@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/app/modules/http/modules/middleware.mjs

@@ -36,11 +36,12 @@ import "../../oauth2/index.mjs";
 import path from "node:path";
 //#region src/app/modules/http/modules/middleware.ts
 var HTTPMiddlewareModule = class {
+	viteServer;
 	async mountBefore(router, container) {
 		await this.mountPrometheus(router, container);
 		await this.mountLogger(router, container);
 		await this.mountCors(router, container);
-		await this.mountAssets(router);
+		await this.mountAssets(router, container);
 		await this.mountUIHttpClient(router, container);
 		await this.mountBasic(router);
 		await this.mountRateLimit(router, container);
@@ -66,8 +67,22 @@ var HTTPMiddlewareModule = class {
 		});
 		router.use(middleware);
 	}
-	async mountAssets(router) {
-		await registerAssetsMiddleware(router);
+	async mountAssets(router, container) {
+		const config = container.resolve(ConfigInjectionKey);
+		this.viteServer = await registerAssetsMiddleware(router, {
+			themeDirectoryPath: config.themeDirectoryPath,
+			themeFragmentsEnabled: config.themeFragmentsEnabled,
+			logger: container.resolve(LoggerInjectionKey)
+		});
+	}
+	/**
+	* Release what the mounted middlewares own beyond the http listener. Only
+	* the JIT vite dev server qualifies: it keeps a file watcher and an HMR
+	* websocket alive, which would survive every setup/teardown cycle.
+	*/ async teardown() {
+		if (!this.viteServer) return;
+		await this.viteServer.close();
+		this.viteServer = void 0;
 	}
 	async mountUIHttpClient(router, container) {
 		if (!container.has(HTTPInjectionKey.UIHttpClient)) return;

