@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.59

package/dist/core/entities/client/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n        // The per-row `secret` visibility gate lives on the client SCHEMA\n        // (`fields.validateMany`, issue #3322), so it also covers the\n        // `include=client` paths served by other services; the repository\n        // layer redacts unauthorized values without dropping rows.\n        return this.repository.findMany(\n            await decodeQuery(query, { schema: clientSchema, actor }),\n        );\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: CLIENT_READ_PERMISSIONS,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, `web`) so an\n        // API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isUUID","EntityNotFoundError","ValidationError","CLIENT_RESERVED_NAMES","ClientAuthMethod","ClientValidator","PermissionName","AbstractEntityService","ClientCredentialsService","CLIENT_READ_PERMISSIONS","decodeQuery","clientSchema","ClientService","repository","realmRepository","validator","ctx","getMany","query","actor","permissionEvaluator","preEvaluateOneOf","name","findMany","schema","getOne","idOrName","realmId","isMe","identity","type","data","id","entity","findOne","parameters","secret","secretEncrypted","secretHashed","evaluateOneOf","ATTRIBUTES","resourceRealmMatch","create","save","undefined","update","updateOnly","options","group","realm","resolve","where","findOneWithSecret","isSelfEdit","preEvaluate","CLIENT_UPDATE","e","CLIENT_SELF_MANAGE","UPDATE","CLIENT_CREATE","CREATE","validated","run","includes","builtIn","validateJoinColumns","checkUniqueness","credentialsService","actorRealmId","getActorRealmId","evaluate","merge","authMethod","SECRET","generateSecret","protect","created","delete","CLIENT_DELETE","findOneBy","entityId","remove"],"sources":["../../../../src/core/entities/client/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    CLIENT_RESERVED_NAMES,\n    ClientAuthMethod,\n    ClientValidator,\n    PermissionName,\n} from '@authup/core-kit';\nimport type { Client } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult  } from '@authup/server-kit';\nimport type { IRealmRepository } from '../realm/types.ts';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport { ClientCredentialsService } from '../../authentication/credential/entities/client/module.ts';\nimport type { IClientRepository, IClientService } from './types.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { clientSchema } from './schema.ts';\n\nexport type ClientServiceContext = {\n    repository: IClientRepository;\n    realmRepository: IRealmRepository;\n};\n\nexport class ClientService extends AbstractEntityService implements IClientService {\n    protected repository: IClientRepository;\n\n    protected realmRepository: IRealmRepository;\n\n    protected validator: ClientValidator;\n\n    constructor(ctx: ClientServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmRepository = ctx.realmRepository;\n        this.validator = new ClientValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<EntityRepositoryFindManyResult<Client>> {\n        await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n\n        // The per-row `secret` visibility gate lives on the client SCHEMA\n        // (`fields.validateMany`, issue #3322), so it also covers the\n        // `include=client` paths served by other services; the repository\n        // layer redacts unauthorized values without dropping rows.\n        return this.repository.findMany(\n            await decodeQuery(query, { schema: clientSchema, actor }),\n        );\n    }\n\n    async getOne(\n        idOrName: string,\n        actor: ActorContext,\n        query?: Record<string, any>,\n        realmId?: string,\n    ): Promise<Client> {\n        let isMe = !!actor.identity &&\n            actor.identity.type === 'client' &&\n            (\n                actor.identity.data.id === idOrName ||\n                actor.identity.data.name === idOrName\n            );\n\n        if (!isMe) {\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        const entity = await this.repository.findOne(\n            idOrName,\n            await decodeQuery(query, {\n                schema: clientSchema, \n                parameters: ['fields', 'relations'], \n                actor, \n            }),\n            realmId,\n        );\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (isMe && actor.identity!.data.id !== entity.id) {\n            isMe = false;\n            await actor.permissionEvaluator.preEvaluateOneOf({ name: CLIENT_READ_PERMISSIONS });\n        }\n\n        if (\n            !isMe &&\n            entity.secret &&\n            !entity.secretEncrypted &&\n            !entity.secretHashed\n        ) {\n            await actor.permissionEvaluator.evaluateOneOf({\n                name: CLIENT_READ_PERMISSIONS,\n                data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n            });\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Client> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Client,\n        created: boolean \n    }> {\n        let group: string;\n\n        const realm = typeof data.realmId === 'string' ?\n            await this.realmRepository.resolve(data.realmId) :\n            undefined;\n\n        let entity: Client | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            if (realm) {\n                where.realmId = realm.id;\n            }\n\n            entity = await this.repository.findOneWithSecret(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        let isSelfEdit = false;\n        if (entity) {\n            try {\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_UPDATE });\n            } catch (e) {\n                if (\n                    !actor.identity ||\n                    actor.identity.type !== 'client' ||\n                    actor.identity.data.id !== entity.id\n                ) {\n                    throw e;\n                }\n                isSelfEdit = true;\n                await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_SELF_MANAGE });\n            }\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        // Reserve the system-provisioned client names (`system`, the console\n        // clients) so an API caller can't create or rename a client onto them — that would\n        // collide on unique(name, realmId) or shadow the builtIn client.\n        // Provisioning and runtime hooks bypass this service, so they remain\n        // free to manage the reserved clients. builtIn clients are exempt\n        // (they ARE the provisioned ones) but API callers can never produce a\n        // builtIn client since the validator strips the flag.\n        if (\n            typeof validated.name === 'string' &&\n            CLIENT_RESERVED_NAMES.includes(validated.name) &&\n            !(entity && entity.builtIn && entity.name === validated.name)\n        ) {\n            throw new ValidationError(`The client name '${validated.name}' is reserved.