`);
+			return;
+		}
+		const name = canonicalizeRealmName(realm.name);
+		const relations = this.relationsByRealmName?.get(name) ?? this.relations;
+		await this.synchronizer.synchronize(structuredClone({
+			attributes: { name },
+			relations
+		}));
+	}
+};
+//#endregion
+export { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/wildcard/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["REALM_WILDCARD_NAME","mergeProvisioningEntity","canonicalizeRealmName","name","trim","toLowerCase","extractWildcardRealmEntry","data","realms","length","undefined","wildcards","filter","entry","attributes","folded","i","relations","expandWildcardRealmEntry","wildcard","variants","Map","map","merged","structuredClone","inheritStrategy","set","WildcardRealmProvisioner","relationsByRealmName","synchronizer","logger","ctx","hasExplicitEntry","realm","has","ensureForRealm","warn","id","get","synchronize"],"sources":["../../../../src/core/provisioning/wildcard/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { REALM_WILDCARD_NAME } from '../constants.ts';\nimport type { RealmProvisioningEntity, RealmProvisioningRelations } from '../entities/index.ts';\nimport { mergeProvisioningEntity } from '../merge/index.ts';\nimport type { IProvisioningSynchronizer, IRealmProvisioner } from '../types.ts';\nimport type { WildcardRealmProvisionerContext } from './types.ts';\n\nfunction canonicalizeRealmName(name: string): string {\n    return name.trim().toLowerCase();\n}\n\n/**\n * Split the wildcard entries (attributes.name === '*') out of\n * `data.realms`, folding multiples (several files, several entries) into\n * one via the composite merge rules. The folded entry is stripped to a\n * relations-only shape: a wildcard entry is a SELECTOR over realms, so\n * realm-level attributes and a realm-level strategy carry no meaning\n * (validated away on the file path; discarded structurally here so\n * programmatic sources get the same semantics).\n */\nexport function extractWildcardRealmEntry(\n    data: { realms?: RealmProvisioningEntity[] },\n): RealmProvisioningEntity | undefined {\n    if (!data.realms || data.realms.length === 0) {\n        return undefined;\n    }\n\n    const wildcards = data.realms.filter(\n        (entry) => entry.attributes.name === REALM_WILDCARD_NAME,\n    );\n    if (wildcards.length === 0) {\n        return undefined;\n    }\n\n    data.realms = data.realms.filter(\n        (entry) => entry.attributes.name !== REALM_WILDCARD_NAME,\n    );\n\n    let folded = wildcards[0];\n    for (let i = 1; i < wildcards.length; i++) {\n        folded = mergeProvisioningEntity(folded, wildcards[i]) as RealmProvisioningEntity;\n    }\n\n    return {\n        attributes: { name: REALM_WILDCARD_NAME },\n        relations: folded.relations ?? {},\n    };\n}\n\n/**\n * Deep-merge the wildcard entry UNDER every explicit realm entry (explicit\n * wins per attribute, relation lists union, the explicit child's strategy\n * wins when it carries one) so the graph sync covers those realms in\n * one pass. Returns the merged relations per canonical realm name, kept\n * PRISTINE (cloned before the sync mutates anything) for the runtime\n * creation hook.\n */\nexport function expandWildcardRealmEntry(\n    wildcard: RealmProvisioningEntity,\n    data: { realms?: RealmProvisioningEntity[] },\n): Map<string, RealmProvisioningRelations> {\n    const variants = new Map<string, RealmProvisioningRelations>();\n\n    if (data.realms) {\n        data.realms = data.realms.map((entry) => {\n            // inheritStrategy: false — the precedence here is inverted\n            // relative to the composite source. The wildcard is the low\n            // precedence side, so it must not supply the lifecycle of an\n            // entity the operator declared explicitly: a wildcard child\n            // carrying `absent` would otherwise delete the very row the\n            // explicit realm block declares. A child that declares no\n            // strategy falls back to the normal default instead.