@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/app/modules/database/repositories/identity-provider-account/repository.mjs

@@ -0,0 +1,69 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isDatabaseTypeRowLockable } from "../../../../../adapters/database/helpers/is-supported.mjs";
+import "../../../../../adapters/database/helpers/index.mjs";
+import { IdentityProviderAccountEntity } from "../../../../../adapters/database/domains/identity-provider-account/entity.mjs";
+import "../../../../../adapters/database/domains/index.mjs";
+import { applyQuery, redactFieldConditions } from "../query.mjs";
+//#region src/app/modules/database/repositories/identity-provider-account/repository.ts
+var IdentityProviderAccountRepositoryAdapter = class {
+	dataSource;
+	repository;
+	constructor(dataSource) {
+		this.dataSource = dataSource;
+		this.repository = dataSource.getRepository(IdentityProviderAccountEntity);
+	}
+	async findMany(query, options = {}) {
+		const qb = this.repository.createQueryBuilder("identityProviderAccount");
+		const { pagination } = applyQuery(qb, query);
+		const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));
+		const selections = ["userId", "userRealmId"].map((column) => `identityProviderAccount.${column}`).filter((selection) => !existing.has(selection));
+		if (selections.length > 0) qb.addSelect(selections);
+		if (options.userId) qb.andWhere("identityProviderAccount.userId = :ownerUserId", { ownerUserId: options.userId });
+		if (options.realmId) qb.andWhere("identityProviderAccount.userRealmId = :ownerRealmId", { ownerRealmId: options.realmId });
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: redactFieldConditions(query, entities),
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneById(id) {
+		return this.repository.findOneBy({ id });
+	}
+	async removeGuarded(entity, userHasOtherLogin) {
+		if (!isDatabaseTypeRowLockable(this.dataSource.options.type)) {
+			if (await this.repository.countBy({ userId: entity.userId }) <= 1 && !userHasOtherLogin) return false;
+			await this.repository.remove(entity);
+			return true;
+		}
+		return this.dataSource.transaction(async (manager) => {
+			const repository = manager.getRepository(IdentityProviderAccountEntity);
+			if ((await repository.createQueryBuilder("identityProviderAccount").select(["identityProviderAccount.id"]).where("identityProviderAccount.userId = :userId", { userId: entity.userId }).setLock("pessimistic_write").getMany()).length <= 1 && !userHasOtherLogin) return false;
+			await repository.remove(entity);
+			return true;
+		});
+	}
+	async findOneByProviderIdentity(identity) {
+		return this.repository.findOne({
+			where: {
+				providerUserId: identity.id,
+				providerId: identity.provider.id
+			},
+			relations: { user: true }
+		});
+	}
+	async save(entity) {
+		return this.repository.save(entity);
+	}
+	async remove(entity) {
+		await this.repository.remove(entity);
+	}
+};
+//#endregion
+export { IdentityProviderAccountRepositoryAdapter };
+
+//# sourceMappingURL=repository.mjs.map

package/dist/app/modules/database/repositories/identity-provider-account/repository.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.mjs","names":["applyQuery","redactFieldConditions","IdentityProviderAccountEntity","isDatabaseTypeRowLockable","IdentityProviderAccountRepositoryAdapter","dataSource","repository","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","existing","Set","expressionMap","selects","map","select","selection","selections","column","filter","has","length","addSelect","userId","andWhere","ownerUserId","realmId","ownerRealmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","removeGuarded","entity","userHasOtherLogin","type","count","countBy","remove","transaction","manager","rows","where","setLock","getMany","findOneByProviderIdentity","identity","findOne","providerUserId","providerId","provider","relations","user","save"],"sources":["../../../../../../src/app/modules/database/repositories/identity-provider-account/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type {\n    DataSource, \n    DeepPartial, \n    Repository,\n} from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { IdentityProviderAccountEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isDatabaseTypeRowLockable } from '../../../../../adapters/database/helpers/index.ts';\nimport type {\n    IIdentityProviderAccountRepository,\n    IdentityProviderAccountFindManyOptions,\n    IdentityProviderIdentity,\n} from '../../../../../core/index.ts';\n\nexport class IdentityProviderAccountRepositoryAdapter implements IIdentityProviderAccountRepository {\n    protected dataSource: DataSource;\n\n    protected repository: Repository<IdentityProviderAccountEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.repository = dataSource.getRepository(IdentityProviderAccountEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: IdentityProviderAccountFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>> {\n        const qb = this.repository.createQueryBuilder('identityProviderAccount');\n\n        const { pagination } = applyQuery(qb, query);\n\n        // plan-039 force-select: the per-row gate reads userId (ownership)\n        // and userRealmId (realm reach). The shared applyRealmScopeSelect\n        // pins a `realmId` column this entity does not have, so dedupe and\n        // add the two columns the same way it would.\n        const existing = new Set(qb.expressionMap.selects.map((select) => select.selection));\n        const selections = ['userId', 'userRealmId']\n            .map((column) => `identityProviderAccount.${column}`)\n            .filter((selection) => !existing.has(selection));\n        if (selections.length > 0) {\n            qb.addSelect(selections);\n        }\n\n        if (options.userId) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userId = :ownerUserId', { ownerUserId: options.userId });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/identity-provider-accounts` mount —\n            // mandatory constraint, not overridable by a rapiq filter\n            qb.andWhere('identityProviderAccount.userRealmId = :ownerRealmId', { ownerRealmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean> {\n        if (!isDatabaseTypeRowLockable(this.dataSource.options.type)) {\n            // better-sqlite3: a single synchronous writer, so the\n            // count/delete race cannot manifest and no transaction is\n            // needed. Deliberately NOT wrapped in one — a held write\n            // transaction would contend the database lock (single-file\n            // driver) without buying any atomicity here. Plain\n            // count-then-remove, exactly as the un-guarded path did.\n            const count = await this.repository.countBy({ userId: entity.userId });\n            if (count <= 1 && !userHasOtherLogin) {\n                return false;\n            }\n\n            await this.repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        }\n\n        // mysql / postgres: real concurrency. Lock the user's account rows,\n        // count, and delete in one transaction so two concurrent unlinks for\n        // the same user cannot both read > 1 and both delete.\n        return this.dataSource.transaction(async (manager) => {\n            const repository = manager.getRepository(IdentityProviderAccountEntity);\n\n            const rows = await repository.createQueryBuilder('identityProviderAccount')\n                .select(['identityProviderAccount.id'])\n                .where('identityProviderAccount.userId = :userId', { userId: entity.userId })\n                .setLock('pessimistic_write')\n                .getMany();\n\n            if (rows.length <= 1 && !userHasOtherLogin) {\n                return false;\n            }\n\n            await repository.remove(entity as IdentityProviderAccountEntity);\n            return true;\n        });\n    }\n\n    async findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null> {\n        return this.repository.findOne({\n            where: {\n                providerUserId: identity.id,\n                providerId: identity.provider.id,\n            },\n            relations: { user: true },\n        });\n    }\n\n    async save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount> {\n        return this.repository.save(entity);\n    }\n\n    async remove(entity: IdentityProviderAccount): Promise<void> {\n        await this.repository.remove(entity as IdentityProviderAccountEntity);\n    }\n}\n"],"mappings":";;;;;;;;;AAwBA,IAAaI,2CAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,YAAwB;EAChC,KAAKA,aAAaA;EAClB,KAAKC,aAAaD,WAAWE,cAAcL,6BAAAA;CAC/C;CAEA,MAAMM,SACFC,OACAC,UAAkD,CAAC,GACa;EAChE,MAAMC,KAAK,KAAKL,WAAWM,mBAAmB,yBAAA;EAE9C,MAAM,EAAEC,eAAeb,WAAWW,IAAIF,KAAAA;EAMtC,MAAMK,WAAW,IAAIC,IAAIJ,GAAGK,cAAcC,QAAQC,KAAKC,WAAWA,OAAOC,SAAS,CAAA;EAClF,MAAMC,aAAa,CAAC,UAAU,aAAc,CAAA,CACvCH,KAAKI,WAAW,2BAA2BA,QAAQ,CAAA,CACnDC,QAAQH,cAAc,CAACN,SAASU,IAAIJ,SAAAA,CAAAA;EACzC,IAAIC,WAAWI,SAAS,GACpBd,GAAGe,UAAUL,UAAAA;EAGjB,IAAIX,QAAQiB,QAERhB,GAAGiB,SAAS,iDAAiD,EAAEC,aAAanB,QAAQiB,OAAO,CAAA;EAG/F,IAAIjB,QAAQoB,SAGRnB,GAAGiB,SAAS,uDAAuD,EAAEG,cAAcrB,QAAQoB,QAAQ,CAAA;EAGvG,MAAM,CAACE,UAAUC,SAAS,MAAMtB,GAAGuB,gBAAe;EAElD,OAAO;GACHC,MAAMlC,sBAAsBQ,OAAOuB,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGpB;GACP;EACJ;CACJ;CAEA,MAAMwB,YAAYC,IAAqD;EACnE,OAAO,KAAKhC,WAAWiC,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,cAAcC,QAAiCC,mBAA8C;EAC/F,IAAI,CAACvC,0BAA0B,KAAKE,WAAWK,QAAQiC,IAAI,GAAG;GAQ1D,IAAIC,MADgB,KAAKtC,WAAWuC,QAAQ,EAAElB,QAAQc,OAAOd,OAAO,CAAA,KACvD,KAAK,CAACe,mBACf,OAAO;GAGX,MAAM,KAAKpC,WAAWwC,OAAOL,MAAAA;GAC7B,OAAO;EACX;EAKA,OAAO,KAAKpC,WAAW0C,YAAY,OAAOC,YAAAA;GACtC,MAAM1C,aAAa0C,QAAQzC,cAAcL,6BAAAA;GAQzC,KAAI+C,MANe3C,WAAWM,mBAAmB,yBAAA,CAAA,CAC5CO,OAAO,CAAC,4BAA6B,CAAA,CAAA,CACrC+B,MAAM,4CAA4C,EAAEvB,QAAQc,OAAOd,OAAO,CAAA,CAAA,CAC1EwB,QAAQ,mBAAA,CAAA,CACRC,QAAO,EAAA,CAEH3B,UAAU,KAAK,CAACiB,mBACrB,OAAO;GAGX,MAAMpC,WAAWwC,OAAOL,MAAAA;GACxB,OAAO;EACX,CAAA;CACJ;CAEA,MAAMY,0BAA0BC,UAA6E;EACzG,OAAO,KAAKhD,WAAWiD,QAAQ;GAC3BL,OAAO;IACHM,gBAAgBF,SAAShB;IACzBmB,YAAYH,SAASI,SAASpB;GAClC;GACAqB,WAAW,EAAEC,MAAM,KAAK;EAC5B,CAAA;CACJ;CAEA,MAAMC,KAAKpB,QAAgF;EACvF,OAAO,KAAKnC,WAAWuD,KAAKpB,MAAAA;CAChC;CAEA,MAAMK,OAAOL,QAAgD;EACzD,MAAM,KAAKnC,WAAWwC,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/database/repositories/index.d.ts

@@ -4,6 +4,7 @@ export * from './client-role/index.ts';
 export * from './client-scope/index.ts';
 export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './identity-provider-account/index.ts';
 export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';

package/dist/app/modules/database/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/app/modules/database/repositories/index.mjs

@@ -14,6 +14,8 @@ import { EventRepositoryAdapter } from "./event/repository.mjs";
 import "./event/index.mjs";
 import { IdentityProviderRepositoryAdapter } from "./identity-provider/repository.mjs";
 import "./identity-provider/index.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "./identity-provider-account/repository.mjs";
+import "./identity-provider-account/index.mjs";
 import { KeyRepositoryAdapter } from "./key/repository.mjs";
 import "./key/index.mjs";
 import { PermissionRepositoryAdapter } from "./permission/repository.mjs";
@@ -47,4 +49,4 @@ import { UserRoleRepositoryAdapter } from "./user-role/repository.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingRepositoryAdapter } from "./identity-provider-role-mapping/repository.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, EventRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };
+export { ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, EventRepositoryAdapter, IdentityProviderAccountRepositoryAdapter, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, ScopeRepositoryAdapter, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter };

package/dist/app/modules/database/repositories/key/repository.d.ts

@@ -24,9 +24,32 @@ export declare class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {
     protected secretsCipher: ISymmetricCipher | null;
     protected realmRepository: IRealmRepository;
     protected logger?: Logger;
+    /**
+     * In-flight mints keyed `<realmId>:<use>` — see {@link mintExclusive}.
+     */
+    protected mints: Map<string, Promise<Key>>;
     constructor(dataSource: DataSource, options?: KeyRepositoryAdapterOptions);
     protected get repository(): Repository<KeyEntity>;
+    protected findActiveKey(realmId: string, use: `${JWKUse}`): Promise<KeyEntity | null>;
     resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    /**
+     * Minting is check-then-act (read, count, insert), and the callers are
+     * hot paths — the token signer resolves a signature key for EVERY
+     * issuance, the realm cipher an encryption key for every MFA seed — so
+     * a freshly created realm routinely takes several simultaneous calls
+     * and each one would insert its own key. Concurrent mints for one
+     * (realm, use) therefore share a single in-flight promise.
+     *
+     * The map is per adapter instance, and the store is a DI singleton, so
+     * it is scoped to one application: two applications in one process
+     * (the test suite) never share mint state. Separate PROCESSES can still
+     * race, which is why the duplicate stays tolerable rather than fatal —
+     * both keys are published in JWKS and verify, and `findActiveKey`
+     * orders deterministically, so a duplicate costs a redundant row, not
+     * a broken token.
+     */
+    protected mintExclusive(realmId: string, use: `${JWKUse}`): Promise<Key>;
+    protected mint(realmId: string, use: `${JWKUse}`): Promise<Key>;
     resolveById(id: string): Promise<Key | null>;
     protected createSignatureKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;
     protected createEncryptionKey(repository: Repository<KeyEntity>, realmId: string): Promise<Key>;