package/dist/app/modules/http/modules/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":["path","createAuthorizationMiddleware","createLoggerMiddleware","createRealmResolverMiddleware","createRequestEventContextMiddleware","createSwaggerMiddleware","registerAssetsMiddleware","registerBasicMiddleware","registerCorsMiddleware","registerErrorMiddleware","registerPrometheusMiddleware","registerRateLimitMiddleware","registerUIHttpClientMiddleware","HTTPInjectionKey","DIST_PATH","AuthenticationInjectionKey","ConfigInjectionKey","LoggerInjectionKey","IdentityInjectionKey","OAuth2InjectionToken","RealmEntity","RealmRepositoryAdapter","DatabaseInjectionKey","PermissionDatabaseProvider","HTTPMiddlewareModule","mountBefore","router","container","mountPrometheus","mountLogger","mountCors","mountAssets","mountUIHttpClient","mountBasic","mountRateLimit","mountSwagger","mountAuthorization","mountRequestEventContext","mountRealmResolver","mountAfter","logger","resolve","config","isEnabled","middlewareCors","options","transformBoolToEmptyObject","middleware","env","use","has","UIHttpClient","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","documentPath","join","baseURL","publicUrl","realmRepository","dataSource","DataSource","identityResolver","Resolver","sessionManager","SessionManager","oauth2TokenVerifier","TokenVerifier","identityPermissionProvider","PermissionProvider","permissionProvider","clientAuthBasic","userAuthBasic","certificateSource","input"],"sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport path from 'node:path';\nimport type { IContainer } from 'eldin';\nimport type { Repository } from 'typeorm';\nimport type { Realm } from '@authup/core-kit';\nimport {\n    createAuthorizationMiddleware,\n    createLoggerMiddleware,\n    createRealmResolverMiddleware,\n    createRequestEventContextMiddleware,\n    createSwaggerMiddleware,\n    registerAssetsMiddleware,\n    registerBasicMiddleware,\n    registerCorsMiddleware,\n    registerErrorMiddleware,\n    registerPrometheusMiddleware,\n    registerRateLimitMiddleware,\n    registerUIHttpClientMiddleware,\n} from '../../../../adapters/http/index.ts';\nimport { HTTPInjectionKey } from '../constants.ts';\nimport { DIST_PATH } from '../../../../path.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { ConfigInjectionKey } from '../../config/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { RealmEntity } from '../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../../database/repositories/index.ts';\nimport {\n    DatabaseInjectionKey,\n    PermissionDatabaseProvider,\n} from '../../database/index.ts';\n\nexport class HTTPMiddlewareModule {\n    async mountBefore(router: App, container: IContainer): Promise<void> {\n        // @routup/prometheus must be installed before any other plugin or\n        // route so that its onion middleware can observe the full request\n        // lifecycle (the v3 README is explicit on this).\n        await this.mountPrometheus(router, container);\n        await this.mountLogger(router, container);\n        await this.mountCors(router, container);\n        await this.mountAssets(router);\n        await this.mountUIHttpClient(router, container);\n        await this.mountBasic(router);\n        await this.mountRateLimit(router, container);\n\n        await this.mountSwagger(router, container);\n        await this.mountAuthorization(router, container);\n        await this.mountRequestEventContext(router);\n        await this.mountRealmResolver(router, container);\n    }\n\n\n    async mountAfter(router: App, container: IContainer): Promise<void> {\n        registerErrorMiddleware(router, { logger: container.resolve(LoggerInjectionKey) });\n    }\n\n    // ----------------------------------------------------\n    async mountCors(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareCors)) {\n            return;\n        }\n\n        const options = this.transformBoolToEmptyObject(config.middlewareCors) ?? {};\n\n        registerCorsMiddleware(router, options);\n    }\n\n    async mountLogger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const middleware = createLoggerMiddleware({\n            env: config.env,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        router.use(middleware);\n    }\n\n    async mountAssets(router: App): Promise<void> {\n        await registerAssetsMiddleware(router);\n    }\n\n    async mountUIHttpClient(router: App, container: IContainer): Promise<void> {\n        if (!container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        registerUIHttpClientMiddleware(router, () => container.resolve(HTTPInjectionKey.UIHttpClient));\n    }\n\n    async mountBasic(router: App): Promise<void> {\n        registerBasicMiddleware(router);\n    }\n\n    async mountPrometheus(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewarePrometheus)) {\n            return;\n        }\n\n        registerPrometheusMiddleware(router, this.transformBoolToEmptyObject(config.middlewarePrometheus));\n    }\n\n    async mountRateLimit(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareRateLimit)) {\n            return;\n        }\n\n        registerRateLimitMiddleware(router, this.transformBoolToEmptyObject(config.middlewareRateLimit));\n    }\n\n    async mountSwagger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        if (!this.isEnabled(config.middlewareSwagger)) {\n            return;\n        }\n\n        const middleware = createSwaggerMiddleware({\n            documentPath: path.join(DIST_PATH, 'swagger.json'),\n            baseURL: config.publicUrl,\n        });\n\n        router.use('/docs', middleware);\n    }\n\n    async mountRealmResolver(router: App, container: IContainer): Promise<void> {\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const middleware = createRealmResolverMiddleware({ realmRepository: new RealmRepositoryAdapter(realmRepository) });\n\n        // Mounted at /realms/:realmId/:nested so the middleware only fires on\n        // nested-resource URLs (e.g. /realms/master/users/...). Bare\n        // /realms/:id routes belong to RealmController (CRUD, openid-config,\n        // jwks) and would otherwise 404 on PUT upserts where the realm\n        // doesn't exist yet.\n        router.use('/realms/:realmId/:nested', middleware);\n    }\n\n    async mountAuthorization(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n        const oauth2TokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n        const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n        const middleware = createAuthorizationMiddleware({\n            identityResolver,\n            identityPermissionProvider,\n            permissionProvider,\n            oauth2TokenVerifier,\n            sessionManager,\n            options: {\n                clientAuthBasic: config.clientAuthBasic,\n                userAuthBasic: config.userAuthBasic,\n                certificateSource: config.certificateSource,\n            },\n        });\n\n        router.use(middleware);\n    }\n\n    async mountRequestEventContext(router: App): Promise<void> {\n        // mounted immediately AFTER the authorization middleware — the\n        // identity must already be resolved for actor attribution.\n        router.use(createRequestEventContextMiddleware());\n    }\n\n    // ----------------------------------------------------\n\n    private transformBoolToEmptyObject<T extends Record<string, any>>(\n        input?: T | boolean,\n    ) : T | undefined {\n        if (typeof input === 'boolean') {\n            return {} as T;\n        }\n\n        return input || {} as T;\n    }\n\n    private isEnabled<T>(input: T | boolean) {\n        return typeof input !