npm - @authup/server-core - Versions diffs - 1.0.0-beta.58 → 1.0.0-beta.59 - Mend

@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.59

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (339) hide show

package/dist/app/modules/http/modules/middleware.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"middleware.mjs","names":["path","createAuthorizationMiddleware","createLoggerMiddleware","createRealmResolverMiddleware","createRequestEventContextMiddleware","createSwaggerMiddleware","registerAssetsMiddleware","registerBasicMiddleware","registerCorsMiddleware","registerErrorMiddleware","registerPrometheusMiddleware","registerRateLimitMiddleware","registerUIHttpClientMiddleware","HTTPInjectionKey","DIST_PATH","AuthenticationInjectionKey","ConfigInjectionKey","LoggerInjectionKey","IdentityInjectionKey","OAuth2InjectionToken","RealmEntity","RealmRepositoryAdapter","DatabaseInjectionKey","PermissionDatabaseProvider","HTTPMiddlewareModule","mountBefore","router","container","mountPrometheus","mountLogger","mountCors","mountAssets","mountUIHttpClient","mountBasic","mountRateLimit","mountSwagger","mountAuthorization","mountRequestEventContext","mountRealmResolver","mountAfter","logger","resolve","config","isEnabled","middlewareCors","options","transformBoolToEmptyObject","middleware","env","use","has","UIHttpClient","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","documentPath","join","baseURL","publicUrl","realmRepository","dataSource","DataSource","identityResolver","Resolver","sessionManager","SessionManager","oauth2TokenVerifier","TokenVerifier","identityPermissionProvider","PermissionProvider","permissionProvider","clientAuthBasic","userAuthBasic","certificateSource","input"],"sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport path from 'node:path';\nimport type { IContainer } from 'eldin';\nimport type { Repository } from 'typeorm';\nimport type { Realm } from '@authup/core-kit';\nimport {\n createAuthorizationMiddleware,\n createLoggerMiddleware,\n createRealmResolverMiddleware,\n createRequestEventContextMiddleware,\n createSwaggerMiddleware,\n registerAssetsMiddleware,\n registerBasicMiddleware,\n registerCorsMiddleware,\n registerErrorMiddleware,\n registerPrometheusMiddleware,\n registerRateLimitMiddleware,\n registerUIHttpClientMiddleware,\n} from '../../../../adapters/http/index.ts';\nimport { HTTPInjectionKey } from '../constants.ts';\nimport { DIST_PATH } from '../../../../path.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { ConfigInjectionKey } from '../../config/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { RealmEntity } from '../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../../database/repositories/index.ts';\nimport {\n DatabaseInjectionKey,\n PermissionDatabaseProvider,\n} from '../../database/index.ts';\n\nexport class HTTPMiddlewareModule {\n async mountBefore(router: App, container: IContainer): Promise<void> {\n // @routup/prometheus must be installed before any other plugin or\n // route so that its onion middleware can observe the full request\n // lifecycle (the v3 README is explicit on this).\n await this.mountPrometheus(router, container);\n await this.mountLogger(router, container);\n await this.mountCors(router, container);\n await this.mountAssets(router);\n await this.mountUIHttpClient(router, container);\n await this.mountBasic(router);\n await this.mountRateLimit(router, container);\n\n await this.mountSwagger(router, container);\n await this.mountAuthorization(router, container);\n await this.mountRequestEventContext(router);\n await this.mountRealmResolver(router, container);\n }\n\n\n async mountAfter(router: App, container: IContainer): Promise<void> {\n registerErrorMiddleware(router, { logger: container.resolve(LoggerInjectionKey) });\n }\n\n // ----------------------------------------------------\n async mountCors(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n if (!this.isEnabled(config.middlewareCors)) {\n return;\n }\n\n const options = this.transformBoolToEmptyObject(config.middlewareCors) ?? {};\n\n registerCorsMiddleware(router, options);\n }\n\n async mountLogger(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n const middleware = createLoggerMiddleware({\n env: config.env,\n logger: container.resolve(LoggerInjectionKey),\n });\n\n router.use(middleware);\n }\n\n async mountAssets(router: App): Promise<void> {\n await registerAssetsMiddleware(router);\n }\n\n async mountUIHttpClient(router: App, container: IContainer): Promise<void> {\n if (!container.has(HTTPInjectionKey.UIHttpClient)) {\n return;\n }\n\n registerUIHttpClientMiddleware(router, () => container.resolve(HTTPInjectionKey.UIHttpClient));\n }\n\n async mountBasic(router: App): Promise<void> {\n registerBasicMiddleware(router);\n }\n\n async mountPrometheus(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n if (!this.isEnabled(config.middlewarePrometheus)) {\n return;\n }\n\n registerPrometheusMiddleware(router, this.transformBoolToEmptyObject(config.middlewarePrometheus));\n }\n\n async mountRateLimit(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n if (!this.isEnabled(config.middlewareRateLimit)) {\n return;\n }\n\n registerRateLimitMiddleware(router, this.transformBoolToEmptyObject(config.middlewareRateLimit));\n }\n\n async mountSwagger(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n if (!this.isEnabled(config.middlewareSwagger)) {\n return;\n }\n\n const middleware = createSwaggerMiddleware({\n documentPath: path.join(DIST_PATH, 'swagger.json'),\n baseURL: config.publicUrl,\n });\n\n router.use('/docs', middleware);\n }\n\n async mountRealmResolver(router: App, container: IContainer): Promise<void> {\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n const middleware = createRealmResolverMiddleware({ realmRepository: new RealmRepositoryAdapter(realmRepository) });\n\n // Mounted at /realms/:realmId/:nested so the middleware only fires on\n // nested-resource URLs (e.g. /realms/master/users/...). Bare\n // /realms/:id routes belong to RealmController (CRUD, openid-config,\n // jwks) and would otherwise 404 on PUT upserts where the realm\n // doesn't exist yet.\n router.use('/realms/:realmId/:nested', middleware);\n }\n\n async mountAuthorization(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n const oauth2TokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n const middleware = createAuthorizationMiddleware({\n identityResolver,\n identityPermissionProvider,\n permissionProvider,\n oauth2TokenVerifier,\n sessionManager,\n options: {\n clientAuthBasic: config.clientAuthBasic,\n userAuthBasic: config.userAuthBasic,\n certificateSource: config.certificateSource,\n },\n });\n\n router.use(middleware);\n }\n\n async mountRequestEventContext(router: App): Promise<void> {\n // mounted immediately AFTER the authorization middleware — the\n // identity must already be resolved for actor attribution.\n router.use(createRequestEventContextMiddleware());\n }\n\n // ----------------------------------------------------\n\n private transformBoolToEmptyObject<T extends Record<string, any>>(\n input?: T \| boolean,\n ) : T \| undefined {\n if (typeof input === 'boolean') {\n return {} as T;\n }\n\n return input \|\| {} as T;\n }\n\n private isEnabled<T>(input: T \| boolean) {\n return typeof input !== 'boolean' \|\| input === true;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAawB,uBAAb,MAAaA;CACT,MAAMC,YAAYC,QAAaC,WAAsC;EAIjE,MAAM,KAAKC,gBAAgBF,QAAQC,SAAAA;EACnC,MAAM,KAAKE,YAAYH,QAAQC,SAAAA;EAC/B,MAAM,KAAKG,UAAUJ,QAAQC,SAAAA;EAC7B,MAAM,KAAKI,YAAYL,MAAAA;EACvB,MAAM,KAAKM,kBAAkBN,QAAQC,SAAAA;EACrC,MAAM,KAAKM,WAAWP,MAAAA;EACtB,MAAM,KAAKQ,eAAeR,QAAQC,SAAAA;EAElC,MAAM,KAAKQ,aAAaT,QAAQC,SAAAA;EAChC,MAAM,KAAKS,mBAAmBV,QAAQC,SAAAA;EACtC,MAAM,KAAKU,yBAAyBX,MAAAA;EACpC,MAAM,KAAKY,mBAAmBZ,QAAQC,SAAAA;CAC1C;CAGA,MAAMY,WAAWb,QAAaC,WAAsC;EAChElB,wBAAwBiB,QAAQ,EAAEc,QAAQb,UAAUc,QAAQxB,kBAAAA,EAAoB,CAAA;CACpF;CAGA,MAAMa,UAAUJ,QAAaC,WAAsC;EAC/D,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOE,cAAc,GACrC;EAGJ,MAAMC,UAAU,KAAKC,2BAA2BJ,OAAOE,cAAc,KAAK,CAAC;EAE3EpC,uBAAuBkB,QAAQmB,OAAAA;CACnC;CAEA,MAAMhB,YAAYH,QAAaC,WAAsC;EACjE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EACjC,MAAM+B,aAAa7C,uBAAuB;GACtC8C,KAAKN,OAAOM;GACZR,QAAQb,UAAUc,QAAQxB,kBAAAA;EAC9B,CAAA;EAEAS,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMhB,YAAYL,QAA4B;EAC1C,MAAMpB,yBAAyBoB,MAAAA;CACnC;CAEA,MAAMM,kBAAkBN,QAAaC,WAAsC;EACvE,IAAI,CAACA,UAAUuB,IAAIrC,iBAAiBsC,YAAY,GAC5C;EAGJvC,+BAA+Bc,cAAcC,UAAUc,QAAQ5B,iBAAiBsC,YAAY,CAAA;CAChG;CAEA,MAAMlB,WAAWP,QAA4B;EACzCnB,wBAAwBmB,MAAAA;CAC5B;CAEA,MAAME,gBAAgBF,QAAaC,WAAsC;EACrE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOU,oBAAoB,GAC3C;EAGJ1C,6BAA6BgB,QAAQ,KAAKoB,2BAA2BJ,OAAOU,oBAAoB,CAAA;CACpG;CAEA,MAAMlB,eAAeR,QAAaC,WAAsC;EACpE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOW,mBAAmB,GAC1C;EAGJ1C,4BAA4Be,QAAQ,KAAKoB,2BAA2BJ,OAAOW,mBAAmB,CAAA;CAClG;CAEA,MAAMlB,aAAaT,QAAaC,WAAsC;EAClE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EACjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOY,iBAAiB,GACxC;EAGJ,MAAMP,aAAa1C,wBAAwB;GACvCkD,cAAcvD,KAAKwD,KAAK1C,WAAW,cAAA;GACnC2C,SAASf,OAAOgB;EACpB,CAAA;EAEAhC,OAAOuB,IAAI,SAASF,UAAAA;CACxB;CAEA,MAAMT,mBAAmBZ,QAAaC,WAAsC;EACxE,MAAMgC,kBAAkBhC,UAAUc,QAA2BrB,WAAAA;EAC7D,MAAM2B,aAAa5C,8BAA8B,EAAEwD,iBAAiB,IAAItC,uBAAuBsC,eAAAA,EAAiB,CAAA;EAOhHjC,OAAOuB,IAAI,4BAA4BF,UAAAA;CAC3C;CAEA,MAAMX,mBAAmBV,QAAaC,WAAsC;EACxE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EACjC,MAAM4C,aAAajC,UAAUc,QAAQnB,qBAAqBuC,UAAU;EAEpE,MAAMC,mBAAmBnC,UAAUc,QAAQvB,qBAAqB6C,QAAQ;EACxE,MAAMC,iBAAiBrC,UAAUc,QAAQ1B,2BAA2BkD,cAAc;EAClF,MAAMC,sBAAsBvC,UAAUc,QAAQtB,qBAAqBgD,aAAa;EAChF,MAAMC,6BAA6BzC,UAAUc,QAAQvB,qBAAqBmD,kBAAkB;EAE5F,MAAMC,qBAAqB,IAAI/C,2BAA2BqC,UAAAA;EAE1D,MAAMb,aAAa9C,8BAA8B;GAC7C6D;GACAM;GACAE;GACAJ;GACAF;GACAnB,SAAS;IACL0B,iBAAiB7B,OAAO6B;IACxBC,eAAe9B,OAAO8B;IACtBC,mBAAmB/B,OAAO+B;GAC9B;EACJ,CAAA;EAEA/C,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMV,yBAAyBX,QAA4B;EAGvDA,OAAOuB,IAAI7C,oCAAAA,CAAAA;CACf;CAIQ0C,2BACJ4B,OACc;EACd,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;EAGZ,OAAOA,SAAS,CAAC;CACrB;CAEQ/B,UAAa+B,OAAoB;EACrC,OAAO,OAAOA,UAAU,aAAaA,UAAU;CACnD;AACJ"}