\n            const merged = mergeProvisioningEntity(\n                structuredClone(wildcard),\n                entry,\n                { inheritStrategy: false },\n            ) as RealmProvisioningEntity;\n\n            if (entry.attributes.name) {\n                variants.set(\n                    canonicalizeRealmName(entry.attributes.name),\n                    structuredClone(merged.relations ?? {}),\n                );\n            }\n\n            return merged;\n        });\n    }\n\n    return variants;\n}\n\n/**\n * Applies the wildcard entry's relations to ONE realm, by synthesizing a\n * realm provisioning entity and pushing it through the regular realm\n * synchronizer (scopes -> clients -> permissions -> roles -> users; the\n * realm row itself is resolved by name and, carrying no strategy, is\n * never modified). The entry is deep-cloned per application: the\n * synchronizer mutates its input (realmId stamping, `replace` writes the\n * resolved row id back), so a shared object would leak one realm's ids\n * into the next realm's sync.\n */\nexport class WildcardRealmProvisioner implements IRealmProvisioner {\n    protected relations: RealmProvisioningRelations;\n\n    protected relationsByRealmName?: Map<string, RealmProvisioningRelations>;\n\n    protected synchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;\n\n    protected logger?: Logger;\n\n    constructor(ctx: WildcardRealmProvisionerContext) {\n        this.relations = ctx.relations;\n        this.relationsByRealmName = ctx.relationsByRealmName;\n        this.synchronizer = ctx.synchronizer;\n        this.logger = ctx.logger;\n    }\n\n    /**\n     * True when the loaded config also declares this realm explicitly:\n     * the startup graph sync already covers it (expansion), so the boot\n     * backfill loop skips it.\n     */\n    hasExplicitEntry(realm: Realm): boolean {\n        if (!this.relationsByRealmName || !realm.name) {\n            return false;\n        }\n        return this.relationsByRealmName.has(canonicalizeRealmName(realm.name));\n    }\n\n    async ensureForRealm(realm: Realm): Promise<void> {\n        if (!realm.name) {\n            this.logger?.warn(\n                `Skipping wildcard realm provisioning for realm ${realm.id}: the realm carries no name.`,\n            );\n            return;\n        }\n\n        const name = canonicalizeRealmName(realm.name);\n        const relations = this.relationsByRealmName?.get(name) ?? this.relations;\n\n        await this.synchronizer.synchronize(structuredClone({\n            attributes: { name },\n            relations,\n        }));\n    }\n}\n"],"mappings":";;;;;;;AAeA,SAASE,sBAAsBC,MAAY;CACvC,OAAOA,KAAKC,KAAI,CAAA,CAAGC,YAAW;AAClC;;;;;;;;;GAWA,SAAgBC,0BACZC,MAA4C;CAE5C,IAAI,CAACA,KAAKC,UAAUD,KAAKC,OAAOC,WAAW,GACvC;CAGJ,MAAME,YAAYJ,KAAKC,OAAOI,QACzBC,UAAUA,MAAMC,WAAWX,SAAAA,GAASH;CAEzC,IAAIW,UAAUF,WAAW,GACrB;CAGJF,KAAKC,SAASD,KAAKC,OAAOI,QACrBC,UAAUA,MAAMC,WAAWX,SAAAA,GAASH;CAGzC,IAAIe,SAASJ,UAAU;CACvB,KAAK,IAAIK,IAAI,GAAGA,IAAIL,UAAUF,QAAQO,KAClCD,SAASd,wBAAwBc,QAAQJ,UAAUK,EAAE;CAGzD,OAAO;EACHF,YAAY,EAAEX,MAAAA,IAA0B;EACxCc,WAAWF,OAAOE,aAAa,CAAC;CACpC;AACJ;;;;;;;;GAUA,SAAgBC,yBACZC,UACAZ,MAA4C;CAE5C,MAAMa,2BAAW,IAAIC,IAAAA;CAErB,IAAId,KAAKC,QACLD,KAAKC,SAASD,KAAKC,OAAOc,KAAKT,UAAAA;EAQ3B,MAAMU,SAAStB,wBACXuB,gBAAgBL,QAAAA,GAChBN,OACA,EAAEY,iBAAiB,MAAM,CAAA;EAG7B,IAAIZ,MAAMC,WAAWX,MACjBiB,SAASM,IACLxB,sBAAsBW,MAAMC,WAAWX,IAAI,GAC3CqB,gBAAgBD,OAAON,aAAa,CAAC,CAAA,CAAA;EAI7C,OAAOM;CACX,CAAA;CAGJ,OAAOH;AACX;;;;;;;;;;GAYA,IAAaO,2BAAb,MAAaA;CACCV;CAEAW;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,KAAKd,YAAYc,IAAId;EACrB,KAAKW,uBAAuBG,IAAIH;EAChC,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,SAASC,IAAID;CACtB;;;;;IAOAE,iBAAiBC,OAAuB;EACpC,IAAI,CAAC,KAAKL,wBAAwB,CAACK,MAAM9B,MACrC,OAAO;EAEX,OAAO,KAAKyB,qBAAqBM,IAAIhC,sBAAsB+B,MAAM9B,IAAI,CAAA;CACzE;CAEA,MAAMgC,eAAeF,OAA6B;EAC9C,IAAI,CAACA,MAAM9B,MAAM;GACb,KAAK2B,QAAQM,KACT,kDAAkDH,MAAMI,GAAG,6BAA6B;GAE5F;EACJ;EAEA,MAAMlC,OAAOD,sBAAsB+B,MAAM9B,IAAI;EAC7C,MAAMc,YAAY,KAAKW,sBAAsBU,IAAInC,IAAAA,KAAS,KAAKc;EAE/D,MAAM,KAAKY,aAAaU,YAAYf,gBAAgB;GAChDV,YAAY,EAAEX,KAAK;GACnBc;EACJ,CAAA,CAAA;CACJ;AACJ"}