== 'boolean' || input === true;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,IAAawB,uBAAb,MAAaA;CACT,MAAMC,YAAYC,QAAaC,WAAsC;EAIjE,MAAM,KAAKC,gBAAgBF,QAAQC,SAAAA;EACnC,MAAM,KAAKE,YAAYH,QAAQC,SAAAA;EAC/B,MAAM,KAAKG,UAAUJ,QAAQC,SAAAA;EAC7B,MAAM,KAAKI,YAAYL,MAAAA;EACvB,MAAM,KAAKM,kBAAkBN,QAAQC,SAAAA;EACrC,MAAM,KAAKM,WAAWP,MAAAA;EACtB,MAAM,KAAKQ,eAAeR,QAAQC,SAAAA;EAElC,MAAM,KAAKQ,aAAaT,QAAQC,SAAAA;EAChC,MAAM,KAAKS,mBAAmBV,QAAQC,SAAAA;EACtC,MAAM,KAAKU,yBAAyBX,MAAAA;EACpC,MAAM,KAAKY,mBAAmBZ,QAAQC,SAAAA;CAC1C;CAGA,MAAMY,WAAWb,QAAaC,WAAsC;EAChElB,wBAAwBiB,QAAQ,EAAEc,QAAQb,UAAUc,QAAQxB,kBAAAA,EAAoB,CAAA;CACpF;CAGA,MAAMa,UAAUJ,QAAaC,WAAsC;EAC/D,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOE,cAAc,GACrC;EAGJ,MAAMC,UAAU,KAAKC,2BAA2BJ,OAAOE,cAAc,KAAK,CAAC;EAE3EpC,uBAAuBkB,QAAQmB,OAAAA;CACnC;CAEA,MAAMhB,YAAYH,QAAaC,WAAsC;EACjE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EACjC,MAAM+B,aAAa7C,uBAAuB;GACtC8C,KAAKN,OAAOM;GACZR,QAAQb,UAAUc,QAAQxB,kBAAAA;EAC9B,CAAA;EAEAS,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMhB,YAAYL,QAA4B;EAC1C,MAAMpB,yBAAyBoB,MAAAA;CACnC;CAEA,MAAMM,kBAAkBN,QAAaC,WAAsC;EACvE,IAAI,CAACA,UAAUuB,IAAIrC,iBAAiBsC,YAAY,GAC5C;EAGJvC,+BAA+Bc,cAAcC,UAAUc,QAAQ5B,iBAAiBsC,YAAY,CAAA;CAChG;CAEA,MAAMlB,WAAWP,QAA4B;EACzCnB,wBAAwBmB,MAAAA;CAC5B;CAEA,MAAME,gBAAgBF,QAAaC,WAAsC;EACrE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOU,oBAAoB,GAC3C;EAGJ1C,6BAA6BgB,QAAQ,KAAKoB,2BAA2BJ,OAAOU,oBAAoB,CAAA;CACpG;CAEA,MAAMlB,eAAeR,QAAaC,WAAsC;EACpE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EAEjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOW,mBAAmB,GAC1C;EAGJ1C,4BAA4Be,QAAQ,KAAKoB,2BAA2BJ,OAAOW,mBAAmB,CAAA;CAClG;CAEA,MAAMlB,aAAaT,QAAaC,WAAsC;EAClE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EACjC,IAAI,CAAC,KAAK2B,UAAUD,OAAOY,iBAAiB,GACxC;EAGJ,MAAMP,aAAa1C,wBAAwB;GACvCkD,cAAcvD,KAAKwD,KAAK1C,WAAW,cAAA;GACnC2C,SAASf,OAAOgB;EACpB,CAAA;EAEAhC,OAAOuB,IAAI,SAASF,UAAAA;CACxB;CAEA,MAAMT,mBAAmBZ,QAAaC,WAAsC;EACxE,MAAMgC,kBAAkBhC,UAAUc,QAA2BrB,WAAAA;EAC7D,MAAM2B,aAAa5C,8BAA8B,EAAEwD,iBAAiB,IAAItC,uBAAuBsC,eAAAA,EAAiB,CAAA;EAOhHjC,OAAOuB,IAAI,4BAA4BF,UAAAA;CAC3C;CAEA,MAAMX,mBAAmBV,QAAaC,WAAsC;EACxE,MAAMe,SAASf,UAAUc,QAAQzB,kBAAAA;EACjC,MAAM4C,aAAajC,UAAUc,QAAQnB,qBAAqBuC,UAAU;EAEpE,MAAMC,mBAAmBnC,UAAUc,QAAQvB,qBAAqB6C,QAAQ;EACxE,MAAMC,iBAAiBrC,UAAUc,QAAQ1B,2BAA2BkD,cAAc;EAClF,MAAMC,sBAAsBvC,UAAUc,QAAQtB,qBAAqBgD,aAAa;EAChF,MAAMC,6BAA6BzC,UAAUc,QAAQvB,qBAAqBmD,kBAAkB;EAE5F,MAAMC,qBAAqB,IAAI/C,2BAA2BqC,UAAAA;EAE1D,MAAMb,aAAa9C,8BAA8B;GAC7C6D;GACAM;GACAE;GACAJ;GACAF;GACAnB,SAAS;IACL0B,iBAAiB7B,OAAO6B;IACxBC,eAAe9B,OAAO8B;IACtBC,mBAAmB/B,OAAO+B;GAC9B;EACJ,CAAA;EAEA/C,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMV,yBAAyBX,QAA4B;EAGvDA,OAAOuB,IAAI7C,oCAAAA,CAAAA;CACf;CAIQ0C,2BACJ4B,OACc;EACd,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;EAGZ,OAAOA,SAAS,CAAC;CACrB;CAEQ/B,UAAa+B,OAAoB;EACrC,OAAO,OAAOA,UAAU,aAAaA,UAAU;CACnD;AACJ"}
+{"version":3,"file":"middleware.mjs","names":["path","createAuthorizationMiddleware","createLoggerMiddleware","createRealmResolverMiddleware","createRequestEventContextMiddleware","createSwaggerMiddleware","registerAssetsMiddleware","registerBasicMiddleware","registerCorsMiddleware","registerErrorMiddleware","registerPrometheusMiddleware","registerRateLimitMiddleware","registerUIHttpClientMiddleware","HTTPInjectionKey","DIST_PATH","AuthenticationInjectionKey","ConfigInjectionKey","LoggerInjectionKey","IdentityInjectionKey","OAuth2InjectionToken","RealmEntity","RealmRepositoryAdapter","DatabaseInjectionKey","PermissionDatabaseProvider","HTTPMiddlewareModule","viteServer","mountBefore","router","container","mountPrometheus","mountLogger","mountCors","mountAssets","mountUIHttpClient","mountBasic","mountRateLimit","mountSwagger","mountAuthorization","mountRequestEventContext","mountRealmResolver","mountAfter","logger","resolve","config","isEnabled","middlewareCors","options","transformBoolToEmptyObject","middleware","env","use","themeDirectoryPath","themeFragmentsEnabled","teardown","close","undefined","has","UIHttpClient","middlewarePrometheus","middlewareRateLimit","middlewareSwagger","documentPath","join","baseURL","publicUrl","realmRepository","dataSource","DataSource","identityResolver","Resolver","sessionManager","SessionManager","oauth2TokenVerifier","TokenVerifier","identityPermissionProvider","PermissionProvider","permissionProvider","clientAuthBasic","userAuthBasic","certificateSource","input"],"sources":["../../../../../src/app/modules/http/modules/middleware.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport path from 'node:path';\nimport type { IContainer } from 'eldin';\nimport type { ViteDevServer } from 'vite';\nimport type { Repository } from 'typeorm';\nimport type { Realm } from '@authup/core-kit';\nimport {\n    createAuthorizationMiddleware,\n    createLoggerMiddleware,\n    createRealmResolverMiddleware,\n    createRequestEventContextMiddleware,\n    createSwaggerMiddleware,\n    registerAssetsMiddleware,\n    registerBasicMiddleware,\n    registerCorsMiddleware,\n    registerErrorMiddleware,\n    registerPrometheusMiddleware,\n    registerRateLimitMiddleware,\n    registerUIHttpClientMiddleware,\n} from '../../../../adapters/http/index.ts';\nimport { HTTPInjectionKey } from '../constants.ts';\nimport { DIST_PATH } from '../../../../path.ts';\nimport { AuthenticationInjectionKey } from '../../authentication/index.ts';\nimport { ConfigInjectionKey } from '../../config/index.ts';\nimport { LoggerInjectionKey } from '../../logger/index.ts';\nimport { IdentityInjectionKey } from '../../identity/index.ts';\nimport { OAuth2InjectionToken } from '../../oauth2/index.ts';\nimport { RealmEntity } from '../../../../adapters/database/domains/index.ts';\nimport { RealmRepositoryAdapter } from '../../database/repositories/index.ts';\nimport {\n    DatabaseInjectionKey,\n    PermissionDatabaseProvider,\n} from '../../database/index.ts';\n\nexport class HTTPMiddlewareModule {\n    protected viteServer : ViteDevServer | undefined;\n\n    async mountBefore(router: App, container: IContainer): Promise<void> {\n        // @routup/prometheus must be installed before any other plugin or\n        // route so that its onion middleware can observe the full request\n        // lifecycle (the v3 README is explicit on this).\n        await this.mountPrometheus(router, container);\n        await this.mountLogger(router, container);\n        await this.mountCors(router, container);\n        await this.mountAssets(router, container);\n        await this.mountUIHttpClient(router, container);\n        await this.mountBasic(router);\n        await this.mountRateLimit(router, container);\n\n        await this.mountSwagger(router, container);\n        await this.mountAuthorization(router, container);\n        await this.mountRequestEventContext(router);\n        await this.mountRealmResolver(router, container);\n    }\n\n\n    async mountAfter(router: App, container: IContainer): Promise<void> {\n        registerErrorMiddleware(router, { logger: container.resolve(LoggerInjectionKey) });\n    }\n\n    // ----------------------------------------------------\n    async mountCors(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareCors)) {\n            return;\n        }\n\n        const options = this.transformBoolToEmptyObject(config.middlewareCors) ?? {};\n\n        registerCorsMiddleware(router, options);\n    }\n\n    async mountLogger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const middleware = createLoggerMiddleware({\n            env: config.env,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        router.use(middleware);\n    }\n\n    async mountAssets(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        // Config is resolved HERE, in the app-module layer, and the value is\n        // passed down: adapters/http/ui/** must not read config itself.