1	+ {"version":3,"file":"middleware.mjs","names":["path","createAuthorizationMiddleware","createLoggerMiddleware","createRealmResolverMiddleware","createRequestEventContextMiddleware","createSwaggerMiddleware","registerAssetsMiddleware","registerBasicMiddleware","registerCorsMiddleware","registerErrorMiddleware","registerPrometheusMiddleware","registerRateLimitMiddleware","registerUIHttpClientMiddleware","HTTPInjectionKey","DIST_PATH","AuthenticationInjectionKey","ConfigInjectionKey","LoggerInjectionKey","IdentityInjectionKey","OAuth2InjectionToken","RealmEntity","RealmRepositoryAdapter","DatabaseInjectionKey","PermissionDatabaseProvider","HTTPMiddlewareModule","viteServer","mountBefore","router","container","mountPrometheus","mountLogger","mountCors","mountAssets","mountUIHttpClient","mountBasic","mountRateLimit","mountSwagger","mountAuthorization","mountRequestEventContext","mountRealmResolver","mountAfter","logger","resolve","config","isEnabled","middlewareCors","options","transformBoolToEmptyObject","middleware","env","use","themeDirectoryPath","themeFragmentsEnabled","teardown","close","undefined","has","UIHttpClient","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","documentPath","join","baseURL","publicUrl","realmRepository","dataSource","DataSource","identityResolver","Resolver","sessionManager","SessionManager","oauth2TokenVerifier","TokenVerifier","identityPermissionProvider","PermissionProvider","permissionProvider","clientAuthBasic","userAuthBasic","certificateSource","input"],"sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"sourcesContent":["/\n Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport type { App } from 'routup';\nimport path from 'node:path';\nimport type { IContainer } from 'eldin';\nimport type { ViteDevServer } from 'vite';\nimport type { Repository } from 'typeorm';\nimport type { Realm } from '@authup/core-kit';\nimport {\n createAuthorizationMiddleware,\n createLoggerMiddleware,\n createRealmResolverMiddleware,\n createRequestEventContextMiddleware,\n createSwaggerMiddleware,\n registerAssetsMiddleware,\n registerBasicMiddleware,\n registerCorsMiddleware,\n registerErrorMiddleware,\n registerPrometheusMiddleware,\n registerRateLimitMiddleware,\n registerUIHttpClientMiddleware,\n} from '../../../../adapters/http/index.ts';\nimport { HTTPInjectionKey } from '../constants.ts';\nimport { DIST_PATH } from '../../../../path.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { ConfigInjectionKey } from '../../config/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { RealmEntity } from '../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../../database/repositories/index.ts';\nimport {\n DatabaseInjectionKey,\n PermissionDatabaseProvider,\n} from '../../database/index.ts';\n\nexport class HTTPMiddlewareModule {\n protected viteServer : ViteDevServer \| undefined;\n\n async mountBefore(router: App, container: IContainer): Promise<void> {\n // @routup/prometheus must be installed before any other plugin or\n // route so that its onion middleware can observe the full request\n // lifecycle (the v3 README is explicit on this).\n await this.mountPrometheus(router, container);\n await this.mountLogger(router, container);\n await this.mountCors(router, container);\n await this.mountAssets(router, container);\n await this.mountUIHttpClient(router, container);\n await this.mountBasic(router);\n await this.mountRateLimit(router, container);\n\n await this.mountSwagger(router, container);\n await this.mountAuthorization(router, container);\n await this.mountRequestEventContext(router);\n await this.mountRealmResolver(router, container);\n }\n\n\n async mountAfter(router: App, container: IContainer): Promise<void> {\n registerErrorMiddleware(router, { logger: container.resolve(LoggerInjectionKey) });\n }\n\n // ----------------------------------------------------\n async mountCors(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n if (!this.isEnabled(config.middlewareCors)) {\n return;\n }\n\n const options = this.transformBoolToEmptyObject(config.middlewareCors) ?? {};\n\n registerCorsMiddleware(router, options);\n }\n\n async mountLogger(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n const middleware = createLoggerMiddleware({\n env: config.env,\n logger: container.resolve(LoggerInjectionKey),\n });\n\n router.use(middleware);\n }\n\n async mountAssets(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n // Config is resolved HERE, in the app-module layer, and the value is\n // passed down: adapters/http/ui/* must not read config itself.\n this.viteServer = await registerAssetsMiddleware(router, {\n themeDirectoryPath: config.themeDirectoryPath,\n themeFragmentsEnabled: config.themeFragmentsEnabled,\n logger: container.resolve(LoggerInjectionKey),\n });\n }\n\n /*\n Release what the mounted middlewares own beyond the http listener. Only\n * the JIT vite dev server qualifies: it keeps a file watcher and an HMR\n * websocket alive, which would survive every setup/teardown cycle.\n */\n async teardown(): Promise<void> {\n if (!this.viteServer) {\n return;\n }\n\n await this.viteServer.close();\n this.viteServer = undefined;\n }\n\n async mountUIHttpClient(router: App, container: IContainer): Promise<void> {\n if (!container.has(HTTPInjectionKey.UIHttpClient)) {\n return;\n }\n\n registerUIHttpClientMiddleware(router, () => container.resolve(HTTPInjectionKey.UIHttpClient));\n }\n\n async mountBasic(router: App): Promise<void> {\n registerBasicMiddleware(router);\n }\n\n async mountPrometheus(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n if (!this.isEnabled(config.middlewarePrometheus)) {\n return;\n }\n\n registerPrometheusMiddleware(router, this.transformBoolToEmptyObject(config.middlewarePrometheus));\n }\n\n async mountRateLimit(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n\n if (!this.isEnabled(config.middlewareRateLimit)) {\n return;\n }\n\n registerRateLimitMiddleware(router, this.transformBoolToEmptyObject(config.middlewareRateLimit));\n }\n\n async mountSwagger(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n if (!this.isEnabled(config.middlewareSwagger)) {\n return;\n }\n\n const middleware = createSwaggerMiddleware({\n documentPath: path.join(DIST_PATH, 'swagger.json'),\n baseURL: config.publicUrl,\n });\n\n router.use('/docs', middleware);\n }\n\n async mountRealmResolver(router: App, container: IContainer): Promise<void> {\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n const middleware = createRealmResolverMiddleware({ realmRepository: new RealmRepositoryAdapter(realmRepository) });\n\n // Mounted at /realms/:realmId/:nested so the middleware only fires on\n // nested-resource URLs (e.g. /realms/master/users/...). Bare\n // /realms/:id routes belong to RealmController (CRUD, openid-config,\n // jwks) and would otherwise 404 on PUT upserts where the realm\n // doesn't exist yet.\n router.use('/realms/:realmId/:nested', middleware);\n }\n\n async mountAuthorization(router: App, container: IContainer): Promise<void> {\n const config = container.resolve(ConfigInjectionKey);\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n const oauth2TokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n const middleware = createAuthorizationMiddleware({\n identityResolver,\n identityPermissionProvider,\n permissionProvider,\n oauth2TokenVerifier,\n sessionManager,\n options: {\n clientAuthBasic: config.clientAuthBasic,\n userAuthBasic: config.userAuthBasic,\n certificateSource: config.certificateSource,\n },\n });\n\n router.use(middleware);\n }\n\n async mountRequestEventContext(router: App): Promise<void> {\n // mounted immediately AFTER the authorization middleware — the\n // identity must already be resolved for actor attribution.\n router.use(createRequestEventContextMiddleware());\n }\n\n // ----------------------------------------------------\n\n private transformBoolToEmptyObject<T extends Record<string, any>>(\n input?: T \| boolean,\n ) : T \| undefined {\n if (typeof input === 'boolean') {\n return {} as T;\n }\n\n return input \|\| {} as T;\n }\n\n private isEnabled<T>(input: T \| boolean) {\n return typeof input !== 'boolean' \|\| input === true;\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAawB,uBAAb,MAAaA;CACCC;CAEV,MAAMC,YAAYC,QAAaC,WAAsC;EAIjE,MAAM,KAAKC,gBAAgBF,QAAQC,SAAAA;EACnC,MAAM,KAAKE,YAAYH,QAAQC,SAAAA;EAC/B,MAAM,KAAKG,UAAUJ,QAAQC,SAAAA;EAC7B,MAAM,KAAKI,YAAYL,QAAQC,SAAAA;EAC/B,MAAM,KAAKK,kBAAkBN,QAAQC,SAAAA;EACrC,MAAM,KAAKM,WAAWP,MAAAA;EACtB,MAAM,KAAKQ,eAAeR,QAAQC,SAAAA;EAElC,MAAM,KAAKQ,aAAaT,QAAQC,SAAAA;EAChC,MAAM,KAAKS,mBAAmBV,QAAQC,SAAAA;EACtC,MAAM,KAAKU,yBAAyBX,MAAAA;EACpC,MAAM,KAAKY,mBAAmBZ,QAAQC,SAAAA;CAC1C;CAGA,MAAMY,WAAWb,QAAaC,WAAsC;EAChEnB,wBAAwBkB,QAAQ,EAAEc,QAAQb,UAAUc,QAAQzB,kBAAAA,EAAoB,CAAA;CACpF;CAGA,MAAMc,UAAUJ,QAAaC,WAAsC;EAC/D,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAEjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOE,cAAc,GACrC;EAGJ,MAAMC,UAAU,KAAKC,2BAA2BJ,OAAOE,cAAc,KAAK,CAAC;EAE3ErC,uBAAuBmB,QAAQmB,OAAAA;CACnC;CAEA,MAAMhB,YAAYH,QAAaC,WAAsC;EACjE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EACjC,MAAMgC,aAAa9C,uBAAuB;GACtC+C,KAAKN,OAAOM;GACZR,QAAQb,UAAUc,QAAQzB,kBAAAA;EAC9B,CAAA;EAEAU,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMhB,YAAYL,QAAaC,WAAsC;EACjE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAIjC,KAAKS,aAAa,MAAMnB,yBAAyBqB,QAAQ;GACrDwB,oBAAoBR,OAAOQ;GAC3BC,uBAAuBT,OAAOS;GAC9BX,QAAQb,UAAUc,QAAQzB,kBAAAA;EAC9B,CAAA;CACJ;;;;;IAOA,MAAMoC,WAA0B;EAC5B,IAAI,CAAC,KAAK5B,YACN;EAGJ,MAAM,KAAKA,WAAW6B,MAAK;EAC3B,KAAK7B,aAAa8B,KAAAA;CACtB;CAEA,MAAMtB,kBAAkBN,QAAaC,WAAsC;EACvE,IAAI,CAACA,UAAU4B,IAAI3C,iBAAiB4C,YAAY,GAC5C;EAGJ7C,+BAA+Be,cAAcC,UAAUc,QAAQ7B,iBAAiB4C,YAAY,CAAA;CAChG;CAEA,MAAMvB,WAAWP,QAA4B;EACzCpB,wBAAwBoB,MAAAA;CAC5B;CAEA,MAAME,gBAAgBF,QAAaC,WAAsC;EACrE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAEjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOe,oBAAoB,GAC3C;EAGJhD,6BAA6BiB,QAAQ,KAAKoB,2BAA2BJ,OAAOe,oBAAoB,CAAA;CACpG;CAEA,MAAMvB,eAAeR,QAAaC,WAAsC;EACpE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAEjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOgB,mBAAmB,GAC1C;EAGJhD,4BAA4BgB,QAAQ,KAAKoB,2BAA2BJ,OAAOgB,mBAAmB,CAAA;CAClG;CAEA,MAAMvB,aAAaT,QAAaC,WAAsC;EAClE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EACjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOiB,iBAAiB,GACxC;EAGJ,MAAMZ,aAAa3C,wBAAwB;GACvCwD,cAAc7D,KAAK8D,KAAKhD,WAAW,cAAA;GACnCiD,SAASpB,OAAOqB;EACpB,CAAA;EAEArC,OAAOuB,IAAI,SAASF,UAAAA;CACxB;CAEA,MAAMT,mBAAmBZ,QAAaC,WAAsC;EACxE,MAAMqC,kBAAkBrC,UAAUc,QAA2BtB,WAAAA;EAC7D,MAAM4B,aAAa7C,8BAA8B,EAAE8D,iBAAiB,IAAI5C,uBAAuB4C,eAAAA,EAAiB,CAAA;EAOhHtC,OAAOuB,IAAI,4BAA4BF,UAAAA;CAC3C;CAEA,MAAMX,mBAAmBV,QAAaC,WAAsC;EACxE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EACjC,MAAMkD,aAAatC,UAAUc,QAAQpB,qBAAqB6C,UAAU;EAEpE,MAAMC,mBAAmBxC,UAAUc,QAAQxB,qBAAqBmD,QAAQ;EACxE,MAAMC,iBAAiB1C,UAAUc,QAAQ3B,2BAA2BwD,cAAc;EAClF,MAAMC,sBAAsB5C,UAAUc,QAAQvB,qBAAqBsD,aAAa;EAChF,MAAMC,6BAA6B9C,UAAUc,QAAQxB,qBAAqByD,kBAAkB;EAE5F,MAAMC,qBAAqB,IAAIrD,2BAA2B2C,UAAAA;EAE1D,MAAMlB,aAAa/C,8BAA8B;GAC7CmE;GACAM;GACAE;GACAJ;GACAF;GACAxB,SAAS;IACL+B,iBAAiBlC,OAAOkC;IACxBC,eAAenC,OAAOmC;IACtBC,mBAAmBpC,OAAOoC;GAC9B;EACJ,CAAA;EAEApD,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMV,yBAAyBX,QAA4B;EAGvDA,OAAOuB,IAAI9C,oCAAAA,CAAAA;CACf;CAIQ2C,2BACJiC,OACc;EACd,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;EAGZ,OAAOA,SAAS,CAAC;CACrB;CAEQpC,UAAaoC,OAAoB;EACrC,OAAO,OAAOA,UAAU,aAAaA,UAAU;CACnD;AACJ"}