`);\n        }\n\n        await this.repository.validateJoinColumns(validated);\n        await this.repository.checkUniqueness(validated, entity || undefined);\n\n        const credentialsService = new ClientCredentialsService();\n\n        if (entity) {\n            if (\n                !isSelfEdit &&\n                !validated.realmId &&\n                !entity.realmId\n            ) {\n                const actorRealmId = this.getActorRealmId(actor);\n                if (actorRealmId) {\n                    validated.realmId = actorRealmId;\n                }\n            }\n\n            if (isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_SELF_MANAGE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n                });\n            }\n\n            entity = this.repository.merge(entity, validated);\n\n            if (!isSelfEdit) {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.CLIENT_UPDATE,\n                    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n                });\n            }\n\n            if (entity.authMethod === ClientAuthMethod.SECRET) {\n                if (!validated.secret && !entity.secret) {\n                    validated.secret = credentialsService.generateSecret();\n                }\n\n                if (validated.secret) {\n                    entity.secret = await credentialsService.protect(validated.secret, entity);\n                }\n            } else {\n                entity.secret = null;\n                entity.secretHashed = false;\n                entity.secretEncrypted = false;\n            }\n\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        if (!validated.realmId) {\n            const actorRealmId = this.getActorRealmId(actor);\n            if (actorRealmId) {\n                validated.realmId = actorRealmId;\n            }\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated, ...this.resourceRealmMatch(validated) }),\n        });\n\n        entity = this.repository.create(validated);\n\n        if (entity.authMethod === ClientAuthMethod.SECRET) {\n            if (!validated.secret) {\n                validated.secret = credentialsService.generateSecret();\n            }\n\n            entity.secret = await credentialsService.protect(validated.secret, validated);\n        } else {\n            entity.secret = null;\n            entity.secretHashed = false;\n            entity.secretEncrypted = false;\n        }\n\n        await this.repository.save(entity);\n\n        return {\n            entity,\n            created: true, \n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Client> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.CLIENT_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.CLIENT_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity, ...this.resourceRealmMatch(entity) }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,IAAae,gBAAb,cAAmCL,sBAAAA;CACrBM;CAEAC;CAEAC;CAEV,YAAYC,KAA2B;EACnC,MAAK;EACL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,kBAAkBE,IAAIF;EAC3B,KAAKC,YAAY,IAAIV,gBAAAA;CACzB;CAEA,MAAMY,QACFC,OACAC,OAC+C;EAC/C,MAAMA,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAMjF,OAAO,KAAKI,WAAWU,SACnB,MAAMb,YAAYQ,OAAO;GAAEM,QAAQb;GAAcQ;EAAM,CAAA,CAAA;CAE/D;CAEA,MAAMM,OACFC,UACAP,OACAD,OACAS,SACe;EACf,IAAIC,OAAO,CAAC,CAACT,MAAMU,YACfV,MAAMU,SAASC,SAAS,aAEpBX,MAAMU,SAASE,KAAKC,OAAON,YAC3BP,MAAMU,SAASE,KAAKT,SAASI;EAGrC,IAAI,CAACE,MACD,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EAGrF,MAAMwB,SAAS,MAAM,KAAKpB,WAAWqB,QACjCR,UACA,MAAMhB,YAAYQ,OAAO;GACrBM,QAAQb;GACRwB,YAAY,CAAC,UAAU,WAAY;GACnChB;EACJ,CAAA,GACAQ,OAAAA;EAEJ,IAAI,CAACM,QACD,MAAM,IAAIhC,oBAAAA;EAGd,IAAI2B,QAAQT,MAAMU,SAAUE,KAAKC,OAAOC,OAAOD,IAAI;GAC/CJ,OAAO;GACP,MAAMT,MAAMC,oBAAoBC,iBAAiB,EAAEC,MAAMb,wBAAwB,CAAA;EACrF;EAEA,IACI,CAACmB,QACDK,OAAOG,UACP,CAACH,OAAOI,mBACR,CAACJ,OAAOK,cAER,MAAMnB,MAAMC,oBAAoBmB,cAAc;GAC1CjB,MAAMb;GACNsB,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAGJ,OAAOA;CACX;CAEA,MAAMS,OACFX,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKC,KAAAA,GAAWb,MAAMZ,KAAAA;EACpD,OAAOc;CACX;CAEA,MAAMY,OACFnB,UACAK,MACAZ,OACe;EACf,MAAM,EAAEc,WAAW,MAAM,KAAKU,KAAKjB,UAAUK,MAAMZ,OAAO,EAAE2B,YAAY,KAAK,CAAA;EAC7E,OAAOb;CACX;CAEA,MAAMU,KACFjB,UACAK,MACAZ,OACA4B,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,MAAMC,QAAQ,OAAOlB,KAAKJ,YAAY,WAClC,MAAM,KAAKb,gBAAgBoC,QAAQnB,KAAKJ,OAAO,IAC/CiB,KAAAA;EAEJ,IAAIX;EACJ,IAAIP,UAAU;GACV,MAAMyB,QAA6B,CAAC;GACpC,IAAInD,OAAO0B,QAAAA,GACPyB,MAAMnB,KAAKN;QAEXyB,MAAM7B,OAAOI;GAGjB,IAAIuB,OACAE,MAAMxB,UAAUsB,MAAMjB;GAG1BC,SAAS,MAAM,KAAKpB,WAAWuC,kBAAkBD,KAAAA;GAGjD,IAAI,CAAClB,WAAWc,QAAQD,cAAcK,MAAMnB,KACxC,MAAM,IAAI/B,oBAAAA;EAElB,OAAO,IAAI8C,QAAQD,YACf,MAAM,IAAI7C,oBAAAA;EAGd,IAAIoD,aAAa;EACjB,IAAIpB,QAAQ;GACR,IAAI;IACA,MAAMd,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeiD,cAAc,CAAA;GACrF,SAASC,GAAG;IACR,IACI,CAACrC,MAAMU,YACPV,MAAMU,SAASC,SAAS,YACxBX,MAAMU,SAASE,KAAKC,OAAOC,OAAOD,IAElC,MAAMwB;IAEVH,aAAa;IACb,MAAMlC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAemD,mBAAmB,CAAA;GAC1F;GACAT,QAAQjD,eAAe2D;EAC3B,OAAO;GACH,MAAMvC,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAeqD,cAAc,CAAA;GACjFX,QAAQjD,eAAe6D;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK9C,UAAU+C,IAAI/B,MAAM,EAAEiB,MAAM,CAAA;EASzD,IACI,OAAOa,UAAUvC,SAAS,YAC1BnB,sBAAsB4D,SAASF,UAAUvC,IAAI,KAC7C,EAAEW,UAAUA,OAAO+B,WAAW/B,OAAOX,SAASuC,UAAUvC,OAExD,MAAM,IAAIpB,gBAAgB,oBAAoB2D,UAAUvC,KAAK,eAAe;EAGhF,MAAM,KAAKT,WAAWoD,oBAAoBJ,SAAAA;EAC1C,MAAM,KAAKhD,WAAWqD,gBAAgBL,WAAW5B,UAAUW,KAAAA,CAAAA;EAE3D,MAAMuB,qBAAqB,IAAI3D,yBAAAA;EAE/B,IAAIyB,QAAQ;GACR,IACI,CAACoB,cACD,CAACQ,UAAUlC,WACX,CAACM,OAAON,SACV;IACE,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;IAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;GAE5B;GAEA,IAAIf,YACA,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAemD;IACrB1B,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaqB;KAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;IAAW,CAAA;GAC9G,CAAA;GAGJ5B,SAAS,KAAKpB,WAAW0D,MAAMtC,QAAQ4B,SAAAA;GAEvC,IAAI,CAACR,YACD,MAAMlC,MAAMC,oBAAoBkD,SAAS;IACrChD,MAAMhB,eAAeiD;IACrBxB,MAAMjC,iBAAiB;MAAGD,kBAAkB2C,aAAaP;KAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;IAAQ,CAAA;GACxG,CAAA;GAGJ,IAAIA,OAAOuC,eAAepE,iBAAiBqE,QAAQ;IAC/C,IAAI,CAACZ,UAAUzB,UAAU,CAACH,OAAOG,QAC7ByB,UAAUzB,SAAS+B,mBAAmBO,eAAc;IAGxD,IAAIb,UAAUzB,QACVH,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQH,MAAAA;GAE3E,OAAO;IACHA,OAAOG,SAAS;IAChBH,OAAOK,eAAe;IACtBL,OAAOI,kBAAkB;GAC7B;GAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;GAE3B,OAAO;IACHA;IACA2C,SAAS;GACb;EACJ;EAEA,IAAI,CAACf,UAAUlC,SAAS;GACpB,MAAMyC,eAAe,KAAKC,gBAAgBlD,KAAAA;GAC1C,IAAIiD,cACAP,UAAUlC,UAAUyC;EAE5B;EAEA,MAAMjD,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAeqD;GACrB5B,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaqB;IAAW,GAAG,KAAKpB,mBAAmBoB,SAAAA;GAAW,CAAA;EAC9G,CAAA;EAEA5B,SAAS,KAAKpB,WAAW6B,OAAOmB,SAAAA;EAEhC,IAAI5B,OAAOuC,eAAepE,iBAAiBqE,QAAQ;GAC/C,IAAI,CAACZ,UAAUzB,QACXyB,UAAUzB,SAAS+B,mBAAmBO,eAAc;GAGxDzC,OAAOG,SAAS,MAAM+B,mBAAmBQ,QAAQd,UAAUzB,QAAQyB,SAAAA;EACvE,OAAO;GACH5B,OAAOG,SAAS;GAChBH,OAAOK,eAAe;GACtBL,OAAOI,kBAAkB;EAC7B;EAEA,MAAM,KAAKxB,WAAW8B,KAAKV,MAAAA;EAE3B,OAAO;GACHA;GACA2C,SAAS;EACb;CACJ;CAEA,MAAMC,OACF7C,IACAb,OACe;EACf,MAAMA,MAAMC,oBAAoBkC,YAAY,EAAEhC,MAAMhB,eAAewE,cAAc,CAAA;EAEjF,MAAM7C,SAAS,MAAM,KAAKpB,WAAWkE,UAAU,EAAE/C,GAAG,CAAA;EACpD,IAAI,CAACC,QACD,MAAM,IAAIhC,oBAAAA;EAGd,MAAMkB,MAAMC,oBAAoBkD,SAAS;GACrChD,MAAMhB,eAAewE;GACrB/C,MAAMjC,iBAAiB;KAAGD,kBAAkB2C,aAAaP;IAAQ,GAAG,KAAKQ,mBAAmBR,MAAAA;GAAQ,CAAA;EACxG,CAAA;EAEA,MAAM,EAAED,IAAIgD,aAAa/C;EACzB,MAAM,KAAKpB,WAAWoE,OAAOhD,MAAAA;EAC7BA,OAAOD,KAAKgD;EAEZ,OAAO/C;CACX;AACJ"}