package/dist/app/modules/database/repositories/key/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAGH,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,MAAM,EAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAW,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAKxE,OAAO,EAEH,SAAS,EAGZ,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAUhG,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,aAAa,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,cAAc,EAAE,SAAS;IAClE,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC;IAElC,SAAS,CAAC,aAAa,EAAG,gBAAgB,GAAG,IAAI,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;gBAEf,UAAU,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC;IAO7E,SAAS,KAAK,UAAU,IAAK,UAAU,CAAC,SAAS,CAAC,CAEjD;IAMK,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAmDhE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;cAkClC,kBAAkB,CAC9B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;cA2BA,mBAAmB,CAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;IAwBhB,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,MAAM;cAIjC,SAAS,CACrB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,MAAM,EAAE,SAAS,GACjB,OAAO,CAAC,GAAG,CAAC;cA6BA,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAYrD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAmBrE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAI5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAenE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAMxE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAI/B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAIrC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAgB/B,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGlF"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAGH,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,MAAM,EAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAW,MAAM,EAAgB,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AAKxE,OAAO,EAEH,SAAS,EAGZ,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAUhG,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,aAAa,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,cAAc,EAAE,SAAS;IAClE,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC;IAElC,SAAS,CAAC,aAAa,EAAG,gBAAgB,GAAG,IAAI,CAAC;IAElD,SAAS,CAAC,eAAe,EAAG,gBAAgB,CAAC;IAE7C,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAE3B;;OAEG;IACH,SAAS,CAAC,KAAK,EAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAa;gBAE5C,UAAU,EAAE,UAAU,EAAE,OAAO,GAAE,2BAAgC;IAO7E,SAAS,KAAK,UAAU,IAAK,UAAU,CAAC,SAAS,CAAC,CAEjD;IAMD,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IA6BhF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAStE;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC;cAgBzD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,OAAO,CAAC,GAAG,CAAC;IA4BhE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;cAkClC,kBAAkB,CAC9B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;cA2BA,mBAAmB,CAC/B,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,OAAO,EAAE,MAAM,GACf,OAAO,CAAC,GAAG,CAAC;IAwBhB,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,GAAI,MAAM;cAIjC,SAAS,CACrB,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EACjC,MAAM,EAAE,SAAS,GACjB,OAAO,CAAC,GAAG,CAAC;cA6BA,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAYrD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;IAmBrE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAI5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAenE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAMxE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAItD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAIhE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAI/B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG;IAIrC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAgB/B,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGlF"}

package/dist/app/modules/database/repositories/key/repository.mjs

@@ -31,6 +31,9 @@ import { validateEntityJoinColumns } from "typeorm-extension";
 	secretsCipher;
 	realmRepository;
 	logger;
+	/**
+	* In-flight mints keyed `<realmId>:<use>` — see {@link mintExclusive}.
+	*/ mints = /* @__PURE__ */ new Map();
 	constructor(dataSource, options = {}) {
 		this.dataSource = dataSource;
 		this.secretsCipher = options.secretsCipher ?? null;
@@ -40,9 +43,8 @@ import { validateEntityJoinColumns } from "typeorm-extension";
 	get repository() {
 		return this.dataSource.getRepository(KeyEntity);
 	}
-	async resolveOrCreate(realmId, use) {
-		const { repository } = this;
-		const entity = await repository.findOne({
+	findActiveKey(realmId, use) {
+		return this.repository.findOne({
 			select: {
 				id: true,
 				name: true,
@@ -65,6 +67,40 @@ import { validateEntityJoinColumns } from "typeorm-extension";
 				id: "ASC"
 			}
 		});
+	}
+	async resolveOrCreate(realmId, use) {
+		const entity = await this.findActiveKey(realmId, use);
+		if (entity) return this.afterLoad(this.repository, entity);
+		return this.mintExclusive(realmId, use);
+	}
+	/**
+	* Minting is check-then-act (read, count, insert), and the callers are
+	* hot paths — the token signer resolves a signature key for EVERY
+	* issuance, the realm cipher an encryption key for every MFA seed — so
+	* a freshly created realm routinely takes several simultaneous calls
+	* and each one would insert its own key. Concurrent mints for one
+	* (realm, use) therefore share a single in-flight promise.
+	*
+	* The map is per adapter instance, and the store is a DI singleton, so
+	* it is scoped to one application: two applications in one process
+	* (the test suite) never share mint state. Separate PROCESSES can still
+	* race, which is why the duplicate stays tolerable rather than fatal —
+	* both keys are published in JWKS and verify, and `findActiveKey`
+	* orders deterministically, so a duplicate costs a redundant row, not
+	* a broken token.
+	*/ mintExclusive(realmId, use) {
+		const cacheKey = `${realmId}:${use}`;
+		const inFlight = this.mints.get(cacheKey);
+		if (inFlight) return inFlight;
+		const promise = this.mint(realmId, use);
+		this.mints.set(cacheKey, promise);
+		return promise.finally(() => {
+			this.mints.delete(cacheKey);
+		});
+	}
+	async mint(realmId, use) {
+		const { repository } = this;
+		const entity = await this.findActiveKey(realmId, use);
 		if (entity) return this.afterLoad(repository, entity);
 		const total = await repository.countBy({
 			realmId,