package/dist/core/provisioning/wildcard/types.d.ts

@@ -0,0 +1,19 @@
+import type { Logger } from '@authup/server-kit';
+import type { RealmProvisioningEntity, RealmProvisioningRelations } from '../entities/index.ts';
+import type { IProvisioningSynchronizer } from '../types.ts';
+export type WildcardRealmProvisionerContext = {
+    /**
+     * The folded wildcard entry's relations, applied to realms without an
+     * explicit realm block.
+     */
+    relations: RealmProvisioningRelations;
+    /**
+     * Merged relations (wildcard deep-merged UNDER the explicit block) per
+     * canonical realm name, for realms the loaded config declares
+     * explicitly. Applied when such a realm is (re-)created at runtime.
+     */
+    relationsByRealmName?: Map<string, RealmProvisioningRelations>;
+    synchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/wildcard/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,MAAM,+BAA+B,GAAG;IAC1C;;;OAGG;IACH,SAAS,EAAE,0BAA0B,CAAC;IAEtC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAE/D,YAAY,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAEjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/provisioning/wildcard/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/index.mjs

@@ -131,6 +131,7 @@ import { ForceLoggedInMiddleware } from "./adapters/http/middleware/built-in/log
 import { ForceUserLoggedInMiddleware } from "./adapters/http/middleware/built-in/loggedin/user.mjs";
 import { RealmResolverMiddleware } from "./adapters/http/middleware/built-in/realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./adapters/http/middleware/built-in/realm-resolver/factory.mjs";
+import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./adapters/http/middleware/built-in/theme.mjs";
 import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./adapters/http/middleware/built-in/assets.mjs";
 import { registerBasicMiddleware } from "./adapters/http/middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./adapters/http/middleware/built-in/cors.mjs";
@@ -166,6 +167,7 @@ import { IdentityProviderRoleMappingController } from "./adapters/http/controlle
 import { KeyController } from "./adapters/http/controllers/entities/key/module.mjs";
 import { PermissionController } from "./adapters/http/controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./adapters/http/controllers/entities/permission-policy/module.mjs";
+import { AccountController } from "./adapters/http/controllers/workflows/account/module.mjs";
 import { ActivateController } from "./adapters/http/controllers/workflows/activate/module.mjs";
 import { AuthenticatorChallengeController } from "./adapters/http/controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./adapters/http/controllers/workflows/authorize/module.mjs";
@@ -212,6 +214,8 @@ import { LDAPInjectionKey } from "./app/modules/ldap/constants.mjs";
 import { LdapModule } from "./app/modules/ldap/module.mjs";
 import { IdentityModule } from "./app/modules/identity/module.mjs";
 import { OAuth2Module } from "./app/modules/oauth2/module.mjs";
+import { ProvisioningInjectionKey } from "./app/modules/provisioning/constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./app/modules/provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./app/modules/mail/constants.mjs";
 import { MailModule } from "./app/modules/mail/module.mjs";
 import { HTTPModule } from "./app/modules/http/module.mjs";
@@ -228,4 +232,4 @@ import { defineCLIMigrationCommand } from "./cli/commands/migration.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { AccountController, ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };

package/dist/path.d.ts

@@ -2,6 +2,4 @@ export declare const CODE_PATH: string;
 export declare const PACKAGE_PATH: string;
 export declare const SRC_PATH: string;
 export declare const DIST_PATH: string;
-export declare const UI_DIST_PATH: string;
-export declare const UI_SOURCE_PATH: string;
 //# sourceMappingURL=path.d.ts.map

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,QAA+C,CAAC;AACtE,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,QAAQ,QAAiC,CAAC;AACvD,eAAO,MAAM,SAAS,QAAkC,CAAC;AAEzD,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,cAAc,QAAgC,CAAC"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,QAA+C,CAAC;AACtE,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,QAAQ,QAAiC,CAAC;AACvD,eAAO,MAAM,SAAS,QAAkC,CAAC"}

package/dist/path.mjs

@@ -8,9 +8,7 @@ const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_PATH = path.join(CODE_PATH, "..");
 const SRC_PATH = path.join(PACKAGE_PATH, "src");
 const DIST_PATH = path.join(PACKAGE_PATH, "dist");
-const UI_DIST_PATH = path.join(DIST_PATH, "ui");
-const UI_SOURCE_PATH = path.join(PACKAGE_PATH, "ui");
 //#endregion
-export { CODE_PATH, DIST_PATH, PACKAGE_PATH, SRC_PATH, UI_DIST_PATH, UI_SOURCE_PATH };
+export { CODE_PATH, DIST_PATH, PACKAGE_PATH, SRC_PATH };
 