package/dist/core/entities/client/system-clients.d.ts

@@ -0,0 +1,95 @@
+import type { Client, Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { IClientScopeRepository } from '../client-scope/types.ts';
+import type { IScopeRepository } from '../scope/types.ts';
+import type { IClientRepository, ISystemClientProvisioner, SystemClientDefinition } from './types.ts';
+export type SystemClientProvisionerContext = {
+    clientRepository: IClientRepository;
+    scopeRepository: IScopeRepository;
+    clientScopeRepository: IClientScopeRepository;
+    appOrigins: string[];
+    logger?: Logger;
+};
+/**
+ * The scopes every system client is granted.
+ *
+ * `global` lets the issued token drive the management API (parity with the
+ * legacy password-grant admin login); `openid` yields the id-token.
+ */
+export declare const SYSTEM_CLIENT_SCOPE_NAMES: string[];
+/**
+ * The public (PKCE) clients provisioned for every realm (plan 079):
+ *
+ * - `admin-console` — authup's own admin console (apps/client-admin-console),
+ * - `account-console` — the account self-service surface (plan 080; each
+ *   definition gets its own `<origin>/**` patterns from
+ *   `buildSystemClientAttributes`, so an inert row adds no redirect
+ *   surface).
+ *
+ * Downstream RPs register their own clients (per realm, or in every realm
+ * via a wildcard realm provisioning entry, plan 082) — the former shared
+ * `web` client was removed.
+ *
+ * `displayName` is seeded at CREATE only and never re-asserted by the
+ * MERGE, so an admin may relabel a client without the next boot undoing it.
+ */
+export declare const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[];
+/**
+ * Build the MERGE-owned attribute set for a realm's system client.
+ *
+ * `builtIn` makes the client auto-consent in the /authorize flow and
+ * protects it from the API reserved-name guard.
+ *
+ * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
+ * /token grants and the /authorize code-request verifier; null = allow-all),
+ * so it must list every flow the client uses. `redirectUri` and
+ * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
+ * origin (matched by isSimpleMatch) — deliberately the shared app-origin
+ * set for every definition: `redirectUri` is re-asserted on each boot, so a
+ * separately-hosted surface (plan 078 "relocatable by choice") registers
+ * its origin via TRUSTED_ORIGINS rather than editing the client row.
+ *
+ * The `scope` column is descriptive only. Scope authorization resolves
+ * through the `auth_client_scopes` junction, which
+ * `SystemClientProvisioner.ensureForRealm` fills from the definition's
+ * `scopeNames`.
+ *
+ * `accessPolicyId` and `displayName` are deliberately NOT part of this set:
+ * the MERGE must neither wipe an admin-bound access policy nor undo a
+ * relabel.
+ */
+export declare function buildSystemClientAttributes(definition: SystemClientDefinition, realm: Realm | {
+    id: string;
+}, appOrigins: string[]): Partial<Client>;
+export declare class SystemClientProvisioner implements ISystemClientProvisioner {
+    protected clientRepository: IClientRepository;
+    protected scopeRepository: IScopeRepository;
+    protected clientScopeRepository: IClientScopeRepository;
+    protected appOrigins: string[];
+    protected logger?: Logger;
+    constructor(ctx: SystemClientProvisionerContext);
+    ensureForRealm(realm: Realm | {
+        id: string;
+    }): Promise<void>;
+    /**
+     * Upsert the client row itself.
+     *
+     * Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the
+     * row belongs to the system whatever state it is in. A non-built-in one
+     * predates the reservation and is taken over rather than left to shadow
+     * the realm's system client.
+     */
+    protected ensureClient(definition: SystemClientDefinition, realm: Realm | {
+        id: string;
+    }): Promise<Client>;
+    /**
+     * Bind the definition's scopes through `auth_client_scopes`. That
+     * junction is the only source the /authorize code-request verifier reads
+     * scopes from.
+     *
+     * Additive like the attribute MERGE above: an extra scope an admin bound
+     * by hand is left in place.
+     */
+    protected ensureScopes(definition: SystemClientDefinition, client: Client): Promise<void>;
+}
+//# sourceMappingURL=system-clients.d.ts.map