package/dist/app/modules/index.mjs CHANGED Viewed

@@ -67,6 +67,8 @@ import { IdentityModule } from "./identity/module.mjs";
 import "./identity/index.mjs";
 import { OAuth2Module } from "./oauth2/module.mjs";
 import "./oauth2/index.mjs";
+import { ProvisioningInjectionKey } from "./provisioning/constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./mail/constants.mjs";
 import { MailModule } from "./mail/module.mjs";
 import "./mail/index.mjs";
@@ -79,4 +81,4 @@ import { ProvisionerModule } from "./provisioning/module.mjs";
 import "./provisioning/index.mjs";
 import { RuntimeModule } from "./runtime/module.mjs";
 import "./runtime/index.mjs";
-export { AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+export { AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/provisioning/constants.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+import { TypedToken } from 'eldin';
+import type { IRealmProvisioner } from '../../../core/index.ts';
+export declare const ProvisioningInjectionKey: {
+    /**
+     * Registered by ProvisionerModule.setup iff the loaded provisioning
+     * data carries a wildcard realm entry. Resolved lazily (request time)
+     * by the realm controller factory, so the HTTP module never depends
+     * on provisioning-module boot order.
+     */
+    readonly WildcardRealmProvisioner: TypedToken<IRealmProvisioner>;
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/app/modules/provisioning/constants.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,eAAO,MAAM,wBAAwB;IACjC;;;;;OAKG;;CAEG,CAAC"}