\n        this.viteServer = await registerAssetsMiddleware(router, {\n            themeDirectoryPath: config.themeDirectoryPath,\n            themeFragmentsEnabled: config.themeFragmentsEnabled,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n    }\n\n    /**\n     * Release what the mounted middlewares own beyond the http listener. Only\n     * the JIT vite dev server qualifies: it keeps a file watcher and an HMR\n     * websocket alive, which would survive every setup/teardown cycle.\n     */\n    async teardown(): Promise<void> {\n        if (!this.viteServer) {\n            return;\n        }\n\n        await this.viteServer.close();\n        this.viteServer = undefined;\n    }\n\n    async mountUIHttpClient(router: App, container: IContainer): Promise<void> {\n        if (!container.has(HTTPInjectionKey.UIHttpClient)) {\n            return;\n        }\n\n        registerUIHttpClientMiddleware(router, () => container.resolve(HTTPInjectionKey.UIHttpClient));\n    }\n\n    async mountBasic(router: App): Promise<void> {\n        registerBasicMiddleware(router);\n    }\n\n    async mountPrometheus(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewarePrometheus)) {\n            return;\n        }\n\n        registerPrometheusMiddleware(router, this.transformBoolToEmptyObject(config.middlewarePrometheus));\n    }\n\n    async mountRateLimit(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        if (!this.isEnabled(config.middlewareRateLimit)) {\n            return;\n        }\n\n        registerRateLimitMiddleware(router, this.transformBoolToEmptyObject(config.middlewareRateLimit));\n    }\n\n    async mountSwagger(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        if (!this.isEnabled(config.middlewareSwagger)) {\n            return;\n        }\n\n        const middleware = createSwaggerMiddleware({\n            documentPath: path.join(DIST_PATH, 'swagger.json'),\n            baseURL: config.publicUrl,\n        });\n\n        router.use('/docs', middleware);\n    }\n\n    async mountRealmResolver(router: App, container: IContainer): Promise<void> {\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n        const middleware = createRealmResolverMiddleware({ realmRepository: new RealmRepositoryAdapter(realmRepository) });\n\n        // Mounted at /realms/:realmId/:nested so the middleware only fires on\n        // nested-resource URLs (e.g. /realms/master/users/...). Bare\n        // /realms/:id routes belong to RealmController (CRUD, openid-config,\n        // jwks) and would otherwise 404 on PUT upserts where the realm\n        // doesn't exist yet.\n        router.use('/realms/:realmId/:nested', middleware);\n    }\n\n    async mountAuthorization(router: App, container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n\n        const identityResolver = container.resolve(IdentityInjectionKey.Resolver);\n        const sessionManager = container.resolve(AuthenticationInjectionKey.SessionManager);\n        const oauth2TokenVerifier = container.resolve(OAuth2InjectionToken.TokenVerifier);\n        const identityPermissionProvider = container.resolve(IdentityInjectionKey.PermissionProvider);\n\n        const permissionProvider = new PermissionDatabaseProvider(dataSource);\n\n        const middleware = createAuthorizationMiddleware({\n            identityResolver,\n            identityPermissionProvider,\n            permissionProvider,\n            oauth2TokenVerifier,\n            sessionManager,\n            options: {\n                clientAuthBasic: config.clientAuthBasic,\n                userAuthBasic: config.userAuthBasic,\n                certificateSource: config.certificateSource,\n            },\n        });\n\n        router.use(middleware);\n    }\n\n    async mountRequestEventContext(router: App): Promise<void> {\n        // mounted immediately AFTER the authorization middleware — the\n        // identity must already be resolved for actor attribution.\n        router.use(createRequestEventContextMiddleware());\n    }\n\n    // ----------------------------------------------------\n\n    private transformBoolToEmptyObject<T extends Record<string, any>>(\n        input?: T | boolean,\n    ) : T | undefined {\n        if (typeof input === 'boolean') {\n            return {} as T;\n        }\n\n        return input || {} as T;\n    }\n\n    private isEnabled<T>(input: T | boolean) {\n        return typeof input !== 'boolean' || input === true;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAawB,uBAAb,MAAaA;CACCC;CAEV,MAAMC,YAAYC,QAAaC,WAAsC;EAIjE,MAAM,KAAKC,gBAAgBF,QAAQC,SAAAA;EACnC,MAAM,KAAKE,YAAYH,QAAQC,SAAAA;EAC/B,MAAM,KAAKG,UAAUJ,QAAQC,SAAAA;EAC7B,MAAM,KAAKI,YAAYL,QAAQC,SAAAA;EAC/B,MAAM,KAAKK,kBAAkBN,QAAQC,SAAAA;EACrC,MAAM,KAAKM,WAAWP,MAAAA;EACtB,MAAM,KAAKQ,eAAeR,QAAQC,SAAAA;EAElC,MAAM,KAAKQ,aAAaT,QAAQC,SAAAA;EAChC,MAAM,KAAKS,mBAAmBV,QAAQC,SAAAA;EACtC,MAAM,KAAKU,yBAAyBX,MAAAA;EACpC,MAAM,KAAKY,mBAAmBZ,QAAQC,SAAAA;CAC1C;CAGA,MAAMY,WAAWb,QAAaC,WAAsC;EAChEnB,wBAAwBkB,QAAQ,EAAEc,QAAQb,UAAUc,QAAQzB,kBAAAA,EAAoB,CAAA;CACpF;CAGA,MAAMc,UAAUJ,QAAaC,WAAsC;EAC/D,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAEjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOE,cAAc,GACrC;EAGJ,MAAMC,UAAU,KAAKC,2BAA2BJ,OAAOE,cAAc,KAAK,CAAC;EAE3ErC,uBAAuBmB,QAAQmB,OAAAA;CACnC;CAEA,MAAMhB,YAAYH,QAAaC,WAAsC;EACjE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EACjC,MAAMgC,aAAa9C,uBAAuB;GACtC+C,KAAKN,OAAOM;GACZR,QAAQb,UAAUc,QAAQzB,kBAAAA;EAC9B,CAAA;EAEAU,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMhB,YAAYL,QAAaC,WAAsC;EACjE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAIjC,KAAKS,aAAa,MAAMnB,yBAAyBqB,QAAQ;GACrDwB,oBAAoBR,OAAOQ;GAC3BC,uBAAuBT,OAAOS;GAC9BX,QAAQb,UAAUc,QAAQzB,kBAAAA;EAC9B,CAAA;CACJ;;;;;IAOA,MAAMoC,WAA0B;EAC5B,IAAI,CAAC,KAAK5B,YACN;EAGJ,MAAM,KAAKA,WAAW6B,MAAK;EAC3B,KAAK7B,aAAa8B,KAAAA;CACtB;CAEA,MAAMtB,kBAAkBN,QAAaC,WAAsC;EACvE,IAAI,CAACA,UAAU4B,IAAI3C,iBAAiB4C,YAAY,GAC5C;EAGJ7C,+BAA+Be,cAAcC,UAAUc,QAAQ7B,iBAAiB4C,YAAY,CAAA;CAChG;CAEA,MAAMvB,WAAWP,QAA4B;EACzCpB,wBAAwBoB,MAAAA;CAC5B;CAEA,MAAME,gBAAgBF,QAAaC,WAAsC;EACrE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAEjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOe,oBAAoB,GAC3C;EAGJhD,6BAA6BiB,QAAQ,KAAKoB,2BAA2BJ,OAAOe,oBAAoB,CAAA;CACpG;CAEA,MAAMvB,eAAeR,QAAaC,WAAsC;EACpE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EAEjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOgB,mBAAmB,GAC1C;EAGJhD,4BAA4BgB,QAAQ,KAAKoB,2BAA2BJ,OAAOgB,mBAAmB,CAAA;CAClG;CAEA,MAAMvB,aAAaT,QAAaC,WAAsC;EAClE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EACjC,IAAI,CAAC,KAAK4B,UAAUD,OAAOiB,iBAAiB,GACxC;EAGJ,MAAMZ,aAAa3C,wBAAwB;GACvCwD,cAAc7D,KAAK8D,KAAKhD,WAAW,cAAA;GACnCiD,SAASpB,OAAOqB;EACpB,CAAA;EAEArC,OAAOuB,IAAI,SAASF,UAAAA;CACxB;CAEA,MAAMT,mBAAmBZ,QAAaC,WAAsC;EACxE,MAAMqC,kBAAkBrC,UAAUc,QAA2BtB,WAAAA;EAC7D,MAAM4B,aAAa7C,8BAA8B,EAAE8D,iBAAiB,IAAI5C,uBAAuB4C,eAAAA,EAAiB,CAAA;EAOhHtC,OAAOuB,IAAI,4BAA4BF,UAAAA;CAC3C;CAEA,MAAMX,mBAAmBV,QAAaC,WAAsC;EACxE,MAAMe,SAASf,UAAUc,QAAQ1B,kBAAAA;EACjC,MAAMkD,aAAatC,UAAUc,QAAQpB,qBAAqB6C,UAAU;EAEpE,MAAMC,mBAAmBxC,UAAUc,QAAQxB,qBAAqBmD,QAAQ;EACxE,MAAMC,iBAAiB1C,UAAUc,QAAQ3B,2BAA2BwD,cAAc;EAClF,MAAMC,sBAAsB5C,UAAUc,QAAQvB,qBAAqBsD,aAAa;EAChF,MAAMC,6BAA6B9C,UAAUc,QAAQxB,qBAAqByD,kBAAkB;EAE5F,MAAMC,qBAAqB,IAAIrD,2BAA2B2C,UAAAA;EAE1D,MAAMlB,aAAa/C,8BAA8B;GAC7CmE;GACAM;GACAE;GACAJ;GACAF;GACAxB,SAAS;IACL+B,iBAAiBlC,OAAOkC;IACxBC,eAAenC,OAAOmC;IACtBC,mBAAmBpC,OAAOoC;GAC9B;EACJ,CAAA;EAEApD,OAAOuB,IAAIF,UAAAA;CACf;CAEA,MAAMV,yBAAyBX,QAA4B;EAGvDA,OAAOuB,IAAI9C,oCAAAA,CAAAA;CACf;CAIQ2C,2BACJiC,OACc;EACd,IAAI,OAAOA,UAAU,WACjB,OAAO,CAAC;EAGZ,OAAOA,SAAS,CAAC;CACrB;CAEQpC,UAAaoC,OAAoB;EACrC,OAAO,OAAOA,UAAU,aAAaA,UAAU;CACnD;AACJ"}