package/dist/core/entities/client/system-clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-clients.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/system-clients.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEtG,MAAM,MAAM,8BAA8B,GAAG;IACzC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,EAG7C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,EAW7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CACvC,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,uBAAwB,YAAW,wBAAwB;IACpE,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,8BAA8B;IAQzC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlE;;;;;;;OAOG;cACa,YAAY,CACxB,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,MAAM,CAAC;IAyDlB;;;;;;;OAOG;cACa,YAAY,CAAC,UAAU,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiClG"}

package/dist/core/entities/client/system-clients.mjs

@@ -0,0 +1,158 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CLIENT_ACCOUNT_CONSOLE_NAME, CLIENT_ADMIN_CONSOLE_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
+//#region src/core/entities/client/system-clients.ts
+/**
+* The scopes every system client is granted.
+*
+* `global` lets the issued token drive the management API (parity with the
+* legacy password-grant admin login); `openid` yields the id-token.
+*/ const SYSTEM_CLIENT_SCOPE_NAMES = [ScopeName.GLOBAL, ScopeName.OPEN_ID];
+/**
+* The public (PKCE) clients provisioned for every realm (plan 079):
+*
+* - `admin-console` — authup's own admin console (apps/client-admin-console),
+* - `account-console` — the account self-service surface (plan 080; each
+*   definition gets its own `<origin>/**` patterns from
+*   `buildSystemClientAttributes`, so an inert row adds no redirect
+*   surface).
+*
+* Downstream RPs register their own clients (per realm, or in every realm
+* via a wildcard realm provisioning entry, plan 082) — the former shared
+* `web` client was removed.
+*
+* `displayName` is seeded at CREATE only and never re-asserted by the
+* MERGE, so an admin may relabel a client without the next boot undoing it.
+*/ const SYSTEM_CLIENT_DEFINITIONS = [{
+	name: CLIENT_ADMIN_CONSOLE_NAME,
+	displayName: "Admin Console",
+	scopeNames: SYSTEM_CLIENT_SCOPE_NAMES
+}, {
+	name: CLIENT_ACCOUNT_CONSOLE_NAME,
+	displayName: "Account Console",
+	scopeNames: SYSTEM_CLIENT_SCOPE_NAMES
+}];
+/**
+* Build the MERGE-owned attribute set for a realm's system client.
+*
+* `builtIn` makes the client auto-consent in the /authorize flow and
+* protects it from the API reserved-name guard.
+*
+* `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
+* /token grants and the /authorize code-request verifier; null = allow-all),
+* so it must list every flow the client uses. `redirectUri` and
+* `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
+* origin (matched by isSimpleMatch) — deliberately the shared app-origin
+* set for every definition: `redirectUri` is re-asserted on each boot, so a
+* separately-hosted surface (plan 078 "relocatable by choice") registers
+* its origin via TRUSTED_ORIGINS rather than editing the client row.
+*
+* The `scope` column is descriptive only. Scope authorization resolves
+* through the `auth_client_scopes` junction, which
+* `SystemClientProvisioner.ensureForRealm` fills from the definition's
+* `scopeNames`.
+*
+* `accessPolicyId` and `displayName` are deliberately NOT part of this set:
+* the MERGE must neither wipe an admin-bound access policy nor undo a
+* relabel.
+*/ function buildSystemClientAttributes(definition, realm, appOrigins) {
+	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
+	return {
+		name: definition.name,
+		realmId: realm.id,
+		authMethod: ClientAuthMethod.NONE,
+		tokenBindingMethod: ClientTokenBindingMethod.NONE,
+		builtIn: true,
+		active: true,
+		grantTypes: "authorization_code refresh_token",
+		scope: definition.scopeNames.join(" "),
+		redirectUri: originPatterns,
+		postLogoutRedirectUri: originPatterns
+	};
+}
+var SystemClientProvisioner = class {
+	clientRepository;
+	scopeRepository;
+	clientScopeRepository;
+	appOrigins;
+	logger;
+	constructor(ctx) {
+		this.clientRepository = ctx.clientRepository;
+		this.scopeRepository = ctx.scopeRepository;
+		this.clientScopeRepository = ctx.clientScopeRepository;
+		this.appOrigins = ctx.appOrigins;
+		this.logger = ctx.logger;
+	}
+	async ensureForRealm(realm) {
+		for (const definition of SYSTEM_CLIENT_DEFINITIONS) {
+			const client = await this.ensureClient(definition, realm);
+			await this.ensureScopes(definition, client);
+		}
+	}
+	/**
+	* Upsert the client row itself.
+	*
+	* Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the
+	* row belongs to the system whatever state it is in. A non-built-in one
+	* predates the reservation and is taken over rather than left to shadow
+	* the realm's system client.
+	*/ async ensureClient(definition, realm) {
+		const attributes = buildSystemClientAttributes(definition, realm, this.appOrigins);
+		const existing = await this.clientRepository.findOneBy({
+			name: definition.name,
+			realmId: realm.id
+		});
+		if (existing) {
+			if (!Object.keys(attributes).some((key) => existing[key] !== attributes[key])) return existing;
+			let target = existing;
+			if (!existing.builtIn) {
+				if (this.logger) this.logger.warn(`Taking over the non-built-in client named '${definition.name}' in realm ${realm.id}: the name is reserved for a built-in system client.`);
+				target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;
+				target.secret = null;
+				target.secretHashed = false;
+				target.secretEncrypted = false;
+			}
+			const merged = this.clientRepository.merge(target, attributes);
+			return this.clientRepository.save(merged);
+		}
+		const entity = this.clientRepository.create({
+			...attributes,
+			displayName: definition.displayName
+		});
+		return this.clientRepository.save(entity);
+	}
+	/**
+	* Bind the definition's scopes through `auth_client_scopes`. That
+	* junction is the only source the /authorize code-request verifier reads
+	* scopes from.
+	*
+	* Additive like the attribute MERGE above: an extra scope an admin bound
+	* by hand is left in place.
+	*/ async ensureScopes(definition, client) {
+		for (const name of definition.scopeNames) {
+			const scope = await this.scopeRepository.findOneBy({
+				name,
+				realmId: null
+			});
+			if (!scope) {
+				if (this.logger) this.logger.warn(`Skipping scope '${name}' for the ${definition.name} client of realm ${client.realmId}: the scope is not provisioned.`);
+				continue;
+			}
+			if (await this.clientScopeRepository.findOneBy({
+				clientId: client.id,
+				scopeId: scope.id
+			})) continue;
+			await this.clientScopeRepository.save(this.clientScopeRepository.create({
+				clientId: client.id,
+				clientRealmId: client.realmId,
+				scopeId: scope.id,
+				scopeRealmId: scope.realmId
+			}));
+		}
+	}
+};
+//#endregion
+export { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes };
+
+//# sourceMappingURL=system-clients.mjs.map