 //# sourceMappingURL=path.mjs.map

package/dist/path.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path.mjs","names":["path","fileURLToPath","CODE_PATH","dirname","url","PACKAGE_PATH","join","SRC_PATH","DIST_PATH","UI_DIST_PATH","UI_SOURCE_PATH"],"sources":["../src/path.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\nexport const SRC_PATH = path.join(PACKAGE_PATH, 'src');\nexport const DIST_PATH = path.join(PACKAGE_PATH, 'dist');\n\nexport const UI_DIST_PATH = path.join(DIST_PATH, 'ui');\nexport const UI_SOURCE_PATH = path.join(PACKAGE_PATH, 'ui');\n"],"mappings":";;;;;;AAUA,MAAaE,YAAYF,KAAKG,QAAQF,cAAc,YAAYG,GAAG,CAAA;AACnE,MAAaC,eAAeL,KAAKM,KAAKJ,WAAW,IAAA;AACjD,MAAaK,WAAWP,KAAKM,KAAKD,cAAc,KAAA;AAChD,MAAaG,YAAYR,KAAKM,KAAKD,cAAc,MAAA;AAEjD,MAAaI,eAAeT,KAAKM,KAAKE,WAAW,IAAA;AACjD,MAAaE,iBAAiBV,KAAKM,KAAKD,cAAc,IAAA"}
+{"version":3,"file":"path.mjs","names":["path","fileURLToPath","CODE_PATH","dirname","url","PACKAGE_PATH","join","SRC_PATH","DIST_PATH"],"sources":["../src/path.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\nexport const SRC_PATH = path.join(PACKAGE_PATH, 'src');\nexport const DIST_PATH = path.join(PACKAGE_PATH, 'dist');\n"],"mappings":";;;;;;AAUA,MAAaE,YAAYF,KAAKG,QAAQF,cAAc,YAAYG,GAAG,CAAA;AACnE,MAAaC,eAAeL,KAAKM,KAAKJ,WAAW,IAAA;AACjD,MAAaK,WAAWP,KAAKM,KAAKD,cAAc,KAAA;AAChD,MAAaG,YAAYR,KAAKM,KAAKD,cAAc,MAAA"}

package/dist/swagger.json

@@ -4789,6 +4789,9 @@
             },
             "StatusResponseFeatures": {
                 "properties": {
+                    "accountConsole": {
+                        "type": "boolean"
+                    },
                     "emailVerification": {
                         "type": "boolean"
                     },
@@ -4800,6 +4803,7 @@
                     }
                 },
                 "required": [
+                    "accountConsole",
                     "emailVerification",
                     "passwordRecovery",
                     "registration"
@@ -10309,7 +10313,7 @@
                 ]
             }
         },
-        "/activate": {
+        "/account": {
             "get": {
                 "operationId": "Serve",
                 "responses": {
@@ -10327,6 +10331,46 @@
                 "description": "",
                 "tags": [],
                 "parameters": []
+            }
+        },
+        "/account/{page}": {
+            "get": {
+                "operationId": "ServePage",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "",
+                "tags": [],
+                "parameters": []
+            }
+        },
+        "/activate": {
+            "get": {
+                "operationId": "Serve_2",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "",
+                "tags": [],
+                "parameters": []
             },
             "post": {
                 "operationId": "Execute",
@@ -10483,7 +10527,7 @@
                 "parameters": []
             },
             "get": {
-                "operationId": "Serve_2",
+                "operationId": "Serve_3",
                 "responses": {
                     "200": {
                         "description": "Ok",
@@ -10567,7 +10611,7 @@
         },
         "/logout": {
             "get": {
-                "operationId": "Serve_3",
+                "operationId": "Serve_4",
                 "responses": {
                     "200": {
                         "description": "Ok",
@@ -10639,7 +10683,7 @@
         },
         "/password-forgot": {
             "get": {
-                "operationId": "Serve_4",
+                "operationId": "Serve_5",
                 "responses": {
                     "200": {
                         "description": "Ok",
@@ -10688,7 +10732,7 @@
         },
         "/password-reset": {
             "get": {
-                "operationId": "Serve_5",
+                "operationId": "Serve_6",
                 "responses": {
                     "200": {
                         "description": "Ok",
@@ -10737,7 +10781,7 @@
         },
         "/register": {
             "get": {
-                "operationId": "Serve_6",
+                "operationId": "Serve_7",
                 "responses": {
                     "200": {
                         "description": "Ok",