package/dist/app/modules/database/repositories/key/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","validateEntityJoinColumns","applyQuery","redactFieldConditions","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","options","getRepository","repository","resolveOrCreate","realmId","use","entity","findOne","select","id","name","type","status","signatureAlgorithm","encryptionKey","decryptionKey","where","ACTIVE","order","priority","createdAt","afterLoad","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus  } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n    AsymmetricKey,\n    CryptoAsymmetricAlgorithm,\n    type EntityRepositoryFindManyResult,\n    type ISymmetricCipher,\n    type Logger,\n    createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { getRandomValues } from 'uncrypto';\nimport {\n    DatabaseConflictError,\n    KeyEntity,\n    RealmEntity,\n    UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n    REALM_CIPHER_BLOB_VERSION,\n    isWrappedKeyMaterial,\n    unwrapKeyMaterial,\n    wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n    /**\n     * Optional KEK (config secretsEncryptionKey) — when present, key\n     * material is persisted wrapped and unwrapped transparently on read.\n     */\n    secretsCipher?: ISymmetricCipher | null,\n    logger?: Logger,\n};\n\n/**\n * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryptionKey; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n    protected dataSource : DataSource;\n\n    protected secretsCipher : ISymmetricCipher | null;\n\n    protected realmRepository : IRealmRepository;\n\n    protected logger? : Logger;\n\n    constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n        this.dataSource = dataSource;\n        this.secretsCipher = options.secretsCipher ?? null;\n        this.logger = options.logger;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository() : Repository<KeyEntity> {\n        return this.dataSource.getRepository(KeyEntity);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyStore — material resolution (signer / verifier / realm cipher)\n    // ------------------------------------------------------------------\n\n    async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n        const { repository } = this;\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: {\n                realmId,\n                use,\n                status: KeyStatus.ACTIVE,\n            },\n            // createdAt + id break priority ties deterministically (e.g.\n            // duplicate mints from a concurrent zero-row backstop race —\n            // benign, both keys verify, but selection must be stable).\n            order: {\n                priority: 'DESC', \n                createdAt: 'DESC', \n                id: 'ASC', \n            },\n        });\n\n        if (entity) {\n            return this.afterLoad(repository, entity);\n        }\n\n        const total = await repository.countBy({ realmId, use });\n        if (total > 0) {\n            // an admin who disabled every key meant it — do not silently\n            // re-mint around the kill switch.\n            throw new AuthupError(\n                `No active ${use} key is available for realm ${realmId} ` +\n                `(${total} key(s) exist, none active).`,\n            );\n        }\n\n        if (use === JWKUse.ENCRYPTION) {\n            return this.createEncryptionKey(repository, realmId);\n        }\n\n        return this.createSignatureKey(repository, realmId);\n    }\n\n    async resolveById(id: string): Promise<Key | null> {\n        const { repository } = this;\n\n        // `id` reaches here from an attacker-controlled JWT `kid` header on the\n        // token-verification hot path. A non-UUID value binds against a\n        // postgres `uuid` column as a driver-level type error (500) instead of\n        // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n        // plain verification failure.\n        if (!isUUID(id)) {\n            return null;\n        }\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: { id },\n        });\n\n        if (!entity) {\n            return null;\n        }\n\n        return this.afterLoad(repository, entity);\n    }\n\n    protected async createSignatureKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n        const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n        const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n        const material = await privateKeyContainer.toBase64();\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.SIGNATURE),\n            type: JWKType.RSA,\n            use: JWKUse.SIGNATURE,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: await publicKeyContainer.toBase64(),\n            realmId,\n            signatureAlgorithm: `${JWTAlgorithm.RS256}`,\n        });\n\n        await repository.save(entity);\n\n        // hand the caller usable material regardless of the persisted form.\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected async createEncryptionKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const raw = new Uint8Array(32);\n        getRandomValues(raw);\n\n        const material = arrayBufferToBase64(raw.buffer);\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.ENCRYPTION),\n            type: JWKType.OCT,\n            use: JWKUse.ENCRYPTION,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: null,\n            realmId,\n            signatureAlgorithm: null,\n        });\n\n        await repository.save(entity);\n\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected generateName(use: `${JWKUse}`) : string {\n        return `${use}-${createNanoID(10)}`;\n    }\n\n    protected async afterLoad(\n        repository: Repository<KeyEntity>,\n        entity: KeyEntity,\n    ) : Promise<Key> {\n        if (!entity.decryptionKey) {\n            return entity;\n        }\n\n        if (isWrappedKeyMaterial(entity.decryptionKey)) {\n            entity.decryptionKey = await unwrapKeyMaterial(this.secretsCipher, entity.decryptionKey);\n            return entity;\n        }\n\n        if (this.secretsCipher) {\n            // lazy wrap-on-read: a KEK added to a running deployment\n            // hardens existing rows without a migration step. Best-effort —\n            // the material stays readable either way.\n            const material = entity.decryptionKey;\n            try {\n                await repository.update(entity.id, { decryptionKey: await wrapKeyMaterial(this.secretsCipher, material) });\n            } catch (e) {\n                // Best-effort — the material stays readable and the next read\n                // retries. Surface it though: a persistent failure (e.g. a\n                // read-only replica) means the row is never hardened at rest.\n                this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n            }\n            entity.decryptionKey = material;\n        }\n\n        return entity;\n    }\n\n    protected async protect(material: string) : Promise<string> {\n        if (!this.secretsCipher) {\n            return material;\n        }\n\n        return wrapKeyMaterial(this.secretsCipher, material);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyRepository — entity CRUD surface (key management API)\n    // ------------------------------------------------------------------\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Key>> {\n        const qb = this.repository.createQueryBuilder('keyEntity');\n        qb.groupBy('keyEntity.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'keyEntity');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Key | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Key | null> {\n        const where : FindOptionsWhere<KeyEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realmId = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Key[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Key | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Key>): Key {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Key, data: Partial<Key>): Key {\n        return this.repository.merge(entity as KeyEntity, data);\n    }\n\n    async save(entity: Key): Promise<Key> {\n        if (\n            entity.decryptionKey &&\n            this.secretsCipher &&\n            !isWrappedKeyMaterial(entity.decryptionKey)\n        ) {\n            const material = entity.decryptionKey;\n            entity.decryptionKey = await wrapKeyMaterial(this.secretsCipher, material);\n            const saved = await this.repository.save(entity as KeyEntity);\n            saved.decryptionKey = material;\n            return saved;\n        }\n\n        return this.repository.save(entity as KeyEntity);\n    }\n\n    async remove(entity: Key): Promise<void> {\n        await this.repository.remove(entity as KeyEntity);\n    }\n\n    async validateJoinColumns(data: Partial<Key>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async countBlobReferences(keyId: string): Promise<number> {\n        return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n    }\n\n    async findHighestPriority(realmId: string, use: string): Promise<number | null> {\n        return this.repository.maximum('priority', { realmId, use: use as `${JWKUse}` });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDA,IAAa4B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYH,YAAwBI,UAAuC,CAAC,GAAG;EAC3E,KAAKJ,aAAaA;EAClB,KAAKC,gBAAgBG,QAAQH,iBAAiB;EAC9C,KAAKE,SAASC,QAAQD;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWK,cAAchB,WAAAA,CAAAA;CAC/E;CAEA,IAAciB,aAAqC;EAC/C,OAAO,KAAKN,WAAWK,cAAcjB,SAAAA;CACzC;CAMA,MAAMmB,gBAAgBC,SAAiBC,KAAgC;EACnE,MAAM,EAAEH,eAAe;EAEvB,MAAMI,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO;IACHZ;IACAC;IACAO,QAAQ5C,UAAUiD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,WAAW;IACXX,IAAI;GACR;EACJ,CAAA;EAEA,IAAIH,QACA,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;EAGtC,MAAMgB,QAAQ,MAAMpB,WAAWqB,QAAQ;GAAEnB;GAASC;EAAI,CAAA;EACtD,IAAIiB,QAAQ,GAGR,MAAM,IAAIvD,YACN,aAAasC,IAAI,8BAA8BD,QAAQ,IACnDkB,MAAM,6BAA6B;EAI/C,IAAIjB,QAAQ7B,OAAOgD,YACf,OAAO,KAAKC,oBAAoBvB,YAAYE,OAAAA;EAGhD,OAAO,KAAKsB,mBAAmBxB,YAAYE,OAAAA;CAC/C;CAEA,MAAMuB,YAAYlB,IAAiC;EAC/C,MAAM,EAAEP,eAAe;EAOvB,IAAI,CAAC/B,OAAOsC,EAAAA,GACR,OAAO;EAGX,MAAMH,SAAS,MAAMJ,WAAWK,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNN,KAAK;IACLO,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfX,SAAS;GACb;GACAY,OAAO,EAAEP,GAAG;EAChB,CAAA;EAEA,IAAI,CAACH,QACD,OAAO;EAGX,OAAO,KAAKe,UAAUnB,YAAYI,MAAAA;CACtC;CAEA,MAAgBoB,mBACZxB,YACAE,SACa;EACb,MAAMwB,UAAU,MAAMtD,wBAAwB,EAAEoC,MAAMrC,0BAA0BwD,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAI1D,cAAcwD,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAI5D,cAAcwD,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAM7B,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa7D,OAAO8D,SAAS;GACxC3B,MAAMpC,QAAQgE;GACdlC,KAAK7B,OAAO8D;GACZ1B,QAAQ5C,UAAUiD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe,MAAMkB,mBAAmBG,SAAQ;GAChD/B;GACAS,oBAAoB,GAAGpC,aAAagE;EACxC,CAAA;EAEA,MAAMvC,WAAWwC,KAAKpC,MAAAA;EAGtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEA,MAAgBmB,oBACZvB,YACAE,SACa;EACb,MAAMuC,sBAAM,IAAIC,WAAW,EAAA;EAC3B9D,gBAAgB6D,GAAAA;EAEhB,MAAMT,WAAWjE,oBAAoB0E,IAAIE,MAAM;EAE/C,MAAMvC,SAASJ,WAAWkC,OAAO;GAC7B1B,MAAM,KAAK2B,aAAa7D,OAAOgD,UAAU;GACzCb,MAAMpC,QAAQuE;GACdzC,KAAK7B,OAAOgD;GACZZ,QAAQ5C,UAAUiD;GAClBF,eAAe,MAAM,KAAKyB,QAAQN,QAAAA;GAClCpB,eAAe;GACfV;GACAS,oBAAoB;EACxB,CAAA;EAEA,MAAMX,WAAWwC,KAAKpC,MAAAA;EAEtBA,OAAOS,gBAAgBmB;EAEvB,OAAO5B;CACX;CAEU+B,aAAahC,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGnC,aAAa,EAAA;CAClC;CAEA,MAAgBmD,UACZnB,YACAI,QACa;EACb,IAAI,CAACA,OAAOS,eACR,OAAOT;EAGX,IAAIlB,qBAAqBkB,OAAOS,aAAa,GAAG;GAC5CT,OAAOS,gBAAgB,MAAM1B,kBAAkB,KAAKQ,eAAeS,OAAOS,aAAa;GACvF,OAAOT;EACX;EAEA,IAAI,KAAKT,eAAe;GAIpB,MAAMqC,WAAW5B,OAAOS;GACxB,IAAI;IACA,MAAMb,WAAW6C,OAAOzC,OAAOG,IAAI,EAAEM,eAAe,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA,EAAU,CAAA;GAC5G,SAASc,GAAG;IAIR,KAAKjD,QAAQkD,KAAK,+CAA+C3C,OAAOG,GAAG,IAAI,EAAEyC,OAAOF,EAAE,CAAA;GAC9F;GACA1C,OAAOS,gBAAgBmB;EAC3B;EAEA,OAAO5B;CACX;CAEA,MAAgBkC,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKrC,eACN,OAAOqC;EAGX,OAAO5C,gBAAgB,KAAKO,eAAeqC,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA6D;EACxE,MAAMC,KAAK,KAAKnD,WAAWoD,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAe5E,WAAWyE,IAAID,KAAAA;EAEtC7D,sBAAsB8D,IAAI,WAAA;EAE1B,MAAM,CAACI,UAAUnC,SAAS,MAAM+B,GAAGK,gBAAe;EAElD,OAAO;GACHC,MAAM9E,sBAAsBuE,OAAOK,QAAAA;GACnCG,MAAM;IACFtC;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMK,YAAYpD,IAAiC;EAC/C,OAAO,KAAKqD,UAAU,EAAErD,GAAG,CAAA;CAC/B;CAEA,MAAMsD,cAAcrD,MAAcsD,UAAwC;EACtE,MAAMhD,QAAsC,EAAEN,KAAK;EAEnD,IAAIsD,UAAU;GACV,MAAM5D,UAAU,MAAM,KAAKN,gBAAgBmE,UAAUD,QAAAA;GACrD,IAAI,CAAC5D,SACD,OAAO;GAGXY,MAAMZ,UAAUA;EACpB;EAEA,OAAO,KAAKF,WAAW4D,UAAU9C,KAAAA;CACrC;CAEA,MAAMkD,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAOjG,OAAOgG,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWrD,OAA4C;EACzD,OAAO,KAAKd,WAAWoE,OAAO7E,yBAAyBuB,KAAAA,CAAAA;CAC3D;CAEA,MAAM8C,UAAU9C,OAAiD;EAC7D,OAAO,KAAKd,WAAW4D,UAAUrE,yBAAyBuB,KAAAA,CAAAA;CAC9D;CAEAoB,OAAOuB,MAAyB;EAC5B,OAAO,KAAKzD,WAAWkC,OAAOuB,IAAAA;CAClC;CAEAY,MAAMjE,QAAaqD,MAAyB;EACxC,OAAO,KAAKzD,WAAWqE,MAAMjE,QAAqBqD,IAAAA;CACtD;CAEA,MAAMjB,KAAKpC,QAA2B;EAClC,IACIA,OAAOS,iBACP,KAAKlB,iBACL,CAACT,qBAAqBkB,OAAOS,aAAa,GAC5C;GACE,MAAMmB,WAAW5B,OAAOS;GACxBT,OAAOS,gBAAgB,MAAMzB,gBAAgB,KAAKO,eAAeqC,QAAAA;GACjE,MAAMsC,QAAQ,MAAM,KAAKtE,WAAWwC,KAAKpC,MAAAA;GACzCkE,MAAMzD,gBAAgBmB;GACtB,OAAOsC;EACX;EAEA,OAAO,KAAKtE,WAAWwC,KAAKpC,MAAAA;CAChC;CAEA,MAAMmE,OAAOnE,QAA4B;EACrC,MAAM,KAAKJ,WAAWuE,OAAOnE,MAAAA;CACjC;CAEA,MAAMoE,oBAAoBf,MAAmC;EACzD,MAAMhF,0BAA0BgF,MAAM;GAClC/D,YAAY,KAAKA;GACjB+E,cAAc3F;EAClB,CAAA;CACJ;CAEA,MAAM4F,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBtF,eAAe;GAClCI,YAAY,KAAKA;GACjB+E,cAAc3F;GACdsB,QAAQqD;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI9F,sBAAAA;CAElB;CAEA,MAAMiG,oBAAoBC,OAAgC;EACtD,OAAO,KAAKrF,WAAWK,cAAcf,uBAAAA,CAAAA,CAAyBqC,QAAQ,EAAE2D,QAAQxG,KAAK,MAAgCuG,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoB/E,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAWkF,QAAQ,YAAY;GAAEhF;GAAcC;EAAmB,CAAA;CAClF;AACJ"}
+{"version":3,"file":"repository.mjs","names":["AuthupError","KeyStatus","arrayBufferToBase64","createNanoID","isUUID","AsymmetricKey","CryptoAsymmetricAlgorithm","createAsymmetricKeyPair","JWKType","JWKUse","JWTAlgorithm","Like","validateEntityJoinColumns","applyQuery","redactFieldConditions","getRandomValues","DatabaseConflictError","KeyEntity","RealmEntity","UserAuthenticatorEntity","REALM_CIPHER_BLOB_VERSION","isWrappedKeyMaterial","unwrapKeyMaterial","wrapKeyMaterial","applyRealmScopeSelect","isEntityUnique","translateWhereConditions","RealmRepositoryAdapter","KeyRepositoryAdapter","dataSource","secretsCipher","realmRepository","logger","mints","Map","options","getRepository","repository","findActiveKey","realmId","use","findOne","select","id","name","type","status","signatureAlgorithm","encryptionKey","decryptionKey","where","ACTIVE","order","priority","createdAt","resolveOrCreate","entity","afterLoad","mintExclusive","cacheKey","inFlight","get","promise","mint","set","finally","delete","total","countBy","ENCRYPTION","createEncryptionKey","createSignatureKey","resolveById","keyPair","RSASSA_PKCS1_V1_5","privateKeyContainer","privateKey","publicKeyContainer","publicKey","material","toBase64","create","generateName","SIGNATURE","RSA","protect","RS256","save","raw","Uint8Array","buffer","OCT","update","e","warn","error","findMany","query","qb","createQueryBuilder","groupBy","pagination","entities","getManyAndCount","data","meta","findOneById","findOneBy","findOneByName","realmKey","resolveId","findOneByIdOrName","idOrName","realm","findManyBy","findBy","merge","saved","remove","validateJoinColumns","entityTarget","checkUniqueness","existing","isUnique","entityExisting","countBlobReferences","keyId","secret","findHighestPriority","maximum"],"sources":["../../../../../../src/app/modules/database/repositories/key/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport type { IQuery } from '@rapiq/core';\nimport type { Key } from '@authup/core-kit';\nimport { KeyStatus  } from '@authup/core-kit';\nimport { arrayBufferToBase64, createNanoID, isUUID } from '@authup/kit';\nimport {\n    AsymmetricKey,\n    CryptoAsymmetricAlgorithm,\n    type EntityRepositoryFindManyResult,\n    type ISymmetricCipher,\n    type Logger,\n    createAsymmetricKeyPair,\n} from '@authup/server-kit';\nimport { JWKType, JWKUse, JWTAlgorithm } from '@authup/specs';\nimport type { DataSource, FindOptionsWhere, Repository } from 'typeorm';\nimport { Like } from 'typeorm';\nimport { validateEntityJoinColumns } from 'typeorm-extension';\nimport { applyQuery, redactFieldConditions } from '../query.ts';\nimport { getRandomValues } from 'uncrypto';\nimport {\n    DatabaseConflictError,\n    KeyEntity,\n    RealmEntity,\n    UserAuthenticatorEntity,\n} from '../../../../../adapters/database/index.ts';\nimport type { IKeyRepository, IKeyStore, IRealmRepository } from '../../../../../core/index.ts';\nimport {\n    REALM_CIPHER_BLOB_VERSION,\n    isWrappedKeyMaterial,\n    unwrapKeyMaterial,\n    wrapKeyMaterial,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect, isEntityUnique, translateWhereConditions } from '../helpers.ts';\nimport { RealmRepositoryAdapter } from '../realm/repository.ts';\n\nexport type KeyRepositoryAdapterOptions = {\n    /**\n     * Optional KEK (config secretsEncryptionKey) — when present, key\n     * material is persisted wrapped and unwrapped transparently on read.\n     */\n    secretsCipher?: ISymmetricCipher | null,\n    logger?: Logger,\n};\n\n/**\n * One adapter, two ports: the entity CRUD surface (IKeyRepository) for the\n * key management API and the material-resolving store (IKeyStore) for the\n * signer / verifier / realm cipher. Entity reads never select\n * decryptionKey; only the IKeyStore surface hands out (unwrapped) material.