package/dist/core/entities/client/system-clients.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-clients.mjs","names":["CLIENT_ACCOUNT_CONSOLE_NAME","CLIENT_ADMIN_CONSOLE_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","SYSTEM_CLIENT_SCOPE_NAMES","GLOBAL","OPEN_ID","SYSTEM_CLIENT_DEFINITIONS","name","displayName","scopeNames","buildSystemClientAttributes","definition","realm","appOrigins","originPatterns","map","origin","join","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","redirectUri","postLogoutRedirectUri","SystemClientProvisioner","clientRepository","scopeRepository","clientScopeRepository","logger","ctx","ensureForRealm","client","ensureClient","ensureScopes","attributes","existing","findOneBy","isDirty","Object","keys","some","key","target","warn","findOneWithSecret","secret","secretHashed","secretEncrypted","merged","merge","save","entity","create","clientId","scopeId","clientRealmId","scopeRealmId"],"sources":["../../../../src/core/entities/client/system-clients.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_ACCOUNT_CONSOLE_NAME,\n    CLIENT_ADMIN_CONSOLE_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientScopeRepository } from '../client-scope/types.ts';\nimport type { IScopeRepository } from '../scope/types.ts';\nimport type { IClientRepository, ISystemClientProvisioner, SystemClientDefinition } from './types.ts';\n\nexport type SystemClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    scopeRepository: IScopeRepository;\n    clientScopeRepository: IClientScopeRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * The scopes every system client is granted.\n *\n * `global` lets the issued token drive the management API (parity with the\n * legacy password-grant admin login); `openid` yields the id-token.\n */\nexport const SYSTEM_CLIENT_SCOPE_NAMES: string[] = [\n    ScopeName.GLOBAL,\n    ScopeName.OPEN_ID,\n];\n\n/**\n * The public (PKCE) clients provisioned for every realm (plan 079):\n *\n * - `admin-console` — authup's own admin console (apps/client-admin-console),\n * - `account-console` — the account self-service surface (plan 080; each\n *   definition gets its own `<origin>/**` patterns from\n *   `buildSystemClientAttributes`, so an inert row adds no redirect\n *   surface).\n *\n * Downstream RPs register their own clients (per realm, or in every realm\n * via a wildcard realm provisioning entry, plan 082) — the former shared\n * `web` client was removed.\n *\n * `displayName` is seeded at CREATE only and never re-asserted by the\n * MERGE, so an admin may relabel a client without the next boot undoing it.\n */\nexport const SYSTEM_CLIENT_DEFINITIONS: SystemClientDefinition[] = [\n    {\n        name: CLIENT_ADMIN_CONSOLE_NAME,\n        displayName: 'Admin Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n    {\n        name: CLIENT_ACCOUNT_CONSOLE_NAME,\n        displayName: 'Account Console',\n        scopeNames: SYSTEM_CLIENT_SCOPE_NAMES,\n    },\n];\n\n/**\n * Build the MERGE-owned attribute set for a realm's system client.\n *\n * `builtIn` makes the client auto-consent in the /authorize flow and\n * protects it from the API reserved-name guard.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch) — deliberately the shared app-origin\n * set for every definition: `redirectUri` is re-asserted on each boot, so a\n * separately-hosted surface (plan 078 \"relocatable by choice\") registers\n * its origin via TRUSTED_ORIGINS rather than editing the client row.\n *\n * The `scope` column is descriptive only. Scope authorization resolves\n * through the `auth_client_scopes` junction, which\n * `SystemClientProvisioner.ensureForRealm` fills from the definition's\n * `scopeNames`.\n *\n * `accessPolicyId` and `displayName` are deliberately NOT part of this set:\n * the MERGE must neither wipe an admin-bound access policy nor undo a\n * relabel.\n */\nexport function buildSystemClientAttributes(\n    definition: SystemClientDefinition,\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: definition.name,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: definition.scopeNames.join(' '),\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class SystemClientProvisioner implements ISystemClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected scopeRepository: IScopeRepository;\n\n    protected clientScopeRepository: IClientScopeRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: SystemClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n        this.clientScopeRepository = ctx.clientScopeRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        for (const definition of SYSTEM_CLIENT_DEFINITIONS) {\n            const client = await this.ensureClient(definition, realm);\n\n            // Always run, even when the attributes were already up to date:\n            // an instance provisioned before the junction rows existed\n            // carries a steady-state client with no scopes at all.\n            await this.ensureScopes(definition, client);\n        }\n    }\n\n    /**\n     * Upsert the client row itself.\n     *\n     * Every system client name is reserved (`CLIENT_RESERVED_NAMES`), so the\n     * row belongs to the system whatever state it is in. A non-built-in one\n     * predates the reservation and is taken over rather than left to shadow\n     * the realm's system client.