package/dist/app/modules/identity/index.mjs

@@ -2,7 +2,6 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { IdentityInjectionKey } from "./constants.mjs";
-import { IdentityProviderAccountRepository } from "./repositories/provider/account/module.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./repositories/provider/mapper/role.mjs";
@@ -10,4 +9,4 @@ import { ClientIdentityRepository } from "./repositories/client.mjs";
 import { UserIdentityRepository } from "./repositories/user.mjs";
 import "./repositories/index.mjs";
 import { IdentityModule } from "./module.mjs";
-export { ClientIdentityRepository, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRoleMappingRepository, UserIdentityRepository };
+export { ClientIdentityRepository, IdentityInjectionKey, IdentityModule, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRoleMappingRepository, UserIdentityRepository };

package/dist/app/modules/identity/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/identity/module.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAaxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAwFpD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/identity/module.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAaxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,qBAAa,cAAe,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAwFpD"}

package/dist/app/modules/identity/module.mjs

@@ -21,13 +21,13 @@ import "../../../core/index.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ClientRepositoryAdapter } from "../database/repositories/client/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "../database/repositories/identity-provider/repository.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "../database/repositories/identity-provider-account/repository.mjs";
 import { RoleRepositoryAdapter } from "../database/repositories/role/repository.mjs";
 import { UserRepositoryAdapter } from "../database/repositories/user/repository.mjs";
 import "../database/repositories/index.mjs";
 import { DatabaseInjectionKey } from "../database/constants.mjs";
 import "../database/index.mjs";
 import { IdentityInjectionKey } from "./constants.mjs";
-import { IdentityProviderAccountRepository } from "./repositories/provider/account/module.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./repositories/provider/mapper/role.mjs";
@@ -85,7 +85,7 @@ var IdentityModule = class {
 		const roleMapper = new IdentityProviderRoleMapper(roleMapperFinder);
 		const permissionMapperRepository = new IdentityProviderPermissionMappingRepository(dataSource);
 		const permissionMapper = new IdentityProviderPermissionMapper(permissionMapperRepository);
-		const providerAccountRepository = new IdentityProviderAccountRepository(dataSource);
+		const providerAccountRepository = new IdentityProviderAccountRepositoryAdapter(dataSource);
 		container.register(IdentityInjectionKey.ProviderAccountManager, { useFactory: () => new IdentityProviderAccountManager({
 			repository: providerAccountRepository,
 			userRepository,