\n */\nexport class KeyRepositoryAdapter implements IKeyRepository, IKeyStore {\n    protected dataSource : DataSource;\n\n    protected secretsCipher : ISymmetricCipher | null;\n\n    protected realmRepository : IRealmRepository;\n\n    protected logger? : Logger;\n\n    /**\n     * In-flight mints keyed `<realmId>:<use>` — see {@link mintExclusive}.\n     */\n    protected mints : Map<string, Promise<Key>> = new Map();\n\n    constructor(dataSource: DataSource, options: KeyRepositoryAdapterOptions = {}) {\n        this.dataSource = dataSource;\n        this.secretsCipher = options.secretsCipher ?? null;\n        this.logger = options.logger;\n        this.realmRepository = new RealmRepositoryAdapter(dataSource.getRepository(RealmEntity));\n    }\n\n    protected get repository() : Repository<KeyEntity> {\n        return this.dataSource.getRepository(KeyEntity);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyStore — material resolution (signer / verifier / realm cipher)\n    // ------------------------------------------------------------------\n\n    protected findActiveKey(realmId: string, use: `${JWKUse}`) : Promise<KeyEntity | null> {\n        return this.repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: {\n                realmId,\n                use,\n                status: KeyStatus.ACTIVE,\n            },\n            // createdAt + id break priority ties deterministically, so key\n            // selection stays stable whenever a realm holds several active\n            // keys (a rotation in progress, or a cross-process mint race).\n            order: {\n                priority: 'DESC',\n                createdAt: 'DESC',\n                id: 'ASC',\n            },\n        });\n    }\n\n    async resolveOrCreate(realmId: string, use: `${JWKUse}`): Promise<Key> {\n        const entity = await this.findActiveKey(realmId, use);\n        if (entity) {\n            return this.afterLoad(this.repository, entity);\n        }\n\n        return this.mintExclusive(realmId, use);\n    }\n\n    /**\n     * Minting is check-then-act (read, count, insert), and the callers are\n     * hot paths — the token signer resolves a signature key for EVERY\n     * issuance, the realm cipher an encryption key for every MFA seed — so\n     * a freshly created realm routinely takes several simultaneous calls\n     * and each one would insert its own key. Concurrent mints for one\n     * (realm, use) therefore share a single in-flight promise.\n     *\n     * The map is per adapter instance, and the store is a DI singleton, so\n     * it is scoped to one application: two applications in one process\n     * (the test suite) never share mint state. Separate PROCESSES can still\n     * race, which is why the duplicate stays tolerable rather than fatal —\n     * both keys are published in JWKS and verify, and `findActiveKey`\n     * orders deterministically, so a duplicate costs a redundant row, not\n     * a broken token.\n     */\n    protected mintExclusive(realmId: string, use: `${JWKUse}`) : Promise<Key> {\n        const cacheKey = `${realmId}:${use}`;\n\n        const inFlight = this.mints.get(cacheKey);\n        if (inFlight) {\n            return inFlight;\n        }\n\n        const promise = this.mint(realmId, use);\n        this.mints.set(cacheKey, promise);\n\n        return promise.finally(() => {\n            this.mints.delete(cacheKey);\n        });\n    }\n\n    protected async mint(realmId: string, use: `${JWKUse}`) : Promise<Key> {\n        const { repository } = this;\n\n        // Re-read under the guard: the caller's lookup may predate a mint\n        // that has since completed and left the map, so the in-flight\n        // check alone would not see it.\n        const entity = await this.findActiveKey(realmId, use);\n        if (entity) {\n            return this.afterLoad(repository, entity);\n        }\n\n        const total = await repository.countBy({ realmId, use });\n        if (total > 0) {\n            // an admin who disabled every key meant it — do not silently\n            // re-mint around the kill switch.\n            throw new AuthupError(\n                `No active ${use} key is available for realm ${realmId} ` +\n                `(${total} key(s) exist, none active).`,\n            );\n        }\n\n        if (use === JWKUse.ENCRYPTION) {\n            return this.createEncryptionKey(repository, realmId);\n        }\n\n        return this.createSignatureKey(repository, realmId);\n    }\n\n    async resolveById(id: string): Promise<Key | null> {\n        const { repository } = this;\n\n        // `id` reaches here from an attacker-controlled JWT `kid` header on the\n        // token-verification hot path. A non-UUID value binds against a\n        // postgres `uuid` column as a driver-level type error (500) instead of\n        // a clean miss — short-circuit to \"not found\" so a garbage kid is a\n        // plain verification failure.\n        if (!isUUID(id)) {\n            return null;\n        }\n\n        const entity = await repository.findOne({\n            select: {\n                id: true,\n                name: true,\n                type: true,\n                use: true,\n                status: true,\n                signatureAlgorithm: true,\n                encryptionKey: true,\n                decryptionKey: true,\n                realmId: true,\n            },\n            where: { id },\n        });\n\n        if (!entity) {\n            return null;\n        }\n\n        return this.afterLoad(repository, entity);\n    }\n\n    protected async createSignatureKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const keyPair = await createAsymmetricKeyPair({ name: CryptoAsymmetricAlgorithm.RSASSA_PKCS1_V1_5 });\n\n        const privateKeyContainer = new AsymmetricKey(keyPair.privateKey);\n        const publicKeyContainer = new AsymmetricKey(keyPair.publicKey);\n\n        const material = await privateKeyContainer.toBase64();\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.SIGNATURE),\n            type: JWKType.RSA,\n            use: JWKUse.SIGNATURE,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: await publicKeyContainer.toBase64(),\n            realmId,\n            signatureAlgorithm: `${JWTAlgorithm.RS256}`,\n        });\n\n        await repository.save(entity);\n\n        // hand the caller usable material regardless of the persisted form.\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected async createEncryptionKey(\n        repository: Repository<KeyEntity>,\n        realmId: string,\n    ) : Promise<Key> {\n        const raw = new Uint8Array(32);\n        getRandomValues(raw);\n\n        const material = arrayBufferToBase64(raw.buffer);\n\n        const entity = repository.create({\n            name: this.generateName(JWKUse.ENCRYPTION),\n            type: JWKType.OCT,\n            use: JWKUse.ENCRYPTION,\n            status: KeyStatus.ACTIVE,\n            decryptionKey: await this.protect(material),\n            encryptionKey: null,\n            realmId,\n            signatureAlgorithm: null,\n        });\n\n        await repository.save(entity);\n\n        entity.decryptionKey = material;\n\n        return entity;\n    }\n\n    protected generateName(use: `${JWKUse}`) : string {\n        return `${use}-${createNanoID(10)}`;\n    }\n\n    protected async afterLoad(\n        repository: Repository<KeyEntity>,\n        entity: KeyEntity,\n    ) : Promise<Key> {\n        if (!entity.decryptionKey) {\n            return entity;\n        }\n\n        if (isWrappedKeyMaterial(entity.decryptionKey)) {\n            entity.decryptionKey = await unwrapKeyMaterial(this.secretsCipher, entity.decryptionKey);\n            return entity;\n        }\n\n        if (this.secretsCipher) {\n            // lazy wrap-on-read: a KEK added to a running deployment\n            // hardens existing rows without a migration step. Best-effort —\n            // the material stays readable either way.\n            const material = entity.decryptionKey;\n            try {\n                await repository.update(entity.id, { decryptionKey: await wrapKeyMaterial(this.secretsCipher, material) });\n            } catch (e) {\n                // Best-effort — the material stays readable and the next read\n                // retries. Surface it though: a persistent failure (e.g. a\n                // read-only replica) means the row is never hardened at rest.\n                this.logger?.warn(`Failed to wrap key material at rest for key ${entity.id}.`, { error: e });\n            }\n            entity.decryptionKey = material;\n        }\n\n        return entity;\n    }\n\n    protected async protect(material: string) : Promise<string> {\n        if (!this.secretsCipher) {\n            return material;\n        }\n\n        return wrapKeyMaterial(this.secretsCipher, material);\n    }\n\n    // ------------------------------------------------------------------\n    // IKeyRepository — entity CRUD surface (key management API)\n    // ------------------------------------------------------------------\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<Key>> {\n        const qb = this.repository.createQueryBuilder('keyEntity');\n        qb.groupBy('keyEntity.id');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'keyEntity');\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Key | null> {\n        return this.findOneBy({ id });\n    }\n\n    async findOneByName(name: string, realmKey?: string): Promise<Key | null> {\n        const where : FindOptionsWhere<KeyEntity> = { name };\n\n        if (realmKey) {\n            const realmId = await this.realmRepository.resolveId(realmKey);\n            if (!realmId) {\n                return null;\n            }\n\n            where.realmId = realmId;\n        }\n\n        return this.repository.findOneBy(where);\n    }\n\n    async findOneByIdOrName(idOrName: string, realm?: string): Promise<Key | null> {\n        return isUUID(idOrName) ?\n            this.findOneById(idOrName) :\n            this.findOneByName(idOrName, realm);\n    }\n\n    async findManyBy(where: Record<string, any>): Promise<Key[]> {\n        return this.repository.findBy(translateWhereConditions(where));\n    }\n\n    async findOneBy(where: Record<string, any>): Promise<Key | null> {\n        return this.repository.findOneBy(translateWhereConditions(where));\n    }\n\n    create(data: Partial<Key>): Key {\n        return this.repository.create(data);\n    }\n\n    merge(entity: Key, data: Partial<Key>): Key {\n        return this.repository.merge(entity as KeyEntity, data);\n    }\n\n    async save(entity: Key): Promise<Key> {\n        if (\n            entity.decryptionKey &&\n            this.secretsCipher &&\n            !isWrappedKeyMaterial(entity.decryptionKey)\n        ) {\n            const material = entity.decryptionKey;\n            entity.decryptionKey = await wrapKeyMaterial(this.secretsCipher, material);\n            const saved = await this.repository.save(entity as KeyEntity);\n            saved.decryptionKey = material;\n            return saved;\n        }\n\n        return this.repository.save(entity as KeyEntity);\n    }\n\n    async remove(entity: Key): Promise<void> {\n        await this.repository.remove(entity as KeyEntity);\n    }\n\n    async validateJoinColumns(data: Partial<Key>): Promise<void> {\n        await validateEntityJoinColumns(data, {\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n        });\n    }\n\n    async checkUniqueness(data: Partial<Key>, existing?: Key): Promise<void> {\n        const isUnique = await isEntityUnique({\n            dataSource: this.dataSource,\n            entityTarget: KeyEntity,\n            entity: data,\n            entityExisting: existing,\n        });\n\n        if (!isUnique) {\n            throw new DatabaseConflictError();\n        }\n    }\n\n    async countBlobReferences(keyId: string): Promise<number> {\n        return this.dataSource.getRepository(UserAuthenticatorEntity).countBy({ secret: Like(`${REALM_CIPHER_BLOB_VERSION}.${keyId}.%`) });\n    }\n\n    async findHighestPriority(realmId: string, use: string): Promise<number | null> {\n        return this.repository.maximum('priority', { realmId, use: use as `${JWKUse}` });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDA,IAAa4B,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;;;IAKV,wBAA8C,IAAIE,IAAAA;CAElD,YAAYL,YAAwBM,UAAuC,CAAC,GAAG;EAC3E,KAAKN,aAAaA;EAClB,KAAKC,gBAAgBK,QAAQL,iBAAiB;EAC9C,KAAKE,SAASG,QAAQH;EACtB,KAAKD,kBAAkB,IAAIJ,uBAAuBE,WAAWO,cAAclB,WAAAA,CAAAA;CAC/E;CAEA,IAAcmB,aAAqC;EAC/C,OAAO,KAAKR,WAAWO,cAAcnB,SAAAA;CACzC;CAMUqB,cAAcC,SAAiBC,KAA8C;EACnF,OAAO,KAAKH,WAAWI,QAAQ;GAC3BC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNL,KAAK;IACLM,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfV,SAAS;GACb;GACAW,OAAO;IACHX;IACAC;IACAM,QAAQ7C,UAAUkD;GACtB;GAIAC,OAAO;IACHC,UAAU;IACVC,WAAW;IACXX,IAAI;GACR;EACJ,CAAA;CACJ;CAEA,MAAMY,gBAAgBhB,SAAiBC,KAAgC;EACnE,MAAMgB,SAAS,MAAM,KAAKlB,cAAcC,SAASC,GAAAA;EACjD,IAAIgB,QACA,OAAO,KAAKC,UAAU,KAAKpB,YAAYmB,MAAAA;EAG3C,OAAO,KAAKE,cAAcnB,SAASC,GAAAA;CACvC;;;;;;;;;;;;;;;;IAkBA,cAAwBD,SAAiBC,KAAiC;EACtE,MAAMmB,WAAW,GAAGpB,QAAQ,GAAGC;EAE/B,MAAMoB,WAAW,KAAK3B,MAAM4B,IAAIF,QAAAA;EAChC,IAAIC,UACA,OAAOA;EAGX,MAAME,UAAU,KAAKC,KAAKxB,SAASC,GAAAA;EACnC,KAAKP,MAAM+B,IAAIL,UAAUG,OAAAA;EAEzB,OAAOA,QAAQG,cAAQ;GACnB,KAAKhC,MAAMiC,OAAOP,QAAAA;EACtB,CAAA;CACJ;CAEA,MAAgBI,KAAKxB,SAAiBC,KAAiC;EACnE,MAAM,EAAEH,eAAe;EAKvB,MAAMmB,SAAS,MAAM,KAAKlB,cAAcC,SAASC,GAAAA;EACjD,IAAIgB,QACA,OAAO,KAAKC,UAAUpB,YAAYmB,MAAAA;EAGtC,MAAMW,QAAQ,MAAM9B,WAAW+B,QAAQ;GAAE7B;GAASC;EAAI,CAAA;EACtD,IAAI2B,QAAQ,GAGR,MAAM,IAAInE,YACN,aAAawC,IAAI,8BAA8BD,QAAQ,IACnD4B,MAAM,6BAA6B;EAI/C,IAAI3B,QAAQ/B,OAAO4D,YACf,OAAO,KAAKC,oBAAoBjC,YAAYE,OAAAA;EAGhD,OAAO,KAAKgC,mBAAmBlC,YAAYE,OAAAA;CAC/C;CAEA,MAAMiC,YAAY7B,IAAiC;EAC/C,MAAM,EAAEN,eAAe;EAOvB,IAAI,CAACjC,OAAOuC,EAAAA,GACR,OAAO;EAGX,MAAMa,SAAS,MAAMnB,WAAWI,QAAQ;GACpCC,QAAQ;IACJC,IAAI;IACJC,MAAM;IACNC,MAAM;IACNL,KAAK;IACLM,QAAQ;IACRC,oBAAoB;IACpBC,eAAe;IACfC,eAAe;IACfV,SAAS;GACb;GACAW,OAAO,EAAEP,GAAG;EAChB,CAAA;EAEA,IAAI,CAACa,QACD,OAAO;EAGX,OAAO,KAAKC,UAAUpB,YAAYmB,MAAAA;CACtC;CAEA,MAAgBe,mBACZlC,YACAE,SACa;EACb,MAAMkC,UAAU,MAAMlE,wBAAwB,EAAEqC,MAAMtC,0BAA0BoE,kBAAkB,CAAA;EAElG,MAAMC,sBAAsB,IAAItE,cAAcoE,QAAQG,UAAU;EAChE,MAAMC,qBAAqB,IAAIxE,cAAcoE,QAAQK,SAAS;EAE9D,MAAMC,WAAW,MAAMJ,oBAAoBK,SAAQ;EAEnD,MAAMxB,SAASnB,WAAW4C,OAAO;GAC7BrC,MAAM,KAAKsC,aAAazE,OAAO0E,SAAS;GACxCtC,MAAMrC,QAAQ4E;GACd5C,KAAK/B,OAAO0E;GACZrC,QAAQ7C,UAAUkD;GAClBF,eAAe,MAAM,KAAKoC,QAAQN,QAAAA;GAClC/B,eAAe,MAAM6B,mBAAmBG,SAAQ;GAChDzC;GACAQ,oBAAoB,GAAGrC,aAAa4E;EACxC,CAAA;EAEA,MAAMjD,WAAWkD,KAAK/B,MAAAA;EAGtBA,OAAOP,gBAAgB8B;EAEvB,OAAOvB;CACX;CAEA,MAAgBc,oBACZjC,YACAE,SACa;EACb,MAAMiD,sBAAM,IAAIC,WAAW,EAAA;EAC3B1E,gBAAgByE,GAAAA;EAEhB,MAAMT,WAAW7E,oBAAoBsF,IAAIE,MAAM;EAE/C,MAAMlC,SAASnB,WAAW4C,OAAO;GAC7BrC,MAAM,KAAKsC,aAAazE,OAAO4D,UAAU;GACzCxB,MAAMrC,QAAQmF;GACdnD,KAAK/B,OAAO4D;GACZvB,QAAQ7C,UAAUkD;GAClBF,eAAe,MAAM,KAAKoC,QAAQN,QAAAA;GAClC/B,eAAe;GACfT;GACAQ,oBAAoB;EACxB,CAAA;EAEA,MAAMV,WAAWkD,KAAK/B,MAAAA;EAEtBA,OAAOP,gBAAgB8B;EAEvB,OAAOvB;CACX;CAEU0B,aAAa1C,KAA2B;EAC9C,OAAO,GAAGA,IAAI,GAAGrC,aAAa,EAAA;CAClC;CAEA,MAAgBsD,UACZpB,YACAmB,QACa;EACb,IAAI,CAACA,OAAOP,eACR,OAAOO;EAGX,IAAInC,qBAAqBmC,OAAOP,aAAa,GAAG;GAC5CO,OAAOP,gBAAgB,MAAM3B,kBAAkB,KAAKQ,eAAe0B,OAAOP,aAAa;GACvF,OAAOO;EACX;EAEA,IAAI,KAAK1B,eAAe;GAIpB,MAAMiD,WAAWvB,OAAOP;GACxB,IAAI;IACA,MAAMZ,WAAWuD,OAAOpC,OAAOb,IAAI,EAAEM,eAAe,MAAM1B,gBAAgB,KAAKO,eAAeiD,QAAAA,EAAU,CAAA;GAC5G,SAASc,GAAG;IAIR,KAAK7D,QAAQ8D,KAAK,+CAA+CtC,OAAOb,GAAG,IAAI,EAAEoD,OAAOF,EAAE,CAAA;GAC9F;GACArC,OAAOP,gBAAgB8B;EAC3B;EAEA,OAAOvB;CACX;CAEA,MAAgB6B,QAAQN,UAAoC;EACxD,IAAI,CAAC,KAAKjD,eACN,OAAOiD;EAGX,OAAOxD,gBAAgB,KAAKO,eAAeiD,QAAAA;CAC/C;CAMA,MAAMiB,SAASC,OAA6D;EACxE,MAAMC,KAAK,KAAK7D,WAAW8D,mBAAmB,WAAA;EAC9CD,GAAGE,QAAQ,cAAA;EAEX,MAAM,EAAEC,eAAexF,WAAWqF,IAAID,KAAAA;EAEtCzE,sBAAsB0E,IAAI,WAAA;EAE1B,MAAM,CAACI,UAAUnC,SAAS,MAAM+B,GAAGK,gBAAe;EAElD,OAAO;GACHC,MAAM1F,sBAAsBmF,OAAOK,QAAAA;GACnCG,MAAM;IACFtC;IACA,GAAGkC;GACP;EACJ;CACJ;CAEA,MAAMK,YAAY/D,IAAiC;EAC/C,OAAO,KAAKgE,UAAU,EAAEhE,GAAG,CAAA;CAC/B;CAEA,MAAMiE,cAAchE,MAAciE,UAAwC;EACtE,MAAM3D,QAAsC,EAAEN,KAAK;EAEnD,IAAIiE,UAAU;GACV,MAAMtE,UAAU,MAAM,KAAKR,gBAAgB+E,UAAUD,QAAAA;GACrD,IAAI,CAACtE,SACD,OAAO;GAGXW,MAAMX,UAAUA;EACpB;EAEA,OAAO,KAAKF,WAAWsE,UAAUzD,KAAAA;CACrC;CAEA,MAAM6D,kBAAkBC,UAAkBC,OAAqC;EAC3E,OAAO7G,OAAO4G,QAAAA,IACV,KAAKN,YAAYM,QAAAA,IACjB,KAAKJ,cAAcI,UAAUC,KAAAA;CACrC;CAEA,MAAMC,WAAWhE,OAA4C;EACzD,OAAO,KAAKb,WAAW8E,OAAOzF,yBAAyBwB,KAAAA,CAAAA;CAC3D;CAEA,MAAMyD,UAAUzD,OAAiD;EAC7D,OAAO,KAAKb,WAAWsE,UAAUjF,yBAAyBwB,KAAAA,CAAAA;CAC9D;CAEA+B,OAAOuB,MAAyB;EAC5B,OAAO,KAAKnE,WAAW4C,OAAOuB,IAAAA;CAClC;CAEAY,MAAM5D,QAAagD,MAAyB;EACxC,OAAO,KAAKnE,WAAW+E,MAAM5D,QAAqBgD,IAAAA;CACtD;CAEA,MAAMjB,KAAK/B,QAA2B;EAClC,IACIA,OAAOP,iBACP,KAAKnB,iBACL,CAACT,qBAAqBmC,OAAOP,aAAa,GAC5C;GACE,MAAM8B,WAAWvB,OAAOP;GACxBO,OAAOP,gBAAgB,MAAM1B,gBAAgB,KAAKO,eAAeiD,QAAAA;GACjE,MAAMsC,QAAQ,MAAM,KAAKhF,WAAWkD,KAAK/B,MAAAA;GACzC6D,MAAMpE,gBAAgB8B;GACtB,OAAOsC;EACX;EAEA,OAAO,KAAKhF,WAAWkD,KAAK/B,MAAAA;CAChC;CAEA,MAAM8D,OAAO9D,QAA4B;EACrC,MAAM,KAAKnB,WAAWiF,OAAO9D,MAAAA;CACjC;CAEA,MAAM+D,oBAAoBf,MAAmC;EACzD,MAAM5F,0BAA0B4F,MAAM;GAClC3E,YAAY,KAAKA;GACjB2F,cAAcvG;EAClB,CAAA;CACJ;CAEA,MAAMwG,gBAAgBjB,MAAoBkB,UAA+B;EAQrE,IAAI,CAACC,MAPkBlG,eAAe;GAClCI,YAAY,KAAKA;GACjB2F,cAAcvG;GACduC,QAAQgD;GACRoB,gBAAgBF;EACpB,CAAA,GAGI,MAAM,IAAI1G,sBAAAA;CAElB;CAEA,MAAM6G,oBAAoBC,OAAgC;EACtD,OAAO,KAAKjG,WAAWO,cAAcjB,uBAAAA,CAAAA,CAAyBiD,QAAQ,EAAE2D,QAAQpH,KAAK,MAAgCmH,MAAM,GAAG,EAAE,CAAA;CACpI;CAEA,MAAME,oBAAoBzF,SAAiBC,KAAqC;EAC5E,OAAO,KAAKH,WAAW4F,QAAQ,YAAY;GAAE1F;GAAcC;EAAmB,CAAA;CAClF;AACJ"}