\n     */\n    protected async ensureClient(\n        definition: SystemClientDefinition,\n        realm: Realm | { id: string },\n    ): Promise<Client> {\n        const attributes = buildSystemClientAttributes(definition, realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: definition.name,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per client and realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return existing;\n            }\n\n            let target = existing;\n\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Taking over the non-built-in client named '${definition.name}' in realm ${realm.id}: the name is reserved for a built-in system client.`,\n                    );\n                }\n\n                // The takeover makes the client public, so a secret it carried\n                // as a confidential client can never authenticate it again.\n                // Drop it instead of leaving the material at rest.\n                //\n                // The row has to be re-read WITH the secret for that: `secret`\n                // is a `select: false` column, so the loaded entity carries no\n                // value for it and typeorm's changed-column diff would not\n                // emit the null. Re-reading is confined to this branch, and\n                // the secret stays out of `buildSystemClientAttributes` for\n                // the same reason (an undefined-vs-null compare would read as\n                // dirty on every boot).\n                target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;\n                target.secret = null;\n                target.secretHashed = false;\n                target.secretEncrypted = false;\n            }\n\n            const merged = this.clientRepository.merge(target, attributes);\n\n            return this.clientRepository.save(merged);\n        }\n\n        const entity = this.clientRepository.create({\n            ...attributes,\n            displayName: definition.displayName,\n        });\n        return this.clientRepository.save(entity);\n    }\n\n    /**\n     * Bind the definition's scopes through `auth_client_scopes`. That\n     * junction is the only source the /authorize code-request verifier reads\n     * scopes from.\n     *\n     * Additive like the attribute MERGE above: an extra scope an admin bound\n     * by hand is left in place.\n     */\n    protected async ensureScopes(definition: SystemClientDefinition, client: Client): Promise<void> {\n        for (const name of definition.scopeNames) {\n            const scope = await this.scopeRepository.findOneBy({\n                name,\n                realmId: null,\n            });\n\n            if (!scope) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping scope '${name}' for the ${definition.name} client of realm ${client.realmId}: the scope is not provisioned.`,\n                    );\n                }\n                continue;\n            }\n\n            const existing = await this.clientScopeRepository.findOneBy({\n                clientId: client.id,\n                scopeId: scope.id,\n            });\n\n            if (existing) {\n                continue;\n            }\n\n            await this.clientScopeRepository.save(this.clientScopeRepository.create({\n                clientId: client.id,\n                clientRealmId: client.realmId,\n                scopeId: scope.id,\n                scopeRealmId: scope.realmId,\n            }));\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAkCA,MAAaK,4BAAsC,CAC/CD,UAAUE,QACVF,UAAUG,OACb;;;;;;;;;;;;;;;;GAkBD,MAAaC,4BAAsD,CAC/D;CACIC,MAAMR;CACNS,aAAa;CACbC,YAAYN;AAChB,GACA;CACII,MAAMT;CACNU,aAAa;CACbC,YAAYN;AAChB,CACH;;;;;;;;;;;;;;;;;;;;;;;;GA0BD,SAAgBO,4BACZC,YACAC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHV,MAAMI,WAAWJ;EACjBW,SAASN,MAAMO;EACfC,YAAYpB,iBAAiBqB;EAC7BC,oBAAoBrB,yBAAyBoB;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAOf,WAAWF,WAAWQ,KAAK,GAAA;EAClCU,aAAab;EACbc,uBAAuBd;CAC3B;AACJ;AAEA,IAAae,0BAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAnB;CAEAoB;CAEV,YAAYC,KAAqC;EAC7C,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKnB,aAAaqB,IAAIrB;EACtB,KAAKoB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAevB,OAA8C;EAC/D,KAAK,MAAMD,cAAcL,2BAA2B;GAChD,MAAM8B,SAAS,MAAM,KAAKC,aAAa1B,YAAYC,KAAAA;GAKnD,MAAM,KAAK0B,aAAa3B,YAAYyB,MAAAA;EACxC;CACJ;;;;;;;;IAUA,MAAgBC,aACZ1B,YACAC,OACe;EACf,MAAM2B,aAAa7B,4BAA4BC,YAAYC,OAAO,KAAKC,UAAU;EAEjF,MAAM2B,WAAW,MAAM,KAAKV,iBAAiBW,UAAU;GACnDlC,MAAMI,WAAWJ;GACjBW,SAASN,MAAMO;EACnB,CAAA;EAEA,IAAIqB,UAAU;GAOV,IAAI,CAFY,OAAQI,KAAKL,UAAAA,CAAAA,CACxBM,MAAMC,QAAQN,SAASM,SAASP,WAAWO,IAC3CJ,GACD,OAAOF;GAGX,IAAIO,SAASP;GAEb,IAAI,CAACA,SAASjB,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOe,KACR,8CAA8CrC,WAAWJ,KAAK,aAAaK,MAAMO,GAAG,qDAAqD;IAejJ4B,SAAS,MAAM,KAAKjB,iBAAiBmB,kBAAkB,EAAE9B,IAAIqB,SAASrB,GAAG,CAAA,KAAMqB;IAC/EO,OAAOG,SAAS;IAChBH,OAAOI,eAAe;IACtBJ,OAAOK,kBAAkB;GAC7B;GAEA,MAAMC,SAAS,KAAKvB,iBAAiBwB,MAAMP,QAAQR,UAAAA;GAEnD,OAAO,KAAKT,iBAAiByB,KAAKF,MAAAA;EACtC;EAEA,MAAMG,SAAS,KAAK1B,iBAAiB2B,OAAO;GACxC,GAAGlB;GACH/B,aAAaG,WAAWH;EAC5B,CAAA;EACA,OAAO,KAAKsB,iBAAiByB,KAAKC,MAAAA;CACtC;;;;;;;;IAUA,MAAgBlB,aAAa3B,YAAoCyB,QAA+B;EAC5F,KAAK,MAAM7B,QAAQI,WAAWF,YAAY;GACtC,MAAMiB,QAAQ,MAAM,KAAKK,gBAAgBU,UAAU;IAC/ClC;IACAW,SAAS;GACb,CAAA;GAEA,IAAI,CAACQ,OAAO;IACR,IAAI,KAAKO,QACL,KAAKA,OAAOe,KACR,mBAAmBzC,KAAK,YAAYI,WAAWJ,KAAK,mBAAmB6B,OAAOlB,QAAQ,gCAAgC;IAG9H;GACJ;GAOA,IAAIsB,MALmB,KAAKR,sBAAsBS,UAAU;IACxDiB,UAAUtB,OAAOjB;IACjBwC,SAASjC,MAAMP;GACnB,CAAA,GAGI;GAGJ,MAAM,KAAKa,sBAAsBuB,KAAK,KAAKvB,sBAAsByB,OAAO;IACpEC,UAAUtB,OAAOjB;IACjByC,eAAexB,OAAOlB;IACtByC,SAASjC,MAAMP;IACf0C,cAAcnC,MAAMR;GACxB,CAAA,CAAA;EACJ;CACJ;AACJ"}