package/dist/app/modules/identity/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientIdentityRepository","IdentityProviderAccountRepository","IdentityProviderAttributeMappingRepository","IdentityProviderPermissionMappingRepository","IdentityProviderRoleMappingRepository","UserIdentityRepository","DatabaseInjectionKey","IdentityProviderRepositoryAdapter","ClientEntity","IdentityProviderRepository","RealmEntity","RoleEntity","UserPermissionEntity","UserRepository","UserRoleEntity","ClientRepositoryAdapter","RoleRepositoryAdapter","UserRepositoryAdapter","IdentityPermissionProvider","IdentityProviderAccountManager","IdentityProviderAttributeMapper","IdentityProviderLdapCollectionAuthenticator","IdentityProviderPermissionMapper","IdentityProviderRoleMapper","IdentityResolver","IdentityRoleProvider","LDAPInjectionKey","ModuleName","IdentityInjectionKey","IdentityModule","name","dependencies","IDENTITY","DATABASE","setup","container","dataSource","resolve","DataSource","realmRepository","clientRepository","userRepository","repository","userPermissionRepository","userRoleRepository","register","Resolver","useFactory","clientRepositoryAdapter","userRepositoryAdapter","roleRepositoryAdapter","RoleProvider","PermissionProvider","c","roleRepository","roleProvider","attributeMapperRepository","attributeMapper","roleMapperFinder","roleMapper","permissionMapperRepository","permissionMapper","providerAccountRepository","ProviderAccountManager","identityProviderRepository","ProviderLdapCollectionAuthenticator","accountManager","clientFactory","ClientFactory"],"sources":["../../../../src/app/modules/identity/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client,\n    Realm,\n    Role,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport {\n    ClientIdentityRepository,\n    IdentityProviderAccountRepository,\n    IdentityProviderAttributeMappingRepository,\n    IdentityProviderPermissionMappingRepository,\n    IdentityProviderRoleMappingRepository,\n    UserIdentityRepository,\n} from './repositories/index.ts';\nimport { DatabaseInjectionKey, IdentityProviderRepositoryAdapter } from '../database/index.ts';\nimport {\n    ClientEntity,\n    IdentityProviderRepository,\n    RealmEntity,\n    RoleEntity,\n    UserPermissionEntity,\n    UserRepository,\n    UserRoleEntity,\n} from '../../../adapters/database/domains/index.ts';\nimport {\n    ClientRepositoryAdapter,\n    RoleRepositoryAdapter,\n    UserRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    IdentityPermissionProvider,\n    IdentityProviderAccountManager,\n    IdentityProviderAttributeMapper,\n    IdentityProviderLdapCollectionAuthenticator,\n    IdentityProviderPermissionMapper,\n    IdentityProviderRoleMapper,\n    IdentityResolver,\n    IdentityRoleProvider,\n} from '../../../core/index.ts';\nimport { LDAPInjectionKey } from '../ldap/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { IdentityInjectionKey } from './constants.ts';\n\nexport class IdentityModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.IDENTITY;\n        this.dependencies = [ModuleName.DATABASE];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const clientRepository = new ClientIdentityRepository(\n            container.resolve<Repository<Client>>(ClientEntity),\n        );\n        const userRepository = new UserIdentityRepository({\n            repository: new UserRepository(dataSource),\n            userPermissionRepository: container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            userRoleRepository: container.resolve<Repository<UserRole>>(UserRoleEntity),\n        });\n\n        container.register(IdentityInjectionKey.Resolver, {\n            useFactory: () => new IdentityResolver({\n                clientRepository,\n                userRepository,\n            }),\n        });\n\n        // ---------------------------------------------\n\n        const clientRepositoryAdapter = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const userRepositoryAdapter = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const roleRepositoryAdapter = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n\n        container.register(IdentityInjectionKey.RoleProvider, {\n            useFactory: () => new IdentityRoleProvider({\n                clientRepository: clientRepositoryAdapter,\n                userRepository: userRepositoryAdapter,\n            }),\n        });\n\n        container.register(IdentityInjectionKey.PermissionProvider, {\n            useFactory: (c) => new IdentityPermissionProvider({\n                clientRepository: clientRepositoryAdapter,\n                userRepository: userRepositoryAdapter,\n                roleRepository: roleRepositoryAdapter,\n                roleProvider: c.resolve(IdentityInjectionKey.RoleProvider),\n            }),\n        });\n\n        // ---------------------------------------------\n\n        const attributeMapperRepository = new IdentityProviderAttributeMappingRepository(dataSource);\n        const attributeMapper = new IdentityProviderAttributeMapper(attributeMapperRepository);\n\n        const roleMapperFinder = new IdentityProviderRoleMappingRepository(dataSource);\n        const roleMapper = new IdentityProviderRoleMapper(roleMapperFinder);\n\n        const permissionMapperRepository = new IdentityProviderPermissionMappingRepository(dataSource);\n        const permissionMapper = new IdentityProviderPermissionMapper(permissionMapperRepository);\n\n        const providerAccountRepository = new IdentityProviderAccountRepository(dataSource);\n\n        container.register(IdentityInjectionKey.ProviderAccountManager, {\n            useFactory: () => new IdentityProviderAccountManager({\n                repository: providerAccountRepository,\n                userRepository,\n                attributeMapper,\n                roleMapper,\n                permissionMapper,\n            }),\n        });\n\n        // ---------------------------------------------\n\n        const identityProviderRepository = new IdentityProviderRepositoryAdapter({\n            repository: new IdentityProviderRepository(dataSource),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n        container.register(IdentityInjectionKey.ProviderLdapCollectionAuthenticator, {\n            useFactory: (c) => new IdentityProviderLdapCollectionAuthenticator({\n                repository: identityProviderRepository,\n                accountManager: c.resolve(IdentityInjectionKey.ProviderAccountManager),\n                clientFactory: c.resolve(LDAPInjectionKey.ClientFactory),\n            }),\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,IAAa6B,iBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOH,WAAWK;EACvB,KAAKD,eAAe,CAACJ,WAAWM,QAAS;CAC7C;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,aAAaD,UAAUE,QAAQ/B,qBAAqBgC,UAAU;EACpE,MAAMC,kBAAkBJ,UAAUE,QAA2B3B,WAAAA;EAE7D,MAAM8B,mBAAmB,IAAIxC,yBACzBmC,UAAUE,QAA4B7B,YAAAA,CAAAA;EAE1C,MAAMiC,iBAAiB,IAAIpC,uBAAuB;GAC9CqC,YAAY,IAAI7B,eAAeuB,UAAAA;GAC/BO,0BAA0BR,UAAUE,QAAoCzB,oBAAAA;GACxEgC,oBAAoBT,UAAUE,QAA8BvB,cAAAA;EAChE,CAAA;EAEAqB,UAAUU,SAASjB,qBAAqBkB,UAAU,EAC9CC,kBAAkB,IAAIvB,iBAAiB;GACnCgB;GACAC;EACJ,CAAA,EACJ,CAAA;EAIA,MAAMO,0BAA0B,IAAIjC,wBAAwB;GACxD2B,YAAYP,UAAUE,QAA4B7B,YAAAA;GAClD+B;EACJ,CAAA;EACA,MAAMU,wBAAwB,IAAIhC,sBAAsB;GACpDyB,YAAY,IAAI7B,eAAeuB,UAAAA;GAC/BG;EACJ,CAAA;EACA,MAAMW,wBAAwB,IAAIlC,sBAAsB;GACpD0B,YAAYP,UAAUE,QAA0B1B,UAAAA;GAChD4B;EACJ,CAAA;EAEAJ,UAAUU,SAASjB,qBAAqBuB,cAAc,EAClDJ,kBAAkB,IAAItB,qBAAqB;GACvCe,kBAAkBQ;GAClBP,gBAAgBQ;EACpB,CAAA,EACJ,CAAA;EAEAd,UAAUU,SAASjB,qBAAqBwB,oBAAoB,EACxDL,aAAaM,MAAM,IAAInC,2BAA2B;GAC9CsB,kBAAkBQ;GAClBP,gBAAgBQ;GAChBK,gBAAgBJ;GAChBK,cAAcF,EAAEhB,QAAQT,qBAAqBuB,YAAY;EAC7D,CAAA,EACJ,CAAA;EAIA,MAAMK,4BAA4B,IAAItD,2CAA2CkC,UAAAA;EACjF,MAAMqB,kBAAkB,IAAIrC,gCAAgCoC,yBAAAA;EAE5D,MAAME,mBAAmB,IAAItD,sCAAsCgC,UAAAA;EACnE,MAAMuB,aAAa,IAAIpC,2BAA2BmC,gBAAAA;EAElD,MAAME,6BAA6B,IAAIzD,4CAA4CiC,UAAAA;EACnF,MAAMyB,mBAAmB,IAAIvC,iCAAiCsC,0BAAAA;EAE9D,MAAME,4BAA4B,IAAI7D,kCAAkCmC,UAAAA;EAExED,UAAUU,SAASjB,qBAAqBmC,wBAAwB,EAC5DhB,kBAAkB,IAAI5B,+BAA+B;GACjDuB,YAAYoB;GACZrB;GACAgB;GACAE;GACAE;EACJ,CAAA,EACJ,CAAA;EAIA,MAAMG,6BAA6B,IAAIzD,kCAAkC;GACrEmC,YAAY,IAAIjC,2BAA2B2B,UAAAA;GAC3CG,iBAAiBJ,UAAUE,QAA2B3B,WAAAA;EAC1D,CAAA;EACAyB,UAAUU,SAASjB,qBAAqBqC,qCAAqC,EACzElB,aAAaM,MAAM,IAAIhC,4CAA4C;GAC/DqB,YAAYsB;GACZE,gBAAgBb,EAAEhB,QAAQT,qBAAqBmC,sBAAsB;GACrEI,eAAed,EAAEhB,QAAQX,iBAAiB0C,aAAa;EAC3D,CAAA,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientIdentityRepository","IdentityProviderAttributeMappingRepository","IdentityProviderPermissionMappingRepository","IdentityProviderRoleMappingRepository","UserIdentityRepository","DatabaseInjectionKey","IdentityProviderAccountRepositoryAdapter","IdentityProviderRepositoryAdapter","ClientEntity","IdentityProviderRepository","RealmEntity","RoleEntity","UserPermissionEntity","UserRepository","UserRoleEntity","ClientRepositoryAdapter","RoleRepositoryAdapter","UserRepositoryAdapter","IdentityPermissionProvider","IdentityProviderAccountManager","IdentityProviderAttributeMapper","IdentityProviderLdapCollectionAuthenticator","IdentityProviderPermissionMapper","IdentityProviderRoleMapper","IdentityResolver","IdentityRoleProvider","LDAPInjectionKey","ModuleName","IdentityInjectionKey","IdentityModule","name","dependencies","IDENTITY","DATABASE","setup","container","dataSource","resolve","DataSource","realmRepository","clientRepository","userRepository","repository","userPermissionRepository","userRoleRepository","register","Resolver","useFactory","clientRepositoryAdapter","userRepositoryAdapter","roleRepositoryAdapter","RoleProvider","PermissionProvider","c","roleRepository","roleProvider","attributeMapperRepository","attributeMapper","roleMapperFinder","roleMapper","permissionMapperRepository","permissionMapper","providerAccountRepository","ProviderAccountManager","identityProviderRepository","ProviderLdapCollectionAuthenticator","accountManager","clientFactory","ClientFactory"],"sources":["../../../../src/app/modules/identity/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client,\n    Realm,\n    Role,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport {\n    ClientIdentityRepository,\n    IdentityProviderAttributeMappingRepository,\n    IdentityProviderPermissionMappingRepository,\n    IdentityProviderRoleMappingRepository,\n    UserIdentityRepository,\n} from './repositories/index.ts';\nimport {\n    DatabaseInjectionKey,\n    IdentityProviderAccountRepositoryAdapter,\n    IdentityProviderRepositoryAdapter,\n} from '../database/index.ts';\nimport {\n    ClientEntity,\n    IdentityProviderRepository,\n    RealmEntity,\n    RoleEntity,\n    UserPermissionEntity,\n    UserRepository,\n    UserRoleEntity,\n} from '../../../adapters/database/domains/index.ts';\nimport {\n    ClientRepositoryAdapter,\n    RoleRepositoryAdapter,\n    UserRepositoryAdapter,\n} from '../database/repositories/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    IdentityPermissionProvider,\n    IdentityProviderAccountManager,\n    IdentityProviderAttributeMapper,\n    IdentityProviderLdapCollectionAuthenticator,\n    IdentityProviderPermissionMapper,\n    IdentityProviderRoleMapper,\n    IdentityResolver,\n    IdentityRoleProvider,\n} from '../../../core/index.ts';\nimport { LDAPInjectionKey } from '../ldap/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { IdentityInjectionKey } from './constants.ts';\n\nexport class IdentityModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.IDENTITY;\n        this.dependencies = [ModuleName.DATABASE];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const clientRepository = new ClientIdentityRepository(\n            container.resolve<Repository<Client>>(ClientEntity),\n        );\n        const userRepository = new UserIdentityRepository({\n            repository: new UserRepository(dataSource),\n            userPermissionRepository: container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            userRoleRepository: container.resolve<Repository<UserRole>>(UserRoleEntity),\n        });\n\n        container.register(IdentityInjectionKey.Resolver, {\n            useFactory: () => new IdentityResolver({\n                clientRepository,\n                userRepository,\n            }),\n        });\n\n        // ---------------------------------------------\n\n        const clientRepositoryAdapter = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const userRepositoryAdapter = new UserRepositoryAdapter({\n            repository: new UserRepository(dataSource),\n            realmRepository,\n        });\n        const roleRepositoryAdapter = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n\n        container.register(IdentityInjectionKey.RoleProvider, {\n            useFactory: () => new IdentityRoleProvider({\n                clientRepository: clientRepositoryAdapter,\n                userRepository: userRepositoryAdapter,\n            }),\n        });\n\n        container.register(IdentityInjectionKey.PermissionProvider, {\n            useFactory: (c) => new IdentityPermissionProvider({\n                clientRepository: clientRepositoryAdapter,\n                userRepository: userRepositoryAdapter,\n                roleRepository: roleRepositoryAdapter,\n                roleProvider: c.resolve(IdentityInjectionKey.RoleProvider),\n            }),\n        });\n\n        // ---------------------------------------------\n\n        const attributeMapperRepository = new IdentityProviderAttributeMappingRepository(dataSource);\n        const attributeMapper = new IdentityProviderAttributeMapper(attributeMapperRepository);\n\n        const roleMapperFinder = new IdentityProviderRoleMappingRepository(dataSource);\n        const roleMapper = new IdentityProviderRoleMapper(roleMapperFinder);\n\n        const permissionMapperRepository = new IdentityProviderPermissionMappingRepository(dataSource);\n        const permissionMapper = new IdentityProviderPermissionMapper(permissionMapperRepository);\n\n        const providerAccountRepository = new IdentityProviderAccountRepositoryAdapter(dataSource);\n\n        container.register(IdentityInjectionKey.ProviderAccountManager, {\n            useFactory: () => new IdentityProviderAccountManager({\n                repository: providerAccountRepository,\n                userRepository,\n                attributeMapper,\n                roleMapper,\n                permissionMapper,\n            }),\n        });\n\n        // ---------------------------------------------\n\n        const identityProviderRepository = new IdentityProviderRepositoryAdapter({\n            repository: new IdentityProviderRepository(dataSource),\n            realmRepository: container.resolve<Repository<Realm>>(RealmEntity),\n        });\n        container.register(IdentityInjectionKey.ProviderLdapCollectionAuthenticator, {\n            useFactory: (c) => new IdentityProviderLdapCollectionAuthenticator({\n                repository: identityProviderRepository,\n                accountManager: c.resolve(IdentityInjectionKey.ProviderAccountManager),\n                clientFactory: c.resolve(LDAPInjectionKey.ClientFactory),\n            }),\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,IAAa6B,iBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOH,WAAWK;EACvB,KAAKD,eAAe,CAACJ,WAAWM,QAAS;CAC7C;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,aAAaD,UAAUE,QAAQhC,qBAAqBiC,UAAU;EACpE,MAAMC,kBAAkBJ,UAAUE,QAA2B3B,WAAAA;EAE7D,MAAM8B,mBAAmB,IAAIxC,yBACzBmC,UAAUE,QAA4B7B,YAAAA,CAAAA;EAE1C,MAAMiC,iBAAiB,IAAIrC,uBAAuB;GAC9CsC,YAAY,IAAI7B,eAAeuB,UAAAA;GAC/BO,0BAA0BR,UAAUE,QAAoCzB,oBAAAA;GACxEgC,oBAAoBT,UAAUE,QAA8BvB,cAAAA;EAChE,CAAA;EAEAqB,UAAUU,SAASjB,qBAAqBkB,UAAU,EAC9CC,kBAAkB,IAAIvB,iBAAiB;GACnCgB;GACAC;EACJ,CAAA,EACJ,CAAA;EAIA,MAAMO,0BAA0B,IAAIjC,wBAAwB;GACxD2B,YAAYP,UAAUE,QAA4B7B,YAAAA;GAClD+B;EACJ,CAAA;EACA,MAAMU,wBAAwB,IAAIhC,sBAAsB;GACpDyB,YAAY,IAAI7B,eAAeuB,UAAAA;GAC/BG;EACJ,CAAA;EACA,MAAMW,wBAAwB,IAAIlC,sBAAsB;GACpD0B,YAAYP,UAAUE,QAA0B1B,UAAAA;GAChD4B;EACJ,CAAA;EAEAJ,UAAUU,SAASjB,qBAAqBuB,cAAc,EAClDJ,kBAAkB,IAAItB,qBAAqB;GACvCe,kBAAkBQ;GAClBP,gBAAgBQ;EACpB,CAAA,EACJ,CAAA;EAEAd,UAAUU,SAASjB,qBAAqBwB,oBAAoB,EACxDL,aAAaM,MAAM,IAAInC,2BAA2B;GAC9CsB,kBAAkBQ;GAClBP,gBAAgBQ;GAChBK,gBAAgBJ;GAChBK,cAAcF,EAAEhB,QAAQT,qBAAqBuB,YAAY;EAC7D,CAAA,EACJ,CAAA;EAIA,MAAMK,4BAA4B,IAAIvD,2CAA2CmC,UAAAA;EACjF,MAAMqB,kBAAkB,IAAIrC,gCAAgCoC,yBAAAA;EAE5D,MAAME,mBAAmB,IAAIvD,sCAAsCiC,UAAAA;EACnE,MAAMuB,aAAa,IAAIpC,2BAA2BmC,gBAAAA;EAElD,MAAME,6BAA6B,IAAI1D,4CAA4CkC,UAAAA;EACnF,MAAMyB,mBAAmB,IAAIvC,iCAAiCsC,0BAAAA;EAE9D,MAAME,4BAA4B,IAAIxD,yCAAyC8B,UAAAA;EAE/ED,UAAUU,SAASjB,qBAAqBmC,wBAAwB,EAC5DhB,kBAAkB,IAAI5B,+BAA+B;GACjDuB,YAAYoB;GACZrB;GACAgB;GACAE;GACAE;EACJ,CAAA,EACJ,CAAA;EAIA,MAAMG,6BAA6B,IAAIzD,kCAAkC;GACrEmC,YAAY,IAAIjC,2BAA2B2B,UAAAA;GAC3CG,iBAAiBJ,UAAUE,QAA2B3B,WAAAA;EAC1D,CAAA;EACAyB,UAAUU,SAASjB,qBAAqBqC,qCAAqC,EACzElB,aAAaM,MAAM,IAAIhC,4CAA4C;GAC/DqB,YAAYsB;GACZE,gBAAgBb,EAAEhB,QAAQT,qBAAqBmC,sBAAsB;GACrEI,eAAed,EAAEhB,QAAQX,iBAAiB0C,aAAa;EAC3D,CAAA,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/identity/repositories/index.mjs