package/dist/app/modules/database/repositories/schema-validation.d.ts

@@ -14,12 +14,20 @@ export declare function assertSchemaFieldsCoverEntity(name: string, schema: {
 }, metadata: EntityMetadata): void;
 /**
  * Validate every registered entity schema against its TypeORM
- * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
- * fields/sort defaults and the filters default condition tree must
- * reference existing columns/relations) and assert its field allow-list
- * covers every selectable column. Called by
- * `DatabaseModule.setup` once the DataSource is initialized —
- * schema/entity drift fails the boot, fail-fast.
+ * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`:
+ * allow-lists, fields/sort defaults and the filters default condition
+ * tree must reference existing columns/relations, AND every declared
+ * index must be a leftmost prefix of a real primary key, unique
+ * constraint or index) and assert its field allow-list covers every
+ * selectable column. Called by `DatabaseModule.setup` once the
+ * DataSource is initialized — schema/entity drift fails the boot,
+ * fail-fast.
+ *
+ * The index half was an authup-side assert until rapiq 2.1.0 folded it
+ * upstream (tada5hi/rapiq#902 closed #898); the local copy is gone,
+ * since the upstream check is the same leftmost-prefix rule over the
+ * same structures and additionally verifies the index keys are real
+ * columns.
  */
 export declare function validateEntitySchemas(dataSource: DataSource): void;
 //# sourceMappingURL=schema-validation.d.ts.map

package/dist/app/modules/database/repositories/schema-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAgB,MAAM,SAAS,CAAC;AA2ExE;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,cAAc,GACxB,IAAI,CAiBP;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAI,IAAI,CAQnE"}
+{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAgB,MAAM,SAAS,CAAC;AA+ExE;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,cAAc,GACxB,IAAI,CAiBP;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAI,IAAI,CAQnE"}

package/dist/app/modules/database/repositories/schema-validation.mjs

@@ -17,8 +17,10 @@ import { UserAttributeEntity } from "../../../../adapters/database/domains/user-
 import { ConsentEntity } from "../../../../adapters/database/domains/consent/entity.mjs";
 import { EventEntity } from "../../../../adapters/database/domains/event/entity.mjs";
 import { IdentityProviderEntity } from "../../../../adapters/database/domains/identity-provider/entity.mjs";
+import { IdentityProviderAccountEntity } from "../../../../adapters/database/domains/identity-provider-account/entity.mjs";
 import { IdentityProviderRoleMappingEntity } from "../../../../adapters/database/domains/identity-provider-role-mapping/entity.mjs";
 import { SessionEntity } from "../../../../adapters/database/domains/session/entity.mjs";
+import { SessionTokenEntity } from "../../../../adapters/database/domains/session-token/entity.mjs";
 import { TrustAnchorEntity } from "../../../../adapters/database/domains/trust-anchor/entity.mjs";
 import { PermissionPolicyEntity } from "../../../../adapters/database/domains/permission-policy/entity.mjs";
 import { RolePermissionEntity } from "../../../../adapters/database/domains/role-permission/entity.mjs";
@@ -43,6 +45,7 @@ import { assertSchemaMatchesEntity } from "@rapiq/adapter-typeorm";
 	[EntityType.CONSENT]: ConsentEntity,
 	[EntityType.EVENT]: EventEntity,
 	[EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,
+	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: IdentityProviderAccountEntity,
 	[EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,
 	[EntityType.KEY]: KeyEntity,
 	[EntityType.PERMISSION]: PermissionEntity,
@@ -54,6 +57,7 @@ import { assertSchemaMatchesEntity } from "@rapiq/adapter-typeorm";
 	[EntityType.ROLE_PERMISSION]: RolePermissionEntity,
 	[EntityType.SCOPE]: ScopeEntity,
 	[EntityType.SESSION]: SessionEntity,
+	[EntityType.SESSION_TOKEN]: SessionTokenEntity,
 	[EntityType.TRUST_ANCHOR]: TrustAnchorEntity,
 	[EntityType.USER]: UserEntity,
 	[EntityType.USER_ATTRIBUTE]: UserAttributeEntity,
@@ -81,12 +85,20 @@ import { assertSchemaMatchesEntity } from "@rapiq/adapter-typeorm";
 }
 /**
 * Validate every registered entity schema against its TypeORM
-* metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,
-* fields/sort defaults and the filters default condition tree must
-* reference existing columns/relations) and assert its field allow-list
-* covers every selectable column. Called by
-* `DatabaseModule.setup` once the DataSource is initialized —
-* schema/entity drift fails the boot, fail-fast.
+* metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`:
+* allow-lists, fields/sort defaults and the filters default condition
+* tree must reference existing columns/relations, AND every declared
+* index must be a leftmost prefix of a real primary key, unique
+* constraint or index) and assert its field allow-list covers every
+* selectable column. Called by `DatabaseModule.setup` once the
+* DataSource is initialized — schema/entity drift fails the boot,
+* fail-fast.
+*
+* The index half was an authup-side assert until rapiq 2.1.0 folded it
+* upstream (tada5hi/rapiq#902 closed #898); the local copy is gone,
+* since the upstream check is the same leftmost-prefix rule over the
+* same structures and additionally verifies the index keys are real
+* columns.
 */ function validateEntitySchemas(dataSource) {
 	for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {
 		const schema = schemaRegistry.getOrFail(name);