package/dist/app/modules/provisioning/constants.mjs ADDED Viewed

@@ -0,0 +1,16 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TypedToken } from "eldin";
+//#region src/app/modules/provisioning/constants.ts
+const ProvisioningInjectionKey = {
+/**
+* Registered by ProvisionerModule.setup iff the loaded provisioning
+* data carries a wildcard realm entry. Resolved lazily (request time)
+* by the realm controller factory, so the HTTP module never depends
+* on provisioning-module boot order.
+*/ WildcardRealmProvisioner: new TypedToken("WildcardRealmProvisioner") };
+//#endregion
+export { ProvisioningInjectionKey };
+//# sourceMappingURL=constants.mjs.map

package/dist/app/modules/provisioning/constants.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.mjs","names":["TypedToken","ProvisioningInjectionKey","WildcardRealmProvisioner"],"sources":["../../../../src/app/modules/provisioning/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { IRealmProvisioner } from '../../../core/index.ts';\n\nexport const ProvisioningInjectionKey = {\n /**\n * Registered by ProvisionerModule.setup iff the loaded provisioning\n * data carries a wildcard realm entry. Resolved lazily (request time)\n * by the realm controller factory, so the HTTP module never depends\n * on provisioning-module boot order.\n */\n WildcardRealmProvisioner: new TypedToken<IRealmProvisioner>('WildcardRealmProvisioner'),\n} as const;\n"],"mappings":";;;;;AAUA,MAAaC,2BAA2B;;;;;;GAOpCC,0BAA0B,IAAIF,WAA8B,0BAAA,EAChE"}

package/dist/app/modules/provisioning/index.d.ts CHANGED Viewed

@@ -1,3 +1,5 @@
+export * from './constants.ts';
+export * from './lazy-wildcard.ts';
 export * from './sources/index.ts';
 export * from './module.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/provisioning/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}

package/dist/app/modules/provisioning/index.mjs CHANGED Viewed

@@ -1,9 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { ProvisioningInjectionKey } from "./constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./lazy-wildcard.mjs";
 import { DefaultProvisioningSource } from "./sources/default/module.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
 import { ProvisionerModule } from "./module.mjs";
-export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource, ProvisionerModule };
+export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource, LazyWildcardRealmProvisioner, ProvisionerModule, ProvisioningInjectionKey };

package/dist/app/modules/provisioning/lazy-wildcard.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+import type { Realm } from '@authup/core-kit';
+import type { IContainer } from 'eldin';
+import type { IRealmProvisioner } from '../../../core/index.ts';
+/**
+ * The wildcard realm provisioner is registered by ProvisionerModule AFTER
+ * the async provisioning-source load, and the HTTP module does not depend
+ * on the provisioning module's boot order — resolve it lazily at request
+ * time. No wildcard entry declared => no-op.
+ */
+export declare class LazyWildcardRealmProvisioner implements IRealmProvisioner {
+    protected container: IContainer;
+    constructor(container: IContainer);
+    ensureForRealm(realm: Realm): Promise<void>;
+}
+//# sourceMappingURL=lazy-wildcard.d.ts.map

package/dist/app/modules/provisioning/lazy-wildcard.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"lazy-wildcard.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/lazy-wildcard.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,iBAAiB;IAClE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEpB,SAAS,EAAE,UAAU;IAI3B,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;CAOpD"}

package/dist/app/modules/provisioning/lazy-wildcard.mjs ADDED Viewed

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningInjectionKey } from "./constants.mjs";
+//#region src/app/modules/provisioning/lazy-wildcard.ts
+/**
+* The wildcard realm provisioner is registered by ProvisionerModule AFTER
+* the async provisioning-source load, and the HTTP module does not depend
+* on the provisioning module's boot order — resolve it lazily at request
+* time. No wildcard entry declared => no-op.
+*/ var LazyWildcardRealmProvisioner = class {
+	container;
+	constructor(container) {
+		this.container = container;
+	}
+	async ensureForRealm(realm) {
+		if (this.container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) await this.container.resolve(ProvisioningInjectionKey.WildcardRealmProvisioner).ensureForRealm(realm);
+	}
+};
+//#endregion
+export { LazyWildcardRealmProvisioner };
+//# sourceMappingURL=lazy-wildcard.mjs.map

package/dist/app/modules/provisioning/lazy-wildcard.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"lazy-wildcard.mjs","names":["ProvisioningInjectionKey","LazyWildcardRealmProvisioner","container","ensureForRealm","realm","has","WildcardRealmProvisioner","resolve"],"sources":["../../../../src/app/modules/provisioning/lazy-wildcard.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport type { IRealmProvisioner } from '../../../core/index.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\n\n/**\n * The wildcard realm provisioner is registered by ProvisionerModule AFTER\n * the async provisioning-source load, and the HTTP module does not depend\n * on the provisioning module's boot order — resolve it lazily at request\n * time. No wildcard entry declared => no-op.\n */\nexport class LazyWildcardRealmProvisioner implements IRealmProvisioner {\n protected container: IContainer;\n\n constructor(container: IContainer) {\n this.container = container;\n }\n\n async ensureForRealm(realm: Realm): Promise<void> {\n if (this.container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n await this.container\n .resolve(ProvisioningInjectionKey.WildcardRealmProvisioner)\n .ensureForRealm(realm);\n }\n }\n}\n"],"mappings":";;;;;;;;;;GAkBA,IAAaC,+BAAb,MAAaA;CACCC;CAEV,YAAYA,WAAuB;EAC/B,KAAKA,YAAYA;CACrB;CAEA,MAAMC,eAAeC,OAA6B;EAC9C,IAAI,KAAKF,UAAUG,IAAIL,yBAAyBM,wBAAwB,GACpE,MAAM,KAAKJ,UACNK,QAAQP,yBAAyBM,wBAAwB,CAAA,CACzDH,eAAeC,KAAAA;CAE5B;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;~~AAWxC~~,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;~~AAC~~/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;~~cAuKjC~~,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAiBxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cA+MjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs CHANGED Viewed

@@ -16,7 +16,7 @@ import { RolePermissionEntity } from "../../../adapters/database/domains/role-pe
 import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
-import { WebClientProvisioner } from "../../../core/entities/client/web-client.mjs";
+import { SystemClientProvisioner } from "../../../core/entities/client/system-clients.mjs";
 import "../../../core/entities/client/index.mjs";
 import { KeyProvisioner } from "../../../core/key/provisioner.mjs";
 import "../../../core/key/index.mjs";
@@ -29,6 +29,8 @@ import { GraphProvisioningSynchronizer } from "../../../core/provisioning/synchr
 import { ScopeProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/user/module.mjs";
 import "../../../core/provisioning/synchronizer/index.mjs";
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "../../../core/provisioning/wildcard/module.mjs";
+import "../../../core/provisioning/wildcard/index.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import { getAppOrigins } from "../config/origins.mjs";
@@ -54,6 +56,7 @@ import { DatabaseInjectionKey } from "../database/constants.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import "../database/index.mjs";
+import { ProvisioningInjectionKey } from "./constants.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
@@ -80,6 +83,9 @@ var ProvisionerModule = class {
 			logger: container.resolve(LoggerInjectionKey)
 		}));
 		const data = await new CompositeProvisioningSource(sources).load(container);
+		const wildcardEntry = extractWildcardRealmEntry(data);
+		let wildcardVariants;
+		if (wildcardEntry) wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const realmRepository = container.resolve(RealmEntity);
 		const permissionRepository = new PermissionRepositoryAdapter({
@@ -156,7 +162,7 @@ var ProvisionerModule = class {
 			realmSynchronizer,
 			scopeSynchronizer
 		}).synchronize(data);
-		const webClientProvisioner = new WebClientProvisioner({
+		const systemClientProvisioner = new SystemClientProvisioner({
 			clientRepository,
 			scopeRepository,
 			clientScopeRepository,
@@ -167,10 +173,22 @@ var ProvisionerModule = class {
 			keyStore: new KeyRepositoryAdapter(dataSource, { secretsCipher: config.secretsEncryptionKey ? new SymmetricCipher(config.secretsEncryptionKey) : null }),
 			logger: container.resolve(LoggerInjectionKey)
 		});
+		let wildcardProvisioner;
+		if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);
+		if (wildcardEntry) {
+			wildcardProvisioner = new WildcardRealmProvisioner({
+				relations: wildcardEntry.relations ?? {},
+				relationsByRealmName: wildcardVariants,
+				synchronizer: realmSynchronizer,
+				logger: container.resolve(LoggerInjectionKey)
+			});
+			container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });
+		}
 		const realms = await realmRepository.find();
 		for (const realm of realms) {
-			await webClientProvisioner.ensureForRealm(realm);
+			await systemClientProvisioner.ensureForRealm(realm);
 			await keyProvisioner.ensureForRealm(realm);
+			if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) await wildcardProvisioner.ensureForRealm(realm);
 		}
 		if (config.permissionsDefaultPolicyAssignment) await this.assignDefaultPolicy(dataSource, policyRepository);
 	}