package/dist/core/entities/client/types.d.ts

@@ -2,12 +2,25 @@ import type { Client, Realm, Role } from '@authup/core-kit';
 import type { IQuery } from '@rapiq/core';
 import type { PermissionPolicyBinding } from '@authup/access';
 import type { ActorContext, EntityRepositoryFindManyResult, IEntityRepository } from '@authup/server-kit';
+import type { IRealmProvisioner } from '../../provisioning/types.ts';
 /**
- * Ensures a realm has its system-provisioned public `web` client.
- * Used by startup provisioning (every realm) and the runtime realm-create
- * hook (a single realm). System-level — never gated on an actor.
+ * One system-provisioned public client (plan 079): `admin-console` or
+ * `account-console`. `displayName` is seeded at CREATE only; the
+ * MERGE-owned attribute set is derived per definition by
+ * `buildSystemClientAttributes`.
  */
-export interface IWebClientProvisioner {
+export type SystemClientDefinition = {
+    name: string;
+    displayName: string;
+    scopeNames: string[];
+};
+/**
+ * Ensures a realm has its system-provisioned public clients
+ * (`admin-console`, `account-console`). Used by startup provisioning
+ * (every realm) and the runtime realm-create hook (a single realm).
+ * System-level — never gated on an actor.
+ */
+export interface ISystemClientProvisioner extends IRealmProvisioner {
     ensureForRealm(realm: Realm | {
         id: string;
     }): Promise<void>;

package/dist/core/entities/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAE3G;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAClC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,iBAAiB,EAAG,MAAM,oBAAoB,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAC/D,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB,CAAC,MAAM,CAAC;IAChE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE5E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,CACF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,IAAI,CACA,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D"}

package/dist/core/entities/index.mjs

@@ -29,7 +29,7 @@ import { userAuthenticatorSchema } from "./user-authenticator/schema.mjs";
 import { userPermissionSchema } from "./user-permission/schema.mjs";
 import { userRoleSchema } from "./user-role/schema.mjs";
 import { ClientService } from "./client/service.mjs";
-import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./client/web-client.mjs";
+import { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes } from "./client/system-clients.mjs";
 import "./client/index.mjs";
 import { ClientPermissionService } from "./client-permission/service.mjs";
 import "./client-permission/index.mjs";
@@ -83,4 +83,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildEntityDiff, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };
+export { CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeService, SessionService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, buildEntityDiff, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };

package/dist/core/entities/realm/service.d.ts

@@ -2,20 +2,22 @@ import { RealmValidator } from '@authup/core-kit';
 import type { Realm } from '@authup/core-kit';
 import type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';
 import { AbstractEntityService } from '@authup/server-kit';
-import type { IWebClientProvisioner } from '../client/types.ts';
-import type { IKeyProvisioner } from '../../key/types.ts';
+import type { IRealmProvisioner } from '../../provisioning/types.ts';
 import type { IRealmRepository, IRealmService } from './types.ts';
 export type RealmServiceContext = {
     repository: IRealmRepository;
-    webClientProvisioner?: IWebClientProvisioner;
-    keyProvisioner?: IKeyProvisioner;
+    /**
+     * Applied in order on realm CREATE (system clients, keys, wildcard
+     * provisioning defaults). Never-fail: a provisioner failure is logged
+     * and swallowed.
+     */
+    realmProvisioners?: IRealmProvisioner[];
     logger?: Logger;
 };
 export declare class RealmService extends AbstractEntityService implements IRealmService {
     protected repository: IRealmRepository;
     protected validator: RealmValidator;
-    protected webClientProvisioner?: IWebClientProvisioner;
-    protected keyProvisioner?: IKeyProvisioner;
+    protected realmProvisioners?: IRealmProvisioner[];
     protected logger?: Logger;
     constructor(ctx: RealmServiceContext);
     getMany(query: Record<string, any>): Promise<EntityRepositoryFindManyResult<Realm>>;

package/dist/core/entities/realm/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAG,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;IAEpC,SAAS,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAEvD,SAAS,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAE3C,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAS9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAgGI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/realm/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAG,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC;IAEpC,SAAS,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAElD,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQ9B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC3B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAI3C,MAAM,CACR,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IASX,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;IAKX,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA8FI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,KAAK,CAAC;CAuBpB"}

package/dist/core/entities/realm/service.mjs

@@ -13,14 +13,12 @@ import { EntityNotFoundError, ValidationError } from "@authup/errors";
 var RealmService = class extends AbstractEntityService {
 	repository;
 	validator;
-	webClientProvisioner;
-	keyProvisioner;
+	realmProvisioners;
 	logger;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
-		this.webClientProvisioner = ctx.webClientProvisioner;
-		this.keyProvisioner = ctx.keyProvisioner;
+		this.realmProvisioners = ctx.realmProvisioners;
 		this.logger = ctx.logger;
 		this.validator = new RealmValidator();
 	}
@@ -81,12 +79,11 @@ var RealmService = class extends AbstractEntityService {
 		});
 		entity = this.repository.create(validated);
 		await this.repository.save(entity);
-		if (this.webClientProvisioner) try {
-			await this.webClientProvisioner.ensureForRealm(entity);
+		if (this.realmProvisioners) for (const provisioner of this.realmProvisioners) try {
+			await provisioner.ensureForRealm(entity);
 		} catch (e) {
-			if (this.logger) this.logger.warn(`Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
+			if (this.logger) this.logger.warn(`${provisioner.constructor.name} failed for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
 		}
-		if (this.keyProvisioner) await this.keyProvisioner.ensureForRealm(entity);
 		return {
 			entity,
 			created: true