package/dist/app/modules/database/repositories/schema-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema-validation.mjs","names":["assertSchemaMatchesEntity","EntityType","schemaRegistry","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","ConsentEntity","EventEntity","IdentityProviderEntity","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyEntity","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","SessionEntity","TrustAnchorEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRoleEntity","SCHEMA_ENTITY_TARGETS","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","PERMISSION","PERMISSION_POLICY","POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","SCHEMA_FIELD_EXCLUSIONS","assertSchemaFieldsCoverEntity","name","schema","metadata","declared","Set","fields","default","allowed","excluded","missing","columns","filter","column","isSelect","map","propertyName","has","length","Error","join","validateEntitySchemas","dataSource","target","Object","entries","getOrFail","getMetadata"],"sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@rapiq/core';\nimport { assertSchemaMatchesEntity } from '@rapiq/adapter-typeorm';\nimport type { DataSource, EntityMetadata, EntityTarget } from 'typeorm';\nimport { EntityType } from '@authup/core-kit';\nimport { schemaRegistry } from '../../../../core/index.ts';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    ConsentEntity,\n    EventEntity,\n    IdentityProviderEntity,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyEntity,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    SessionEntity,\n    TrustAnchorEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\n\n/**\n * Entity class per registered schema name — the iteration source for\n * the boot-time validation. A mapped name missing from the registry\n * fails via `getOrFail`, so a renamed/removed schema surfaces here too.\n */\nconst SCHEMA_ENTITY_TARGETS : Record<string, EntityTarget<ObjectLiteral>> = {\n    [EntityType.CLIENT]: ClientEntity,\n    [EntityType.CLIENT_PERMISSION]: ClientPermissionEntity,\n    [EntityType.CLIENT_ROLE]: ClientRoleEntity,\n    [EntityType.CLIENT_SCOPE]: ClientScopeEntity,\n    [EntityType.CONSENT]: ConsentEntity,\n    [EntityType.EVENT]: EventEntity,\n    [EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,\n    [EntityType.KEY]: KeyEntity,\n    [EntityType.PERMISSION]: PermissionEntity,\n    [EntityType.PERMISSION_POLICY]: PermissionPolicyEntity,\n    [EntityType.POLICY]: PolicyEntity,\n    [EntityType.REALM]: RealmEntity,\n    [EntityType.ROLE]: RoleEntity,\n    [EntityType.ROLE_ATTRIBUTE]: RoleAttributeEntity,\n    [EntityType.ROLE_PERMISSION]: RolePermissionEntity,\n    [EntityType.SCOPE]: ScopeEntity,\n    [EntityType.SESSION]: SessionEntity,\n    [EntityType.TRUST_ANCHOR]: TrustAnchorEntity,\n    [EntityType.USER]: UserEntity,\n    [EntityType.USER_ATTRIBUTE]: UserAttributeEntity,\n    [EntityType.USER_AUTHENTICATOR]: UserAuthenticatorEntity,\n    [EntityType.USER_PERMISSION]: UserPermissionEntity,\n    [EntityType.USER_ROLE]: UserRoleEntity,\n};\n\n/**\n * Selectable columns deliberately kept out of a schema's field\n * allow-list. `select: false` columns are skipped automatically (the\n * entity already declares them hidden); everything listed here is a\n * column that IS selectable but must never ride the API projection.\n */\nconst SCHEMA_FIELD_EXCLUSIONS : Record<string, string[]> = {\n    // device-internal credential blob (TOTP config, WebAuthn public key +\n    // signature counter) — surfaced only through the challenge endpoint's\n    // trimmed view.\n    [EntityType.USER_AUTHENTICATOR]: ['parameters'],\n};\n\n/**\n * Every selectable column must appear in the schema's field allow-list:\n * rapiq derives the root projection from `fields` (`default` when\n * present, else `allowed`), so a column missing from BOTH silently\n * vanishes from every collection response — no error, just an absent\n * property (`role.builtIn` went missing this way).\n */\nexport function assertSchemaFieldsCoverEntity(\n    name: string,\n    schema: { fields?: { default?: string[], allowed?: string[] } },\n    metadata: EntityMetadata,\n) : void {\n    const declared = new Set([\n        ...(schema.fields?.default || []),\n        ...(schema.fields?.allowed || []),\n    ]);\n\n    const excluded = new Set(SCHEMA_FIELD_EXCLUSIONS[name] || []);\n    const missing = metadata.columns\n        .filter((column) => column.isSelect)\n        .map((column) => column.propertyName)\n        .filter((propertyName) => !declared.has(propertyName) && !excluded.has(propertyName));\n\n    if (missing.length > 0) {\n        throw new Error(\n            `The schema \"${name}\" does not declare the field(s): ${missing.join(', ')}.`,\n        );\n    }\n}\n\n/**\n * Validate every registered entity schema against its TypeORM\n * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`: allow-lists,\n * fields/sort defaults and the filters default condition tree must\n * reference existing columns/relations) and assert its field allow-list\n * covers every selectable column. Called by\n * `DatabaseModule.setup` once the DataSource is initialized —\n * schema/entity drift fails the boot, fail-fast.\n */\nexport function validateEntitySchemas(dataSource: DataSource) : void {\n    for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {\n        const schema = schemaRegistry.getOrFail(name);\n        const metadata = dataSource.getMetadata(target);\n\n        assertSchemaMatchesEntity(schema, metadata);\n        assertSchemaFieldsCoverEntity(name, schema, metadata);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CA,MAAM2B,wBAAsE;EACvE1B,WAAW2B,SAASzB;EACpBF,WAAW4B,oBAAoBzB;EAC/BH,WAAW6B,cAAczB;EACzBJ,WAAW8B,eAAezB;EAC1BL,WAAW+B,UAAUzB;EACrBN,WAAWgC,QAAQzB;EACnBP,WAAWiC,oBAAoBzB;EAC/BR,WAAWkC,iCAAiCzB;EAC5CT,WAAWmC,MAAMzB;EACjBV,WAAWoC,aAAazB;EACxBX,WAAWqC,oBAAoBzB;EAC/BZ,WAAWsC,SAASzB;EACpBb,WAAWuC,QAAQzB;EACnBd,WAAWwC,OAAOxB;EAClBhB,WAAWyC,iBAAiB1B;EAC5Bf,WAAW0C,kBAAkBzB;EAC7BjB,WAAW2C,QAAQzB;EACnBlB,WAAW4C,UAAUzB;EACrBnB,WAAW6C,eAAezB;EAC1BpB,WAAW8C,OAAOvB;EAClBvB,WAAW+C,iBAAiB1B;EAC5BrB,WAAWgD,qBAAqB1B;EAChCtB,WAAWiD,kBAAkBzB;EAC7BxB,WAAWkD,YAAYzB;AAC5B;;;;;;GAQA,MAAM0B,0BAAqD,GAItDnD,WAAWgD,qBAAqB,CAAC,YAAa,EACnD;;;;;;;GASA,SAAgBI,8BACZC,MACAC,QACAC,UAAwB;CAExB,MAAMC,2BAAW,IAAIC,IAAI,CACjBH,GAAAA,OAAOI,QAAQC,WAAW,CAAA,GAC1BL,GAAAA,OAAOI,QAAQE,WAAW,CAAA,CACjC,CAAA;CAED,MAAMC,WAAW,IAAIJ,IAAIN,wBAAwBE,SAAS,CAAA,CAAE;CAC5D,MAAMS,UAAUP,SAASQ,QACpBC,QAAQC,WAAWA,OAAOC,QAAQ,CAAA,CAClCC,KAAKF,WAAWA,OAAOG,YAAY,CAAA,CACnCJ,QAAQI,iBAAiB,CAACZ,SAASa,IAAID,YAAAA,KAAiB,CAACP,SAASQ,IAAID,YAAAA,CAAAA;CAE3E,IAAIN,QAAQQ,SAAS,GACjB,MAAM,IAAIC,MACN,eAAelB,KAAK,mCAAmCS,QAAQU,KAAK,IAAA,EAAM,EAAE;AAGxF;;;;;;;;;GAWA,SAAgBC,sBAAsBC,YAAsB;CACxD,KAAK,MAAM,CAACrB,MAAMsB,WAAWC,OAAOC,QAAQnD,qBAAAA,GAAwB;EAChE,MAAM4B,SAASrD,eAAe6E,UAAUzB,IAAAA;EACxC,MAAME,WAAWmB,WAAWK,YAAYJ,MAAAA;EAExC5E,0BAA0BuD,QAAQC,QAAAA;EAClCH,8BAA8BC,MAAMC,QAAQC,QAAAA;CAChD;AACJ"}
+{"version":3,"file":"schema-validation.mjs","names":["assertSchemaMatchesEntity","EntityType","schemaRegistry","ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","ConsentEntity","EventEntity","IdentityProviderAccountEntity","IdentityProviderEntity","IdentityProviderRoleMappingEntity","KeyEntity","PermissionEntity","PermissionPolicyEntity","PolicyEntity","RealmEntity","RoleAttributeEntity","RoleEntity","RolePermissionEntity","ScopeEntity","SessionEntity","SessionTokenEntity","TrustAnchorEntity","UserAttributeEntity","UserAuthenticatorEntity","UserEntity","UserPermissionEntity","UserRoleEntity","SCHEMA_ENTITY_TARGETS","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","PERMISSION","PERMISSION_POLICY","POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","SESSION_TOKEN","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","SCHEMA_FIELD_EXCLUSIONS","assertSchemaFieldsCoverEntity","name","schema","metadata","declared","Set","fields","default","allowed","excluded","missing","columns","filter","column","isSelect","map","propertyName","has","length","Error","join","validateEntitySchemas","dataSource","target","Object","entries","getOrFail","getMetadata"],"sources":["../../../../../src/app/modules/database/repositories/schema-validation.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ObjectLiteral } from '@rapiq/core';\nimport { assertSchemaMatchesEntity } from '@rapiq/adapter-typeorm';\nimport type { DataSource, EntityMetadata, EntityTarget } from 'typeorm';\nimport { EntityType } from '@authup/core-kit';\nimport { schemaRegistry } from '../../../../core/index.ts';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    ConsentEntity,\n    EventEntity,\n    IdentityProviderAccountEntity,\n    IdentityProviderEntity,\n    IdentityProviderRoleMappingEntity,\n    KeyEntity,\n    PermissionEntity,\n    PermissionPolicyEntity,\n    PolicyEntity,\n    RealmEntity,\n    RoleAttributeEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    SessionEntity,\n    SessionTokenEntity,\n    TrustAnchorEntity,\n    UserAttributeEntity,\n    UserAuthenticatorEntity,\n    UserEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../../adapters/database/domains/index.ts';\n\n/**\n * Entity class per registered schema name — the iteration source for\n * the boot-time validation. A mapped name missing from the registry\n * fails via `getOrFail`, so a renamed/removed schema surfaces here too.\n */\nconst SCHEMA_ENTITY_TARGETS : Record<string, EntityTarget<ObjectLiteral>> = {\n    [EntityType.CLIENT]: ClientEntity,\n    [EntityType.CLIENT_PERMISSION]: ClientPermissionEntity,\n    [EntityType.CLIENT_ROLE]: ClientRoleEntity,\n    [EntityType.CLIENT_SCOPE]: ClientScopeEntity,\n    [EntityType.CONSENT]: ConsentEntity,\n    [EntityType.EVENT]: EventEntity,\n    [EntityType.IDENTITY_PROVIDER]: IdentityProviderEntity,\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: IdentityProviderAccountEntity,\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: IdentityProviderRoleMappingEntity,\n    [EntityType.KEY]: KeyEntity,\n    [EntityType.PERMISSION]: PermissionEntity,\n    [EntityType.PERMISSION_POLICY]: PermissionPolicyEntity,\n    [EntityType.POLICY]: PolicyEntity,\n    [EntityType.REALM]: RealmEntity,\n    [EntityType.ROLE]: RoleEntity,\n    [EntityType.ROLE_ATTRIBUTE]: RoleAttributeEntity,\n    [EntityType.ROLE_PERMISSION]: RolePermissionEntity,\n    [EntityType.SCOPE]: ScopeEntity,\n    [EntityType.SESSION]: SessionEntity,\n    [EntityType.SESSION_TOKEN]: SessionTokenEntity,\n    [EntityType.TRUST_ANCHOR]: TrustAnchorEntity,\n    [EntityType.USER]: UserEntity,\n    [EntityType.USER_ATTRIBUTE]: UserAttributeEntity,\n    [EntityType.USER_AUTHENTICATOR]: UserAuthenticatorEntity,\n    [EntityType.USER_PERMISSION]: UserPermissionEntity,\n    [EntityType.USER_ROLE]: UserRoleEntity,\n};\n\n/**\n * Selectable columns deliberately kept out of a schema's field\n * allow-list. `select: false` columns are skipped automatically (the\n * entity already declares them hidden); everything listed here is a\n * column that IS selectable but must never ride the API projection.\n */\nconst SCHEMA_FIELD_EXCLUSIONS : Record<string, string[]> = {\n    // device-internal credential blob (TOTP config, WebAuthn public key +\n    // signature counter) — surfaced only through the challenge endpoint's\n    // trimmed view.\n    [EntityType.USER_AUTHENTICATOR]: ['parameters'],\n};\n\n/**\n * Every selectable column must appear in the schema's field allow-list:\n * rapiq derives the root projection from `fields` (`default` when\n * present, else `allowed`), so a column missing from BOTH silently\n * vanishes from every collection response — no error, just an absent\n * property (`role.builtIn` went missing this way).\n */\nexport function assertSchemaFieldsCoverEntity(\n    name: string,\n    schema: { fields?: { default?: string[], allowed?: string[] } },\n    metadata: EntityMetadata,\n) : void {\n    const declared = new Set([\n        ...(schema.fields?.default || []),\n        ...(schema.fields?.allowed || []),\n    ]);\n\n    const excluded = new Set(SCHEMA_FIELD_EXCLUSIONS[name] || []);\n    const missing = metadata.columns\n        .filter((column) => column.isSelect)\n        .map((column) => column.propertyName)\n        .filter((propertyName) => !declared.has(propertyName) && !excluded.has(propertyName));\n\n    if (missing.length > 0) {\n        throw new Error(\n            `The schema \"${name}\" does not declare the field(s): ${missing.join(', ')}.`,\n        );\n    }\n}\n\n/**\n * Validate every registered entity schema against its TypeORM\n * metadata (`@rapiq/adapter-typeorm`'s `assertSchemaMatchesEntity`:\n * allow-lists, fields/sort defaults and the filters default condition\n * tree must reference existing columns/relations, AND every declared\n * index must be a leftmost prefix of a real primary key, unique\n * constraint or index) and assert its field allow-list covers every\n * selectable column. Called by `DatabaseModule.setup` once the\n * DataSource is initialized — schema/entity drift fails the boot,\n * fail-fast.\n *\n * The index half was an authup-side assert until rapiq 2.1.0 folded it\n * upstream (tada5hi/rapiq#902 closed #898); the local copy is gone,\n * since the upstream check is the same leftmost-prefix rule over the\n * same structures and additionally verifies the index keys are real\n * columns.\n */\nexport function validateEntitySchemas(dataSource: DataSource) : void {\n    for (const [name, target] of Object.entries(SCHEMA_ENTITY_TARGETS)) {\n        const schema = schemaRegistry.getOrFail(name);\n        const metadata = dataSource.getMetadata(target);\n\n        assertSchemaMatchesEntity(schema, metadata);\n        assertSchemaFieldsCoverEntity(name, schema, metadata);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CA,MAAM6B,wBAAsE;EACvE5B,WAAW6B,SAAS3B;EACpBF,WAAW8B,oBAAoB3B;EAC/BH,WAAW+B,cAAc3B;EACzBJ,WAAWgC,eAAe3B;EAC1BL,WAAWiC,UAAU3B;EACrBN,WAAWkC,QAAQ3B;EACnBP,WAAWmC,oBAAoB1B;EAC/BT,WAAWoC,4BAA4B5B;EACvCR,WAAWqC,iCAAiC3B;EAC5CV,WAAWsC,MAAM3B;EACjBX,WAAWuC,aAAa3B;EACxBZ,WAAWwC,oBAAoB3B;EAC/Bb,WAAWyC,SAAS3B;EACpBd,WAAW0C,QAAQ3B;EACnBf,WAAW2C,OAAO1B;EAClBjB,WAAW4C,iBAAiB5B;EAC5BhB,WAAW6C,kBAAkB3B;EAC7BlB,WAAW8C,QAAQ3B;EACnBnB,WAAW+C,UAAU3B;EACrBpB,WAAWgD,gBAAgB3B;EAC3BrB,WAAWiD,eAAe3B;EAC1BtB,WAAWkD,OAAOzB;EAClBzB,WAAWmD,iBAAiB5B;EAC5BvB,WAAWoD,qBAAqB5B;EAChCxB,WAAWqD,kBAAkB3B;EAC7B1B,WAAWsD,YAAY3B;AAC5B;;;;;;GAQA,MAAM4B,0BAAqD,GAItDvD,WAAWoD,qBAAqB,CAAC,YAAa,EACnD;;;;;;;GASA,SAAgBI,8BACZC,MACAC,QACAC,UAAwB;CAExB,MAAMC,2BAAW,IAAIC,IAAI,CACjBH,GAAAA,OAAOI,QAAQC,WAAW,CAAA,GAC1BL,GAAAA,OAAOI,QAAQE,WAAW,CAAA,CACjC,CAAA;CAED,MAAMC,WAAW,IAAIJ,IAAIN,wBAAwBE,SAAS,CAAA,CAAE;CAC5D,MAAMS,UAAUP,SAASQ,QACpBC,QAAQC,WAAWA,OAAOC,QAAQ,CAAA,CAClCC,KAAKF,WAAWA,OAAOG,YAAY,CAAA,CACnCJ,QAAQI,iBAAiB,CAACZ,SAASa,IAAID,YAAAA,KAAiB,CAACP,SAASQ,IAAID,YAAAA,CAAAA;CAE3E,IAAIN,QAAQQ,SAAS,GACjB,MAAM,IAAIC,MACN,eAAelB,KAAK,mCAAmCS,QAAQU,KAAK,IAAA,EAAM,EAAE;AAGxF;;;;;;;;;;;;;;;;;GAmBA,SAAgBC,sBAAsBC,YAAsB;CACxD,KAAK,MAAM,CAACrB,MAAMsB,WAAWC,OAAOC,QAAQrD,qBAAAA,GAAwB;EAChE,MAAM8B,SAASzD,eAAeiF,UAAUzB,IAAAA;EACxC,MAAME,WAAWmB,WAAWK,YAAYJ,MAAAA;EAExChF,0BAA0B2D,QAAQC,QAAAA;EAClCH,8BAA8BC,MAAMC,QAAQC,QAAAA;CAChD;AACJ"}