package/dist/app/modules/provisioning/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n ClientScope,\n PermissionPolicy,\n Realm,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n ClientScopeEntity,\n PermissionEntity,\n RealmEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n ClientScopeRepositoryAdapter,\n KeyRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter, \n UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({\n cwd: provisioningDir,\n logger: container.resolve(LoggerInjectionKey),\n }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n const clientScopeRepository = new ClientScopeRepositoryAdapter(\n container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n );\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n clientScopeRepository,\n\n roleRepository,\n permissionRepository,\n scopeRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n // ---------------------------------------------------------------\n // Per-realm public `web` client. Single provisioning mechanism:\n // list every realm (incl. pre-existing) and upsert its web client.\n // Idempotent; guarded on builtIn inside the provisioner.\n // ---------------------------------------------------------------\n const webClientProvisioner = new WebClientProvisioner({\n clientRepository,\n scopeRepository,\n clientScopeRepository,\n appOrigins: getAppOrigins(config),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n // Eager key minting (plan 071 hybrid model): every realm — incl.\n // pre-existing ones — holds sig + enc keys after startup, so the\n // management API shows them without waiting for first use. The\n // adapter is constructed locally (NOT resolved from the oauth2\n // module's registration) so provisioning stays runnable in minimal\n // module graphs (test setup, CLI); the KEK handling is identical.\n const keyProvisioner = new KeyProvisioner({\n keyStore: new KeyRepositoryAdapter(dataSource, {\n secretsCipher: config.secretsEncryptionKey ?\n new SymmetricCipher(config.secretsEncryptionKey) :\n null,\n }),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n const realms = await realmRepository.find();\n for (const realm of realms) {\n await webClientProvisioner.ensureForRealm(realm);\n await keyProvisioner.ensureForRealm(realm);\n }\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permissionId: permission.id,\n permissionRealmId: permission.realmId,\n policyId: defaultPolicy.id,\n policyRealmId: defaultPolicy.realmId,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,IAAakD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BvD,WAAAA;EAE7D,MAAMqE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCxD,gBAAAA;GAC5DqE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI9D,iBAAiB0D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMkE,qBAAqB,IAAI5D,+BAA+B;GAC1DyD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BtD,UAAAA;GAChDmE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIxD,wBAAwB;GACjDmD,YAAYjB,UAAUE,QAA4B5D,YAAAA;GAClDyE;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAI/C,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BpD,WAAAA;GACjDiE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAIxD,6BAC9BgC,UAAUE,QAAiCzD,iBAAAA,CAAAA;EAG/C,MAAMgF,yBAAyB,IAAIlE,mCAAmC;GAClE0D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIhE,6BAA6B;GACtDuD,YAAYI;GACZL;GACAW,0BAA0B,IAAIrD,gCAC1B0B,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DiE;GACAO,sBAAsB,IAAI9D,4BACtBiC,UAAUE,QAAgC1D,gBAAAA,CAAAA;GAE9CsF,4BAA4B,IAAIjE,kCAC5BmC,UAAUE,QAAsC3D,sBAAAA,CAAAA;GAEpDiF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAInE,6BAA6B;GACtDoE,gBAAgB,IAAItD,sBAAsB;IACtCuC,YAAY,IAAI7D,eAAeyD,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAItD,0BACpBqB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAIzD,gCAC1BuB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDuE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAIxE,8BAA8B,EAAEsD,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAI3E,8BAA8B;GACxDwD,YAAY,IAAI5C,uBAAuB0C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuB/E,8BAA8B;GACvD8D;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY3B,IAAAA;EAOnC,MAAM4B,uBAAuB,IAAInD,qBAAqB;GAClDkC;GACAC;GACAC;GACAgB,YAAYvD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMsD,iBAAiB,IAAIpD,eAAe;GACtCqD,UAAU,IAAIzE,qBAAqB4C,YAAY,EAC3C8B,eAAe1C,OAAO2C,uBAClB,IAAI1D,gBAAgBe,OAAO2C,oBAAoB,IAC/C,KACR,CAAA;GACAnC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM0D,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI9C,OAAOgD,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAcnG,iBAAiBoG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc7G,gBAAAA;EAChD,MAAM8G,eAAe3C,WAAW0C,cAAcrG,sBAAAA;EAE9C,MAAMuG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","WildcardRealmProvisioner","expandWildcardRealmEntry","extractWildcardRealmEntry","ProvisioningInjectionKey","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","SystemClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","wildcardEntry","wildcardVariants","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","systemClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","wildcardProvisioner","has","unregister","relations","relationsByRealmName","synchronizer","register","useValue","realms","find","realm","ensureForRealm","hasExplicitEntry","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\nimport type {\n Client,\n ClientPermission,\n ClientRole,\n ClientScope,\n PermissionPolicy,\n Realm,\n Role,\n RolePermission,\n Scope,\n UserPermission,\n UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n ClientEntity,\n ClientPermissionEntity,\n ClientRoleEntity,\n ClientScopeEntity,\n PermissionEntity,\n RealmEntity,\n RoleEntity,\n RolePermissionEntity,\n ScopeEntity,\n UserPermissionEntity,\n UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n PermissionPolicyEntity,\n PolicyRepository,\n UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n ClientProvisioningSynchronizer,\n GraphProvisioningSynchronizer,\n PermissionProvisioningSynchronizer,\n PolicyProvisioningSynchronizer,\n RealmProvisioningSynchronizer,\n RoleProvisioningSynchronizer,\n ScopeProvisioningSynchronizer,\n UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { RealmProvisioningRelations } from '../../../core/provisioning/entities/index.ts';\nimport {\n WildcardRealmProvisioner,\n expandWildcardRealmEntry,\n extractWildcardRealmEntry,\n} from '../../../core/provisioning/wildcard/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\nimport {\n ClientPermissionRepositoryAdapter,\n ClientRepositoryAdapter,\n ClientRoleRepositoryAdapter,\n ClientScopeRepositoryAdapter,\n KeyRepositoryAdapter,\n PermissionPolicyRepositoryAdapter,\n PermissionRepositoryAdapter,\n PolicyRepositoryAdapter,\n RealmRepositoryAdapter,\n RolePermissionRepositoryAdapter,\n RoleRepositoryAdapter,\n ScopeRepositoryAdapter,\n UserPermissionRepositoryAdapter,\n UserRepositoryAdapter, \n UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { SystemClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n readonly name: string;\n\n readonly dependencies: string[];\n\n protected sources: IProvisioningSource[];\n\n constructor(sources: IProvisioningSource[] = []) {\n this.name = ModuleName.PROVISIONING;\n this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n this.sources = sources;\n }\n\n async setup(container: IContainer): Promise<void> {\n const sources = [...this.sources];\n\n const config = container.resolve(ConfigInjectionKey);\n const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n if (fs.existsSync(provisioningDir)) {\n sources.push(new FileProvisioningSource({\n cwd: provisioningDir,\n logger: container.resolve(LoggerInjectionKey),\n }));\n }\n\n const composite = new CompositeProvisioningSource(sources);\n const data = await composite.load(container);\n\n // ---------------------------------------------------------------\n // Wildcard realm entry (plan 082): split the `name: \"\"` entry out\n // of `data.realms` and deep-merge it UNDER every explicit realm\n // entry (explicit wins per attribute, relation lists union) so the\n // graph sync below covers declared realms in one pass. Realms\n // without an explicit entry get the wildcard applied by the\n // backfill loop; runtime-created realms via the DI-registered\n // provisioner (RealmService hook).\n // ---------------------------------------------------------------\n const wildcardEntry = extractWildcardRealmEntry(data);\n let wildcardVariants : Map<string, RealmProvisioningRelations> \| undefined;\n if (wildcardEntry) {\n wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);\n }\n\n const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n const permissionRepository = new PermissionRepositoryAdapter({\n repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n realmRepository,\n });\n\n const policyRepository = new PolicyRepositoryAdapter({\n repository: new PolicyRepository(dataSource),\n realmRepository,\n });\n\n // ---------------------------------------------------------------\n // Synchronize all entities (policies → permissions → roles → ...)\n // ---------------------------------------------------------------\n\n const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n );\n\n const policySynchronizer = new PolicyProvisioningSynchronizer({\n repository: policyRepository,\n permissionPolicyRepository,\n });\n\n const roleRepository = new RoleRepositoryAdapter({\n repository: container.resolve<Repository<Role>>(RoleEntity),\n realmRepository,\n });\n const clientRepository = new ClientRepositoryAdapter({\n repository: container.resolve<Repository<Client>>(ClientEntity),\n realmRepository,\n });\n const scopeRepository = new ScopeRepositoryAdapter({\n repository: container.resolve<Repository<Scope>>(ScopeEntity),\n realmRepository,\n });\n const clientScopeRepository = new ClientScopeRepositoryAdapter(\n container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n );\n\n const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n repository: permissionRepository,\n policyRepository,\n permissionPolicyRepository,\n });\n\n const roleSynchronizer = new RoleProvisioningSynchronizer({\n repository: roleRepository,\n permissionRepository,\n rolePermissionRepository: new RolePermissionRepositoryAdapter(\n container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n ),\n });\n\n const clientSynchronizer = new ClientProvisioningSynchronizer({\n clientRepository,\n clientRoleRepository: new ClientRoleRepositoryAdapter(\n container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n ),\n clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n ),\n clientScopeRepository,\n\n roleRepository,\n permissionRepository,\n scopeRepository,\n\n roleSynchronizer,\n permissionSynchronizer,\n });\n\n const userSynchronizer = new UserProvisioningSynchronizer({\n userRepository: new UserRepositoryAdapter({\n repository: new UserRepository(dataSource),\n realmRepository,\n }),\n userRoleRepository: new UserRoleRepositoryAdapter(\n container.resolve<Repository<UserRole>>(UserRoleEntity),\n ),\n userPermissionRepository: new UserPermissionRepositoryAdapter(\n container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n ),\n\n clientRepository,\n roleRepository,\n permissionRepository,\n });\n\n const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n const realmSynchronizer = new RealmProvisioningSynchronizer({\n repository: new RealmRepositoryAdapter(realmRepository),\n\n clientSynchronizer,\n roleSynchronizer,\n permissionSynchronizer,\n userSynchronizer,\n scopeSynchronizer,\n });\n\n const rootSynchronizer = new GraphProvisioningSynchronizer({\n policySynchronizer,\n permissionSynchronizer,\n roleSynchronizer,\n realmSynchronizer,\n scopeSynchronizer,\n });\n\n await rootSynchronizer.synchronize(data);\n\n // ---------------------------------------------------------------\n // Per-realm system clients (web, admin-console, account-console).\n // Single provisioning mechanism: list every realm (incl.\n // pre-existing) and upsert its clients.\n // Idempotent; guarded on builtIn inside the provisioner.\n // ---------------------------------------------------------------\n const systemClientProvisioner = new SystemClientProvisioner({\n clientRepository,\n scopeRepository,\n clientScopeRepository,\n appOrigins: getAppOrigins(config),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n // Eager key minting (plan 071 hybrid model): every realm — incl.\n // pre-existing ones — holds sig + enc keys after startup, so the\n // management API shows them without waiting for first use. The\n // adapter is constructed locally (NOT resolved from the oauth2\n // module's registration) so provisioning stays runnable in minimal\n // module graphs (test setup, CLI); the KEK handling is identical.\n const keyProvisioner = new KeyProvisioner({\n keyStore: new KeyRepositoryAdapter(dataSource, {\n secretsCipher: config.secretsEncryptionKey ?\n new SymmetricCipher(config.secretsEncryptionKey) :\n null,\n }),\n logger: container.resolve(LoggerInjectionKey),\n });\n\n // Wildcard realm provisioning (plan 082): one shared instance for\n // the boot backfill below AND the runtime realm-create hook (the\n // realm controller factory resolves the DI key lazily), so the two\n // paths cannot drift. Registered only when a wildcard entry was\n // declared.\n let wildcardProvisioner : WildcardRealmProvisioner \| undefined;\n if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);\n }\n if (wildcardEntry) {\n wildcardProvisioner = new WildcardRealmProvisioner({\n relations: wildcardEntry.relations ?? {},\n relationsByRealmName: wildcardVariants,\n synchronizer: realmSynchronizer,\n logger: container.resolve(LoggerInjectionKey),\n });\n container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });\n }\n\n const realms = await realmRepository.find();\n for (const realm of realms) {\n await systemClientProvisioner.ensureForRealm(realm);\n await keyProvisioner.ensureForRealm(realm);\n // Realms with an explicit entry were already covered by the\n // wildcard expansion inside the graph sync above.\n if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) {\n await wildcardProvisioner.ensureForRealm(realm);\n }\n }\n\n if (config.permissionsDefaultPolicyAssignment) {\n await this.assignDefaultPolicy(dataSource, policyRepository);\n }\n }\n\n protected async assignDefaultPolicy(\n dataSource: DataSource,\n policyRepository: PolicyRepositoryAdapter,\n ): Promise<void> {\n const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n if (!defaultPolicy) {\n return;\n }\n\n const permissionRepo = dataSource.getRepository(PermissionEntity);\n const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n const permissions = await permissionRepo.find();\n for (const permission of permissions) {\n const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n if (!hasAnyPolicy) {\n await junctionRepo.save(junctionRepo.create({\n permissionId: permission.id,\n permissionRealmId: permission.realmId,\n policyId: defaultPolicy.id,\n policyRealmId: defaultPolicy.realmId,\n }));\n }\n }\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,IAAasD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAWlC,MAAMa,gBAAgBlD,0BAA0BgD,IAAAA;EAChD,IAAIG;EACJ,IAAID,eACAC,mBAAmBpD,yBAAyBmD,eAAeF,IAAAA;EAG/D,MAAMI,aAAaf,UAAUE,QAAQtB,qBAAqBoC,UAAU;EACpE,MAAMC,kBAAkBjB,UAAUE,QAA2B3D,WAAAA;EAE7D,MAAM2E,uBAAuB,IAAI/C,4BAA4B;GACzDgD,YAAYnB,UAAUE,QAAsC5D,gBAAAA;GAC5D2E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIhD,wBAAwB;GACjD+C,YAAY,IAAIpE,iBAAiBgE,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAInD,kCACnC8B,UAAUE,QAAsCpD,sBAAAA,CAAAA;EAGpD,MAAMwE,qBAAqB,IAAIlE,+BAA+B;GAC1D+D,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIhD,sBAAsB;GAC7C4C,YAAYnB,UAAUE,QAA0B1D,UAAAA;GAChDyE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAI1D,wBAAwB;GACjDqD,YAAYnB,UAAUE,QAA4BhE,YAAAA;GAClD+E;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAIjD,uBAAuB;GAC/C2C,YAAYnB,UAAUE,QAA2BxD,WAAAA;GACjDuE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAI1D,6BAC9BgC,UAAUE,QAAiC7D,iBAAAA,CAAAA;EAG/C,MAAMsF,yBAAyB,IAAIxE,mCAAmC;GAClEgE,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAItE,6BAA6B;GACtD6D,YAAYI;GACZL;GACAW,0BAA0B,IAAIvD,gCAC1B0B,UAAUE,QAAoCzD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMqF,qBAAqB,IAAI7E,+BAA+B;GAC1DuE;GACAO,sBAAsB,IAAIhE,4BACtBiC,UAAUE,QAAgC9D,gBAAAA,CAAAA;GAE9C4F,4BAA4B,IAAInE,kCAC5BmC,UAAUE,QAAsC/D,sBAAAA,CAAAA;GAEpDuF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIzE,6BAA6B;GACtD0E,gBAAgB,IAAIxD,sBAAsB;IACtCyC,YAAY,IAAInE,eAAe+D,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAIxD,0BACpBqB,UAAUE,QAA8BtD,cAAAA,CAAAA;GAE5CwF,0BAA0B,IAAI3D,gCAC1BuB,UAAUE,QAAoCvD,oBAAAA,CAAAA;GAGlD6E;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAI9E,8BAA8B,EAAE4D,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAIjF,8BAA8B;GACxD8D,YAAY,IAAI9C,uBAAuB4C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuBrF,8BAA8B;GACvDoE;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY7B,IAAAA;EAQnC,MAAM8B,0BAA0B,IAAIrD,wBAAwB;GACxDoC;GACAC;GACAC;GACAgB,YAAYzD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMwD,iBAAiB,IAAItD,eAAe;GACtCuD,UAAU,IAAI3E,qBAAqB8C,YAAY,EAC3C8B,eAAe5C,OAAO6C,uBAClB,IAAI5D,gBAAgBe,OAAO6C,oBAAoB,IAC/C,KACR,CAAA;GACArC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAOA,IAAI4D;EACJ,IAAI/C,UAAUgD,IAAIpF,yBAAyBH,wBAAwB,GAC/DuC,UAAUiD,WAAWrF,yBAAyBH,wBAAwB;EAE1E,IAAIoD,eAAe;GACfkC,sBAAsB,IAAItF,yBAAyB;IAC/CyF,WAAWrC,cAAcqC,aAAa,CAAC;IACvCC,sBAAsBrC;IACtBsC,cAAcd;IACd7B,QAAQT,UAAUE,QAAQf,kBAAAA;GAC9B,CAAA;GACAa,UAAUqD,SAASzF,yBAAyBH,0BAA0B,EAAE6F,UAAUP,oBAAoB,CAAA;EAC1G;EAEA,MAAMQ,SAAS,MAAMtC,gBAAgBuC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMd,wBAAwBiB,eAAeD,KAAAA;GAC7C,MAAMd,eAAee,eAAeD,KAAAA;GAGpC,IAAIV,uBAAuB,CAACA,oBAAoBY,iBAAiBF,KAAAA,GAC7D,MAAMV,oBAAoBW,eAAeD,KAAAA;EAEjD;EAEA,IAAIxD,OAAO2D,oCACP,MAAM,KAAKC,oBAAoB9C,YAAYK,gBAAAA;CAEnD;CAEA,MAAgByC,oBACZ9C,YACAK,kBACa;EACb,MAAM0C,gBAAgB,MAAM1C,iBAAiB2C,cAAclH,iBAAiBmH,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBlD,WAAWmD,cAAc5H,gBAAAA;EAChD,MAAM6H,eAAepD,WAAWmD,cAAcpH,sBAAAA;EAE9C,MAAMsH,cAAc,MAAMH,eAAeT,KAAI;EAC7C,KAAK,MAAMa,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/module.d.ts CHANGED Viewed