package/dist/core/entities/realm/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","decodeQuery","realmSchema","RealmService","repository","validator","webClientProvisioner","keyProvisioner","logger","ctx","getMany","query","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","builtIn","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IKeyProvisioner } from '../../key/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { realmSchema } from './schema.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    keyProvisioner?: IKeyProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected keyProvisioner?: IKeyProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.keyProvisioner = ctx.keyProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(await decodeQuery(query, { schema: realmSchema }));\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        // Mint the realm's sig + enc keys eagerly (plan 071 hybrid model) —\n        // same system-level, never-fail posture as the web client above.\n        if (this.keyProvisioner) {\n            await this.keyProvisioner.ensureForRealm(entity);\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA+BA,IAAaa,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKL,aAAaK,IAAIL;EACtB,KAAKE,uBAAuBG,IAAIH;EAChC,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAClB,KAAKH,YAAY,IAAIN,eAAAA;CACzB;CAEA,MAAMW,QACFC,OAC8C;EAC9C,OAAO,KAAKP,WAAWQ,SAAS,MAAMX,YAAYU,OAAO,EAAEE,QAAQX,YAAY,CAAA,CAAA;CACnF;CAEA,MAAMY,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKZ,WAAWa,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAIjC,OAAOqB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKZ,WAAW0B,UAAUH,KAAAA;GAGzC,IAAI,CAACX,WAAWS,QAAQD,cAAcG,MAAMC,KACxC,MAAM,IAAIjC,oBAAAA;EAElB,OAAO,IAAI8B,QAAQD,YACf,MAAM,IAAI7B,oBAAAA;EAGd,IAAIqB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAeoC,aAAa,CAAA;GAChFP,QAAQlC,eAAe0C;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAesC,aAAa,CAAA;GAChFT,QAAQlC,eAAe4C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKhC,UAAUiC,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKtB,WAAWmC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAMhC,eAAeoC;IACrBd,MAAM5B,iBAAiB,GAClBD,kBAAkBmD,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS/B,qBAAqBL,cAAc4C,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAIjC,gBAAgB,mBAAmBE,kBAAkB,qBAAqB;GAGxFkB,SAAS,KAAKZ,WAAWsC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAKjC,WAAWiB,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAMhC,eAAesC;GACrBhB,MAAM5B,iBAAiB,GAAGD,kBAAkBmD,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKZ,WAAWc,OAAOmB,SAAAA;EAChC,MAAM,KAAKjC,WAAWiB,KAAKL,MAAAA;EAQ3B,IAAI,KAAKV,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBsC,eAAe5B,MAAAA;EACnD,SAAS6B,GAAG;GACR,IAAI,KAAKrC,QACL,KAAKA,OAAOsC,KACR,4CAA4C9B,OAAOY,GAAG,IAAIiB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAKJ,IAAI,KAAKtC,gBACL,MAAM,KAAKA,eAAeqC,eAAe5B,MAAAA;EAG7C,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFtB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAesD,aAAa,CAAA;EAEhF,MAAMnC,SAAS,MAAM,KAAKZ,WAAW0B,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIrB,oBAAAA;EAGd,IAAIqB,OAAOoC,SACP,MAAM,IAAIxD,gBAAgB,sCAAA;EAG9B,MAAMwB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAMhC,eAAesD;GACrBhC,MAAM5B,iBAAiB,GAAGD,kBAAkBmD,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAIyB,aAAarC;EACzB,MAAM,KAAKZ,WAAWkD,OAAOtC,MAAAA;EAC7BA,OAAOY,KAAKyB;EAEZ,OAAOrC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","decodeQuery","realmSchema","RealmService","repository","validator","realmProvisioners","logger","ctx","getMany","query","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","provisioner","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","builtIn","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRealmProvisioner } from '../../provisioning/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { realmSchema } from './schema.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    /**\n     * Applied in order on realm CREATE (system clients, keys, wildcard\n     * provisioning defaults). Never-fail: a provisioner failure is logged\n     * and swallowed.\n     */\n    realmProvisioners?: IRealmProvisioner[];\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected realmProvisioners?: IRealmProvisioner[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmProvisioners = ctx.realmProvisioners;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(await decodeQuery(query, { schema: realmSchema }));\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's baseline (system clients, sig + enc keys,\n        // wildcard provisioning defaults) via the system-level realm\n        // provisioners (NOT the entity services) — they must not be gated\n        // on the actor's permissions, since a realm creator may lack e.g.\n        // CLIENT_CREATE. Realm creation must stay atomic from the caller's\n        // perspective: the realm is already persisted, so a provisioner\n        // failure is logged and swallowed (startup provisioning reconciles\n        // every realm on the next boot).\n        if (this.realmProvisioners) {\n            for (const provisioner of this.realmProvisioners) {\n                try {\n                    await provisioner.ensureForRealm(entity);\n                } catch (e) {\n                    if (this.logger) {\n                        this.logger.warn(\n                            `${provisioner.constructor.name} failed for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                        );\n                    }\n                }\n            }\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAkCA,IAAaa,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKE,oBAAoBE,IAAIF;EAC7B,KAAKC,SAASC,IAAID;EAClB,KAAKF,YAAY,IAAIN,eAAAA;CACzB;CAEA,MAAMU,QACFC,OAC8C;EAC9C,OAAO,KAAKN,WAAWO,SAAS,MAAMV,YAAYS,OAAO,EAAEE,QAAQV,YAAY,CAAA,CAAA;CACnF;CAEA,MAAMW,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKX,WAAWY,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,OAAOoB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAIhC,OAAOoB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKX,WAAWyB,UAAUH,KAAAA;GAGzC,IAAI,CAACX,WAAWS,QAAQD,cAAcG,MAAMC,KACxC,MAAM,IAAIhC,oBAAAA;EAElB,OAAO,IAAI6B,QAAQD,YACf,MAAM,IAAI5B,oBAAAA;EAGd,IAAIoB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAemC,aAAa,CAAA;GAChFP,QAAQjC,eAAeyC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAeqC,aAAa,CAAA;GAChFT,QAAQjC,eAAe2C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKrB,WAAWkC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM/B,eAAemC;IACrBd,MAAM3B,iBAAiB,GAClBD,kBAAkBkD,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS9B,qBAAqBL,cAAc2C,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAIhC,gBAAgB,mBAAmBE,kBAAkB,qBAAqB;GAGxFiB,SAAS,KAAKX,WAAWqC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM/B,eAAeqC;GACrBhB,MAAM3B,iBAAiB,GAAGD,kBAAkBkD,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKX,WAAWa,OAAOmB,SAAAA;EAChC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;EAU3B,IAAI,KAAKT,mBACL,KAAK,MAAMqC,eAAe,KAAKrC,mBAC3B,IAAI;GACA,MAAMqC,YAAYC,eAAe7B,MAAAA;EACrC,SAAS8B,GAAG;GACR,IAAI,KAAKtC,QACL,KAAKA,OAAOuC,KACR,GAAGH,YAAY,YAAYf,KAAK,oBAAoBb,OAAOY,GAAG,IAAIkB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAG1H;EAIR,OAAO;GACH9B;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMQ,OACFvB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAesD,aAAa,CAAA;EAEhF,MAAMpC,SAAS,MAAM,KAAKX,WAAWyB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIpB,oBAAAA;EAGd,IAAIoB,OAAOqC,SACP,MAAM,IAAIxD,gBAAgB,sCAAA;EAG9B,MAAMuB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM/B,eAAesD;GACrBjC,MAAM3B,iBAAiB,GAAGD,kBAAkBkD,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAI0B,aAAatC;EACzB,MAAM,KAAKX,WAAWkD,OAAOvC,MAAAA;EAC7BA,OAAOY,KAAK0B;EAEZ,OAAOtC;CACX;AACJ"}