package/dist/app/modules/http/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAoDjD;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAevD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/http/module.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGhF,qBAAa,UAAW,YAAW,OAAO;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,QAAQ,EAAG,UAAU,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,oBAAoB,CAAC;IAE5C,SAAS,CAAC,sBAAsB,EAAG,OAAO,CAAC;;IAYrC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4DjD;;;;;;;OAOG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IA+B3D;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;IAehD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBvD"}

package/dist/app/modules/http/module.mjs

@@ -9,7 +9,8 @@ import "../config/index.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import { HTTPInjectionKey } from "./constants.mjs";
-import { createInternalUIHttpClient } from "../../../adapters/http/ui/internal-http-client.mjs";
+import { createInternalUIHttpClient } from "../../../adapters/http/ui/auth-console/http-client.mjs";
+import { bindConsolePackages } from "../../../adapters/http/ui/console-packages/module.mjs";
 import "../../../adapters/http/ui/index.mjs";
 import { MetricsInjectionKey } from "../metrics/constants.mjs";
 import { PromAuthFlowMetrics } from "../metrics/prom.mjs";
@@ -52,6 +53,10 @@ var HTTPModule = class {
 		} catch (e) {
 			throw new AuthupError(`Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`);
 		}
+		await bindConsolePackages({
+			authConsolePath: config.authConsolePath,
+			accountConsolePath: config.accountConsolePath
+		});
 		this.registerUIHttpClient(container);
 		this.registerMetrics(container);
 		await this.middleware.mountBefore(router, container);
@@ -106,6 +111,7 @@ var HTTPModule = class {
 			this.uiHttpClientRegistered = false;
 		}
 		container.unregister(MetricsInjectionKey);
+		await this.middleware.teardown();
 		if (!this.instance) return;
 		container.unregister(HTTPInjectionKey.Server);
 		await this.instance.close();