@@ -6,24 +6,5 @@ export declare class CompositeProvisioningSource implements IProvisioningSource
     constructor(sources: IProvisioningSource[]);
     load(container: IContainer): Promise<RootProvisioningEntity>;
     merge(target: RootProvisioningEntity, source: RootProvisioningEntity): void;
-    private buildEntityKey;
-    private mergeEntities;
-    /**
-     * Deep-merge two entries sharing a composite key. The later source wins
-     * per attribute, but relations are UNIONED — a later source (e.g. a
-     * mounted provisioning file) extending a built-in entry (the default
-     * source's master realm) must not silently drop the built-in relations
-     * (admin user, system client).
-     *
-     * Policy extraAttributes merge per key with the later source winning —
-     * like attributes, NOT like relations: an EA value (a names denylist,
-     * an ATTRIBUTES query tree) is policy configuration, and unioning would
-     * make shrinking a list impossible and fabricate predicates neither
-     * source authored.
-     */
-    private mergeEntity;
-    private mergeRecord;
-    private mergeValue;
-    private isEntityArray;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/provisioning/sources/composite/module.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"~~AAQA~~,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;~~AACtG~~,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;~~AAmBxC~~,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;~~IAQpE,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;CAKxB~~"}
1	+ {"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AAEtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;CAOvE"}