package/dist/app/modules/http/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["Client","AuthupError","App","serve","ConfigInjectionKey","createInternalUIHttpClient","NoopAuthFlowMetrics","ModuleName","HTTPInjectionKey","MetricsInjectionKey","PromAuthFlowMetrics","HTTPControllerModule","HTTPMiddlewareModule","LoggerInjectionKey","HTTPModule","name","dependencies","instance","middleware","controller","uiHttpClientRegistered","HTTP","CONFIG","LOGGER","AUTHENTICATION","IDENTITY","OAUTH2","setup","container","config","resolve","logger","debug","router","options","trustProxy","e","Error","message","String","registerUIHttpClient","registerMetrics","mountBefore","mount","mountAfter","server","port","hostname","host","silent","gracefulShutdown","ready","url","register","Server","useValue","has","UIHttpClient","useFactory","c","undefined","publicURL","publicUrl","internalURL","baseURL","lifetime","enabled","middlewarePrometheus","teardown","unregister","close"],"sources":["../../../../src/app/modules/http/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport { AuthupError } from '@authup/errors';\nimport { App } from 'routup';\nimport { serve } from 'routup/node';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IModule } from 'orkos';\nimport { createInternalUIHttpClient } from '../../../adapters/http/ui/index.ts';\nimport { NoopAuthFlowMetrics } from '../../../core/index.ts';\nimport { ModuleName } from '../constants.ts';\nimport type { HTTPServer } from './constants.ts';\nimport { HTTPInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { MetricsInjectionKey, PromAuthFlowMetrics } from '../metrics/index.ts';\nimport { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport class HTTPModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected instance : HTTPServer | undefined;\n\n    protected middleware : HTTPMiddlewareModule;\n\n    protected controller : HTTPControllerModule;\n\n    protected uiHttpClientRegistered : boolean;\n\n    constructor() {\n        this.name = ModuleName.HTTP;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.AUTHENTICATION, ModuleName.IDENTITY, ModuleName.OAUTH2];\n        this.controller = new HTTPControllerModule();\n        this.middleware = new HTTPMiddlewareModule();\n        this.uiHttpClientRegistered = false;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Starting http server...');\n\n        // Every request helper deriving proxy-dependent request facts\n        // (getRequestIP, hostname, protocol) resolves the trust contract from\n        // the app options — call sites must NOT pass their own `trustProxy`.\n        let router : App;\n        try {\n            router = new App({ options: { trustProxy: config.trustProxy } });\n        } catch (e) {\n            // proxy-addr compiles the allowlist form inside the App\n            // constructor; its error (\"invalid IP address: …\") does not name\n            // the offending config key — attribute it.\n            throw new AuthupError(\n                `Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`,\n            );\n        }\n\n        this.registerUIHttpClient(container);\n        this.registerMetrics(container);\n\n        await this.middleware.mountBefore(router, container);\n        await this.controller.mount(router, container);\n        await this.middleware.mountAfter(router, container);\n\n        const server = serve(router, {\n            port: config.port,\n            hostname: config.host,\n            silent: true,\n            // Shutdown is driven by the orkos teardown chain (see cli/commands/start.ts);\n            // srvx's plugin would only close the HTTP server, leaving DB / cache / etc. open.\n            gracefulShutdown: false,\n        });\n\n        await server.ready();\n\n        this.instance = server;\n\n        if (server.url) {\n            logger.debug(`Listening on ${server.url}`);\n        }\n\n        container.register(HTTPInjectionKey.Server, { useValue: server });\n\n        logger.debug('Started http server.');\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Default HTTP client for the SSR'd UI pages: dispatches against the\n     * server's own listen address instead of round-tripping through the\n     * reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).\n     * Skipped when the token is already bound (test injection wins).\n     * Transient lifetime is mandatory — client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client.\n     */\n    protected registerUIHttpClient(container: IContainer): void {\n        if (container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        container.register(HTTPInjectionKey.UIHttpClient, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                // The server token is registered after listen; a resolve can\n                // only happen on a request, so it is present by then. The\n                // guards keep an edge case on the previous (public URL)\n                // dispatch behavior instead of failing the render.\n                const server = c.has(HTTPInjectionKey.Server) ?\n                    c.resolve(HTTPInjectionKey.Server) :\n                    undefined;\n\n                if (server && server.url) {\n                    return createInternalUIHttpClient({\n                        publicURL: config.publicUrl,\n                        internalURL: server.url,\n                    });\n                }\n\n                return new Client({ baseURL: config.publicUrl });\n            },\n        }, { lifetime: 'transient' });\n\n        this.uiHttpClientRegistered = true;\n    }\n\n    /**\n     * Auth-flow metric counters for the emit points (plan 058 Part 2).\n     * Registered before the controllers are built — the factories resolve the\n     * token. Prometheus-backed iff the prometheus middleware is enabled\n     * (mirrors HTTPMiddlewareModule.isEnabled: boolean|object, false = off),\n     * otherwise a noop so emit sites never need a guard beyond `?.`.\n     */\n    protected registerMetrics(container: IContainer): void {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const enabled = typeof config.middlewarePrometheus !== 'boolean' ||\n            config.middlewarePrometheus === true;\n\n        container.register(MetricsInjectionKey, {\n            useValue: enabled ?\n                new PromAuthFlowMetrics() :\n                new NoopAuthFlowMetrics(),\n        });\n    }\n\n    // ----------------------------------------------------\n\n    async teardown(container: IContainer): Promise<void> {\n        if (this.uiHttpClientRegistered) {\n            container.unregister(HTTPInjectionKey.UIHttpClient);\n            this.uiHttpClientRegistered = false;\n        }\n\n        container.unregister(MetricsInjectionKey);\n\n        if (!this.instance) return;\n\n        container.unregister(HTTPInjectionKey.Server);\n\n        await this.instance.close();\n        this.instance = undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAac,aAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKL,OAAOR,WAAWc;EACvB,KAAKL,eAAe;GAACT,WAAWe;GAAQf,WAAWgB;GAAQhB,WAAWiB;GAAgBjB,WAAWkB;GAAUlB,WAAWmB;EAAO;EAC7H,KAAKP,aAAa,IAAIR,qBAAAA;EACtB,KAAKO,aAAa,IAAIN,qBAAAA;EACtB,KAAKQ,yBAAyB;CAClC;CAIA,MAAMO,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQ1B,kBAAAA;EACjC,MAAM2B,SAASH,UAAUE,QAAQjB,kBAAAA;EAEjCkB,OAAOC,MAAM,yBAAA;EAKb,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAI/B,IAAI,EAAEgC,SAAS,EAAEC,YAAYN,OAAOM,WAAW,EAAE,CAAA;EAClE,SAASC,GAAG;GAIR,MAAM,IAAInC,YACN,mDAAmDmC,aAAaC,QAAQD,EAAEE,UAAUC,OAAOH,CAAAA,GAAI;EAEvG;EAEA,KAAKI,qBAAqBZ,SAAAA;EAC1B,KAAKa,gBAAgBb,SAAAA;EAErB,MAAM,KAAKV,WAAWwB,YAAYT,QAAQL,SAAAA;EAC1C,MAAM,KAAKT,WAAWwB,MAAMV,QAAQL,SAAAA;EACpC,MAAM,KAAKV,WAAW0B,WAAWX,QAAQL,SAAAA;EAEzC,MAAMiB,SAAS1C,MAAM8B,QAAQ;GACzBa,MAAMjB,OAAOiB;GACbC,UAAUlB,OAAOmB;GACjBC,QAAQ;GAGRC,kBAAkB;EACtB,CAAA;EAEA,MAAML,OAAOM,MAAK;EAElB,KAAKlC,WAAW4B;EAEhB,IAAIA,OAAOO,KACPrB,OAAOC,MAAM,gBAAgBa,OAAOO,KAAK;EAG7CxB,UAAUyB,SAAS7C,iBAAiB8C,QAAQ,EAAEC,UAAUV,OAAO,CAAA;EAE/Dd,OAAOC,MAAM,sBAAA;CACjB;;;;;;;;IAYA,qBAA+BJ,WAA6B;EACxD,IAAIA,UAAU4B,IAAIhD,iBAAiBiD,YAAY,GAC3C;EAGJ7B,UAAUyB,SAAS7C,iBAAiBiD,cAAc,EAC9CC,aAAaC,MAAAA;GACT,MAAM9B,SAAS8B,EAAE7B,QAAQ1B,kBAAAA;GAMzB,MAAMyC,SAASc,EAAEH,IAAIhD,iBAAiB8C,MAAM,IACxCK,EAAE7B,QAAQtB,iBAAiB8C,MAAM,IACjCM,KAAAA;GAEJ,IAAIf,UAAUA,OAAOO,KACjB,OAAO/C,2BAA2B;IAC9BwD,WAAWhC,OAAOiC;IAClBC,aAAalB,OAAOO;GACxB,CAAA;GAGJ,OAAO,IAAIpD,OAAO,EAAEgE,SAASnC,OAAOiC,UAAU,CAAA;EAClD,EACJ,GAAG,EAAEG,UAAU,YAAY,CAAA;EAE3B,KAAK7C,yBAAyB;CAClC;;;;;;;IASA,gBAA0BQ,WAA6B;EACnD,MAAMC,SAASD,UAAUE,QAAQ1B,kBAAAA;EAEjC,MAAM8D,UAAU,OAAOrC,OAAOsC,yBAAyB,aACnDtC,OAAOsC,yBAAyB;EAEpCvC,UAAUyB,SAAS5C,qBAAqB,EACpC8C,UAAUW,UACN,IAAIxD,oBAAAA,IACJ,IAAIJ,oBAAAA,EACZ,CAAA;CACJ;CAIA,MAAM8D,SAASxC,WAAsC;EACjD,IAAI,KAAKR,wBAAwB;GAC7BQ,UAAUyC,WAAW7D,iBAAiBiD,YAAY;GAClD,KAAKrC,yBAAyB;EAClC;EAEAQ,UAAUyC,WAAW5D,mBAAAA;EAErB,IAAI,CAAC,KAAKQ,UAAU;EAEpBW,UAAUyC,WAAW7D,iBAAiB8C,MAAM;EAE5C,MAAM,KAAKrC,SAASqD,MAAK;EACzB,KAAKrD,WAAW2C,KAAAA;CACpB;AACJ"}
+{"version":3,"file":"module.mjs","names":["Client","AuthupError","App","serve","ConfigInjectionKey","bindConsolePackages","createInternalUIHttpClient","NoopAuthFlowMetrics","ModuleName","HTTPInjectionKey","MetricsInjectionKey","PromAuthFlowMetrics","HTTPControllerModule","HTTPMiddlewareModule","LoggerInjectionKey","HTTPModule","name","dependencies","instance","middleware","controller","uiHttpClientRegistered","HTTP","CONFIG","LOGGER","AUTHENTICATION","IDENTITY","OAUTH2","setup","container","config","resolve","logger","debug","router","options","trustProxy","e","Error","message","String","authConsolePath","accountConsolePath","registerUIHttpClient","registerMetrics","mountBefore","mount","mountAfter","server","port","hostname","host","silent","gracefulShutdown","ready","url","register","Server","useValue","has","UIHttpClient","useFactory","c","undefined","publicURL","publicUrl","internalURL","baseURL","lifetime","enabled","middlewarePrometheus","teardown","unregister","close"],"sources":["../../../../src/app/modules/http/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport { AuthupError } from '@authup/errors';\nimport { App } from 'routup';\nimport { serve } from 'routup/node';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport type { IModule } from 'orkos';\nimport { bindConsolePackages, createInternalUIHttpClient } from '../../../adapters/http/ui/index.ts';\nimport { NoopAuthFlowMetrics } from '../../../core/index.ts';\nimport { ModuleName } from '../constants.ts';\nimport type { HTTPServer } from './constants.ts';\nimport { HTTPInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\nimport { MetricsInjectionKey, PromAuthFlowMetrics } from '../metrics/index.ts';\nimport { HTTPControllerModule, HTTPMiddlewareModule } from './modules/index.ts';\nimport { LoggerInjectionKey } from '../logger/index.ts';\n\nexport class HTTPModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected instance : HTTPServer | undefined;\n\n    protected middleware : HTTPMiddlewareModule;\n\n    protected controller : HTTPControllerModule;\n\n    protected uiHttpClientRegistered : boolean;\n\n    constructor() {\n        this.name = ModuleName.HTTP;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER, ModuleName.AUTHENTICATION, ModuleName.IDENTITY, ModuleName.OAUTH2];\n        this.controller = new HTTPControllerModule();\n        this.middleware = new HTTPMiddlewareModule();\n        this.uiHttpClientRegistered = false;\n    }\n\n    // ----------------------------------------------------\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug('Starting http server...');\n\n        // Every request helper deriving proxy-dependent request facts\n        // (getRequestIP, hostname, protocol) resolves the trust contract from\n        // the app options — call sites must NOT pass their own `trustProxy`.\n        let router : App;\n        try {\n            router = new App({ options: { trustProxy: config.trustProxy } });\n        } catch (e) {\n            // proxy-addr compiles the allowlist form inside the App\n            // constructor; its error (\"invalid IP address: …\") does not name\n            // the offending config key — attribute it.\n            throw new AuthupError(\n                `Invalid trustProxy (TRUST_PROXY) configuration: ${e instanceof Error ? e.message : String(e)}`,\n            );\n        }\n\n        // Before any route is mounted: a substituted console package that\n        // no longer fulfills its contract must stop the boot, not surface\n        // as a confusing per-request failure on /authorize.\n        await bindConsolePackages({\n            authConsolePath: config.authConsolePath,\n            accountConsolePath: config.accountConsolePath,\n        });\n\n        this.registerUIHttpClient(container);\n        this.registerMetrics(container);\n\n        await this.middleware.mountBefore(router, container);\n        await this.controller.mount(router, container);\n        await this.middleware.mountAfter(router, container);\n\n        const server = serve(router, {\n            port: config.port,\n            hostname: config.host,\n            silent: true,\n            // Shutdown is driven by the orkos teardown chain (see cli/commands/start.ts);\n            // srvx's plugin would only close the HTTP server, leaving DB / cache / etc. open.\n            gracefulShutdown: false,\n        });\n\n        await server.ready();\n\n        this.instance = server;\n\n        if (server.url) {\n            logger.debug(`Listening on ${server.url}`);\n        }\n\n        container.register(HTTPInjectionKey.Server, { useValue: server });\n\n        logger.debug('Started http server.');\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * Default HTTP client for the SSR'd UI pages: dispatches against the\n     * server's own listen address instead of round-tripping through the\n     * reverse proxy at `publicUrl` (see `createInternalUIHttpClient`).\n     * Skipped when the token is already bound (test injection wins).\n     * Transient lifetime is mandatory — client-web-kit's authentication\n     * hook writes per-user Authorization state onto the client.\n     */\n    protected registerUIHttpClient(container: IContainer): void {\n        if (container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        container.register(HTTPInjectionKey.UIHttpClient, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n\n                // The server token is registered after listen; a resolve can\n                // only happen on a request, so it is present by then. The\n                // guards keep an edge case on the previous (public URL)\n                // dispatch behavior instead of failing the render.\n                const server = c.has(HTTPInjectionKey.Server) ?\n                    c.resolve(HTTPInjectionKey.Server) :\n                    undefined;\n\n                if (server && server.url) {\n                    return createInternalUIHttpClient({\n                        publicURL: config.publicUrl,\n                        internalURL: server.url,\n                    });\n                }\n\n                return new Client({ baseURL: config.publicUrl });\n            },\n        }, { lifetime: 'transient' });\n\n        this.uiHttpClientRegistered = true;\n    }\n\n    /**\n     * Auth-flow metric counters for the emit points (plan 058 Part 2).\n     * Registered before the controllers are built — the factories resolve the\n     * token. Prometheus-backed iff the prometheus middleware is enabled\n     * (mirrors HTTPMiddlewareModule.isEnabled: boolean|object, false = off),\n     * otherwise a noop so emit sites never need a guard beyond `?.`.\n     */\n    protected registerMetrics(container: IContainer): void {\n        const config = container.resolve(ConfigInjectionKey);\n\n        const enabled = typeof config.middlewarePrometheus !== 'boolean' ||\n            config.middlewarePrometheus === true;\n\n        container.register(MetricsInjectionKey, {\n            useValue: enabled ?\n                new PromAuthFlowMetrics() :\n                new NoopAuthFlowMetrics(),\n        });\n    }\n\n    // ----------------------------------------------------\n\n    async teardown(container: IContainer): Promise<void> {\n        if (this.uiHttpClientRegistered) {\n            container.unregister(HTTPInjectionKey.UIHttpClient);\n            this.uiHttpClientRegistered = false;\n        }\n\n        container.unregister(MetricsInjectionKey);\n\n        await this.middleware.teardown();\n\n        if (!this.instance) return;\n\n        container.unregister(HTTPInjectionKey.Server);\n\n        await this.instance.close();\n        this.instance = undefined;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAae,aAAb,MAAaA;CACAC;CAEAC;CAECC;CAEAC;CAEAC;CAEAC;CAEV,cAAc;EACV,KAAKL,OAAOR,WAAWc;EACvB,KAAKL,eAAe;GAACT,WAAWe;GAAQf,WAAWgB;GAAQhB,WAAWiB;GAAgBjB,WAAWkB;GAAUlB,WAAWmB;EAAO;EAC7H,KAAKP,aAAa,IAAIR,qBAAAA;EACtB,KAAKO,aAAa,IAAIN,qBAAAA;EACtB,KAAKQ,yBAAyB;CAClC;CAIA,MAAMO,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EACjC,MAAM4B,SAASH,UAAUE,QAAQjB,kBAAAA;EAEjCkB,OAAOC,MAAM,yBAAA;EAKb,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIhC,IAAI,EAAEiC,SAAS,EAAEC,YAAYN,OAAOM,WAAW,EAAE,CAAA;EAClE,SAASC,GAAG;GAIR,MAAM,IAAIpC,YACN,mDAAmDoC,aAAaC,QAAQD,EAAEE,UAAUC,OAAOH,CAAAA,GAAI;EAEvG;EAKA,MAAMhC,oBAAoB;GACtBoC,iBAAiBX,OAAOW;GACxBC,oBAAoBZ,OAAOY;EAC/B,CAAA;EAEA,KAAKC,qBAAqBd,SAAAA;EAC1B,KAAKe,gBAAgBf,SAAAA;EAErB,MAAM,KAAKV,WAAW0B,YAAYX,QAAQL,SAAAA;EAC1C,MAAM,KAAKT,WAAW0B,MAAMZ,QAAQL,SAAAA;EACpC,MAAM,KAAKV,WAAW4B,WAAWb,QAAQL,SAAAA;EAEzC,MAAMmB,SAAS7C,MAAM+B,QAAQ;GACzBe,MAAMnB,OAAOmB;GACbC,UAAUpB,OAAOqB;GACjBC,QAAQ;GAGRC,kBAAkB;EACtB,CAAA;EAEA,MAAML,OAAOM,MAAK;EAElB,KAAKpC,WAAW8B;EAEhB,IAAIA,OAAOO,KACPvB,OAAOC,MAAM,gBAAgBe,OAAOO,KAAK;EAG7C1B,UAAU2B,SAAS/C,iBAAiBgD,QAAQ,EAAEC,UAAUV,OAAO,CAAA;EAE/DhB,OAAOC,MAAM,sBAAA;CACjB;;;;;;;;IAYA,qBAA+BJ,WAA6B;EACxD,IAAIA,UAAU8B,IAAIlD,iBAAiBmD,YAAY,GAC3C;EAGJ/B,UAAU2B,SAAS/C,iBAAiBmD,cAAc,EAC9CC,aAAaC,MAAAA;GACT,MAAMhC,SAASgC,EAAE/B,QAAQ3B,kBAAAA;GAMzB,MAAM4C,SAASc,EAAEH,IAAIlD,iBAAiBgD,MAAM,IACxCK,EAAE/B,QAAQtB,iBAAiBgD,MAAM,IACjCM,KAAAA;GAEJ,IAAIf,UAAUA,OAAOO,KACjB,OAAOjD,2BAA2B;IAC9B0D,WAAWlC,OAAOmC;IAClBC,aAAalB,OAAOO;GACxB,CAAA;GAGJ,OAAO,IAAIvD,OAAO,EAAEmE,SAASrC,OAAOmC,UAAU,CAAA;EAClD,EACJ,GAAG,EAAEG,UAAU,YAAY,CAAA;EAE3B,KAAK/C,yBAAyB;CAClC;;;;;;;IASA,gBAA0BQ,WAA6B;EACnD,MAAMC,SAASD,UAAUE,QAAQ3B,kBAAAA;EAEjC,MAAMiE,UAAU,OAAOvC,OAAOwC,yBAAyB,aACnDxC,OAAOwC,yBAAyB;EAEpCzC,UAAU2B,SAAS9C,qBAAqB,EACpCgD,UAAUW,UACN,IAAI1D,oBAAAA,IACJ,IAAIJ,oBAAAA,EACZ,CAAA;CACJ;CAIA,MAAMgE,SAAS1C,WAAsC;EACjD,IAAI,KAAKR,wBAAwB;GAC7BQ,UAAU2C,WAAW/D,iBAAiBmD,YAAY;GAClD,KAAKvC,yBAAyB;EAClC;EAEAQ,UAAU2C,WAAW9D,mBAAAA;EAErB,MAAM,KAAKS,WAAWoD,SAAQ;EAE9B,IAAI,CAAC,KAAKrD,UAAU;EAEpBW,UAAU2C,WAAW/D,iBAAiBgD,MAAM;EAE5C,MAAM,KAAKvC,SAASuD,MAAK;EACzB,KAAKvD,WAAW6C,KAAAA;CACpB;AACJ"}