package/dist/app/modules/provisioning/sources/composite/module.mjs CHANGED Viewed

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { isObject } from "@authup/kit";
+import { mergeProvisioningEntities } from "../../../../../core/provisioning/merge/module.mjs";
+import "../../../../../core/provisioning/merge/index.mjs";
 //#region src/app/modules/provisioning/sources/composite/module.ts
 var CompositeProvisioningSource = class {
 	sources;
@@ -14,82 +15,11 @@ var CompositeProvisioningSource = class {
 		return output;
 	}
 	merge(target, source) {
-		target.policies = this.mergeEntities(target.policies, source.policies);
-		target.permissions = this.mergeEntities(target.permissions, source.permissions);
-		target.roles = this.mergeEntities(target.roles, source.roles);
-		target.scopes = this.mergeEntities(target.scopes, source.scopes);
-		target.realms = this.mergeEntities(target.realms, source.realms);
-	}
-	buildEntityKey(attributes) {
-		if (!attributes.name) return void 0;
-		return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
-	}
-	mergeEntities(target, source) {
-		if (!source) return target;
-		if (!target) return [...source];
-		const result = [...target];
-		source.forEach((item) => {
-			const key = this.buildEntityKey(item.attributes);
-			if (!key) {
-				result.push(item);
-				return;
-			}
-			const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);
-			if (idx !== -1) result[idx] = this.mergeEntity(result[idx], item);
-			else result.push(item);
-		});
-		return result;
-	}
-	/**
-	* Deep-merge two entries sharing a composite key. The later source wins
-	* per attribute, but relations are UNIONED — a later source (e.g. a
-	* mounted provisioning file) extending a built-in entry (the default
-	* source's master realm) must not silently drop the built-in relations
-	* (admin user, system client).
-	*
-	* Policy extraAttributes merge per key with the later source winning —
-	* like attributes, NOT like relations: an EA value (a names denylist,
-	* an ATTRIBUTES query tree) is policy configuration, and unioning would
-	* make shrinking a list impossible and fabricate predicates neither
-	* source authored.
-	*/ mergeEntity(target, source) {
-		const output = {
-			...target,
-			...source
-		};
-		output.attributes = {
-			...target.attributes,
-			...source.attributes
-		};
-		if (target.strategy && !source.strategy) output.strategy = target.strategy;
-		if (target.relations && source.relations) output.relations = this.mergeRecord(target.relations, source.relations);
-		else if (target.relations && !source.relations) output.relations = target.relations;
-		if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
-			...target.extraAttributes,
-			...source.extraAttributes
-		};
-		else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
-		if (target.children && source.children) output.children = this.mergeEntities(target.children, source.children);
-		else if (target.children && !source.children) output.children = target.children;
-		return output;
-	}
-	mergeRecord(target, source) {
-		const output = { ...target };
-		for (const key of Object.keys(source)) output[key] = key in target ? this.mergeValue(target[key], source[key]) : source[key];
-		return output;
-	}
-	mergeValue(target, source) {
-		if (typeof target === "undefined") return source;
-		if (typeof source === "undefined") return target;
-		if (Array.isArray(target) && Array.isArray(source)) {
-			if (this.isEntityArray(target) || this.isEntityArray(source)) return this.mergeEntities(target, source);
-			return [.../* @__PURE__ */ new Set([...target, ...source])];
-		}
-		if (isObject(target) && isObject(source)) return this.mergeRecord(target, source);
-		return source;
-	}
-	isEntityArray(value) {
-		return value.some((item) => isObject(item) && "attributes" in item);
+		target.policies = mergeProvisioningEntities(target.policies, source.policies);
+		target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);
+		target.roles = mergeProvisioningEntities(target.roles, source.roles);
+		target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);
+		target.realms = mergeProvisioningEntities(target.realms, source.realms);
 	}
 };
 //#endregion

package/dist/app/modules/provisioning/sources/composite/module.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"module.mjs","names":["~~isObject~~","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","~~mergeEntities","~~permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realmId","clientId","result","forEach","item","key","push","idx","findIndex","r","mergeEntity","strategy","relations","mergeRecord","extraAttributes","children","Object","keys","mergeValue","Array","isArray","isEntityArray","Set","value","some"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n /\n\nimport { ~~isObject~~ } from '~~@authup~~/~~kit~~';\nimport ~~type~~ { ~~RootProvisioningEntity~~ } from '../../../../../core/provisioning/~~entities~~/~~root/~~index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\n/\n Structural view of a provisioning entity used by the composite merge.\n * Covers every entity shape (realm, client, user, role, permission, scope,\n * policy): the composite-key attribute bag plus the deep-mergeable groups.\n /\ntype MergeableProvisioningEntity = {\n attributes: {\n name?: string,\n realmId?: string \| null,\n clientId?: string \| null,\n },\n strategy?: unknown,\n relations?: Record<string, unknown>,\n children?: MergeableProvisioningEntity[],\n extraAttributes?: Record<string, unknown>,\n};\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n protected sources : IProvisioningSource[];\n\n constructor(sources : IProvisioningSource[]) {\n this.sources = sources;\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const output : RootProvisioningEntity = {};\n\n const sourcesData = await Promise.all(\n (this.sources).map((source) => source.load(container)),\n );\n\n sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n return output;\n }\n\n merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n target.policies = ~~this.mergeEntities~~(target.policies, source.policies);\n target.permissions = ~~this.mergeEntities~~(target.permissions, source.permissions);\n target.roles = ~~this.mergeEntities~~(target.roles, source.roles);\n target.scopes = ~~this.mergeEntities~~(target.scopes, source.scopes);\n target.realms = ~~this.mergeEntities~~(target.realms, source.realms);\n }\n\n private buildEntityKey(\n attributes: MergeableProvisioningEntity['attributes'],\n ): string \| undefined {\n if (!attributes.name) return undefined;\n return `${attributes.name}~~:${attributes.realmId \|\| ''}:${attributes.clientId \|\| ''}`;\n }~~\n\n private mergeEntities<T extends MergeableProvisioningEntity>(\n target: T[] \| undefined,\n source: T[] \| undefined,\n ): T[] \| undefined {\n if (!source) return target;\n if (!target) return [...source];\n\n const result = [...target];\n source.forEach((item) => {\n const key = this.buildEntityKey(item.attributes);\n if (!key) {\n result.push(item);\n return;\n }\n\n const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n if (idx !== -1) {\n result[idx] = this.mergeEntity(result[idx], item) as T;\n } else {\n result.push(item);\n }\n });\n return result;\n }\n\n /\n Deep-merge two entries sharing a composite key. The later source wins\n * per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n \n Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\n private mergeEntity(\n target: MergeableProvisioningEntity,\n source: MergeableProvisioningEntity,\n ): MergeableProvisioningEntity {\n const output = { ...target, ...source };\n\n output.attributes = { ...target.attributes, ...source.attributes };\n\n if (target.strategy && !source.strategy) {\n output.strategy = target.strategy;\n }\n\n if (target.relations && source.relations) {\n output.relations = this.mergeRecord(target.relations, source.relations);\n } else if (target.relations && !source.relations) {\n output.relations = target.relations;\n }\n\n if (target.extraAttributes && source.extraAttributes) {\n output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n } else if (target.extraAttributes && !source.extraAttributes) {\n output.extraAttributes = target.extraAttributes;\n }\n\n if (target.children && source.children) {\n output.children = this.mergeEntities(target.children, source.children);\n } else if (target.children && !source.children) {\n output.children = target.children;\n }\n\n return output;\n }\n\n private mergeRecord(\n target: Record<string, unknown>,\n source: Record<string, unknown>,\n ): Record<string, unknown> {\n const output : Record<string, unknown> = { ...target };\n for (const key of Object.keys(source)) {\n output[key] = key in target ?\n this.mergeValue(target[key], source[key]) :\n source[key];\n }\n return output;\n }\n\n private mergeValue(target: unknown, source: unknown): unknown {\n if (typeof target === 'undefined') return source;\n if (typeof source === 'undefined') return target;\n\n if (Array.isArray(target) && Array.isArray(source)) {\n if (this.isEntityArray(target) \|\| this.isEntityArray(source)) {\n return this.mergeEntities(\n target as MergeableProvisioningEntity[],\n source as MergeableProvisioningEntity[],\n );\n }\n return [...new Set([...target, ...source])];\n }\n\n if (isObject(target) && isObject(source)) {\n return this.mergeRecord(target, source);\n }\n\n return source;\n }\n\n private isEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n return value.some(\n (item) => isObject(item) && 'attributes' in item,\n );\n }\n}\n"],"mappings":"~~;;;;;AA6BA~~,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,~~WAAW~~,~~KAAKC~~,~~cAAcF,~~OAAOC,UAAUJ,OAAOI,QAAQ;~~EACrED~~,~~OAAOG~~,~~cAAc~~,~~KAAKD~~,~~cAAcF~~,~~OAAOG~~,~~aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,~~OAAOK,~~SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YACkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,~~WAAW~~,GAAG,GAAGH,WAAWI,YAAY~~;~~CACpF;CAEQV~~,~~cACJF~~,~~QACAH~~,~~QACe;EACf~~,~~IAAI,CAACA,QAAQ,~~OAAOG~~;EACpB~~,~~IAAI~~,~~CAACA~~,~~QAAQ,OAAO,CAAIH,GAAAA,MAAO;EAE/B,MAAMgB,SAAS,CAAIb,GAAAA,MAAO;EAC1BH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,~~KAAK;~~IACNH~~,OAAOI,~~KAAKF~~,~~IAAAA;IACZ;GACJ;GAEA~~,~~MAAMG~~,~~MAAML~~,~~OAAOM~~,~~WAAWC,~~MAAM~~,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA~~;~~GAC1E~~,~~IAAIE,QAAQ,IACRL,~~OAAOK,~~OAAO~~,~~KAAKG~~,~~YAAYR,~~OAAOK,~~MAAMH~~,~~IAAAA;QAE5CF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;;;;;;;;;;;;;IAeA,YACIb,QACAH,QAC2B;EAC3B,MAAML,SAAS;GAAE,GAAGQ;GAAQ,GAAGH;EAAO;EAEtCL,OAAOgB,aAAa;GAAE,GAAGR,~~OAAOQ~~;GAAY~~,~~GAAGX,OAAOW~~;~~EAAW~~;EAEjE,IAAIR,OAAOsB,YAAY,CAACzB,OAAOyB,UAC3B9B,OAAO8B,WAAWtB,OAAOsB;EAG7B,IAAItB,OAAOuB,aAAa1B,OAAO0B,WAC3B/B,OAAO+B,YAAY,KAAKC,YAAYxB,OAAOuB,WAAW1B,OAAO0B,SAAS;OACnE,IAAIvB,OAAOuB,aAAa,CAAC1B,OAAO0B,WACnC/B,OAAO+B,YAAYvB,OAAOuB;EAG9B,IAAIvB,OAAOyB,mBAAmB5B,OAAO4B,iBACjCjC,OAAOiC,kBAAkB;GAAE,GAAGzB,OAAOyB;GAAiB,GAAG5B,OAAO4B;EAAgB;OAC7E,IAAIzB,OAAOyB,mBAAmB,CAAC5B,OAAO4B,iBACzCjC,OAAOiC,kBAAkBzB,OAAOyB;EAGpC,IAAIzB,OAAO0B,YAAY7B,OAAO6B,UAC1BlC,OAAOkC,WAAW,KAAKxB,cAAcF,OAAO0B,UAAU7B,OAAO6B,QAAQ;OAClE,IAAI1B,OAAO0B,YAAY,CAAC7B,OAAO6B,UAClClC,OAAOkC,WAAW1B,OAAO0B;EAG7B,OAAOlC;CACX;CAEQgC,YACJxB,QACAH,QACuB;EACvB,MAAML,SAAmC,EAAE,GAAGQ,OAAO;EACrD,KAAK,MAAMgB,OAAOW,OAAOC,KAAK/B,MAAAA,GAC1BL,OAAOwB,OAAOA,OAAOhB,SACjB,KAAK6B,WAAW7B,OAAOgB,MAAMnB,OAAOmB,IAAI,IACxCnB,OAAOmB;EAEf,OAAOxB;CACX;CAEQqC,WAAW7B,QAAiBH,QAA0B;EAC1D,IAAI,OAAOG,WAAW,aAAa,OAAOH;EAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOG;EAE1C,IAAI8B,MAAMC,QAAQ/B,MAAAA,KAAW8B,MAAMC,QAAQlC,MAAAA,GAAS;GAChD,IAAI,KAAKmC,cAAchC,MAAAA,KAAW,KAAKgC,cAAcnC,MAAAA,GACjD,OAAO,KAAKK,cACRF,QACAH,MAAAA;GAGR,OAAO,CAAI,mBAAA,IAAIoC,IAAI,CAAIjC,GAAAA,QAAWH,GAAAA,MAAO,CAAA,CAAE;EAC/C;EAEA,IAAIV,SAASa,MAAAA,KAAWb,SAASU,MAAAA,GAC7B,OAAO,KAAK2B,YAAYxB,QAAQH,MAAAA;EAGpC,OAAOA;CACX;CAEQmC,cAAcE,OAA0D;EAC5E,OAAOA,MAAMC,MACRpB,SAAS5B,SAAS4B,IAAAA,KAAS,gBAAgBA,IAAAA;CAEpD;AACJ"}
1	+ {"version":3,"file":"module.mjs","names":["mergeProvisioningEntities","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","permissions","roles","scopes","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/\n Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport { mergeProvisioningEntities } from '../../../../../core/provisioning/merge/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n protected sources : IProvisioningSource[];\n\n constructor(sources : IProvisioningSource[]) {\n this.sources = sources;\n }\n\n async load(container: IContainer): Promise<RootProvisioningEntity> {\n const output : RootProvisioningEntity = {};\n\n const sourcesData = await Promise.all(\n (this.sources).map((source) => source.load(container)),\n );\n\n sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n return output;\n }\n\n merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n target.policies = mergeProvisioningEntities(target.policies, source.policies);\n target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);\n target.roles = mergeProvisioningEntities(target.roles, source.roles);\n target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);\n target.realms = mergeProvisioningEntities(target.realms, source.realms);\n }\n}\n"],"mappings":";;;;;;AAYA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAWd,0BAA0Ba,OAAOC,UAAUJ,OAAOI,QAAQ;EAC5ED,OAAOE,cAAcf,0BAA0Ba,OAAOE,aAAaL,OAAOK,WAAW;EACrFF,OAAOG,QAAQhB,0BAA0Ba,OAAOG,OAAON,OAAOM,KAAK;EACnEH,OAAOI,SAASjB,0BAA0Ba,OAAOI,QAAQP,OAAOO,MAAM;EACtEJ,OAAOK,SAASlB,0BAA0Ba,OAAOK,QAAQR,OAAOQ,MAAM;CAC1E;AACJ"}

package/dist/core/entities/client/index.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 export * from './constants.ts';
 export * from './service.ts';
 export * from './types.ts';
-export * from './web-client.ts';
+export * from './system-clients.ts';
 export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,~~iBAAiB~~,CAAC;~~AAChC~~,cAAc,aAAa,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC"}

package/dist/core/entities/client/index.mjs CHANGED Viewed

@@ -4,5 +4,5 @@ import.meta.url;
 import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
 import { clientSchema } from "./schema.mjs";
 import { ClientService } from "./service.mjs";
-import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
-export { CLIENT_READ_PERMISSIONS, ClientService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes, clientSchema };
+import { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes } from "./system-clients.mjs";
+export { CLIENT_READ_PERMISSIONS, ClientService, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes, clientSchema };