@@ -1,11 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { IdentityProviderAccountRepository } from "./provider/account/module.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./provider/mapper/role.mjs";
 import "./provider/index.mjs";
 import { ClientIdentityRepository } from "./client.mjs";
 import { UserIdentityRepository } from "./user.mjs";
-export { ClientIdentityRepository, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRoleMappingRepository, UserIdentityRepository };
+export { ClientIdentityRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRoleMappingRepository, UserIdentityRepository };

package/dist/app/modules/identity/repositories/provider/index.d.ts

@@ -1,3 +1,2 @@
-export * from './account/index.ts';
 export * from './mapper/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/identity/repositories/provider/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/identity/repositories/provider/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/identity/repositories/provider/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC"}

package/dist/app/modules/identity/repositories/provider/index.mjs

@@ -1,10 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { IdentityProviderAccountRepository } from "./account/module.mjs";
-import "./account/index.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./mapper/role.mjs";
 import "./mapper/index.mjs";
-export { IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRoleMappingRepository };
+export { IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRoleMappingRepository };

package/dist/app/modules/index.mjs

@@ -24,6 +24,7 @@ import { ClientRoleRepositoryAdapter } from "./database/repositories/client-role
 import { ClientScopeRepositoryAdapter } from "./database/repositories/client-scope/repository.mjs";
 import { EventRepositoryAdapter } from "./database/repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./database/repositories/identity-provider/repository.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "./database/repositories/identity-provider-account/repository.mjs";
 import { KeyRepositoryAdapter } from "./database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./database/repositories/permission-policy/repository.mjs";
@@ -54,7 +55,6 @@ import { PromAuthFlowMetrics } from "./metrics/prom.mjs";
 import "./metrics/index.mjs";
 import { OAuth2InjectionToken } from "./oauth2/constants.mjs";
 import { IdentityInjectionKey } from "./identity/constants.mjs";
-import { IdentityProviderAccountRepository } from "./identity/repositories/provider/account/module.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./identity/repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./identity/repositories/provider/mapper/role.mjs";
@@ -67,6 +67,8 @@ import { IdentityModule } from "./identity/module.mjs";
 import "./identity/index.mjs";
 import { OAuth2Module } from "./oauth2/module.mjs";
 import "./oauth2/index.mjs";
+import { ProvisioningInjectionKey } from "./provisioning/constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./mail/constants.mjs";
 import { MailModule } from "./mail/module.mjs";
 import "./mail/index.mjs";
@@ -79,4 +81,4 @@ import { ProvisionerModule } from "./provisioning/module.mjs";
 import "./provisioning/index.mjs";
 import { RuntimeModule } from "./runtime/module.mjs";
 import "./runtime/index.mjs";
-export { AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+export { AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepositoryAdapter, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/logger/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/logger/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBpD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/logger/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAIrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,YAAa,YAAW,OAAO;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAwBpD"}

package/dist/app/modules/logger/module.mjs

@@ -15,6 +15,7 @@ var LoggerModule = class {
 		this.dependencies = [ModuleName.CONFIG];
 	}
 	async setup(container) {
+		if (container.has(LoggerInjectionKey)) return;
 		const result = container.tryResolve(ConfigInjectionKey);
 		if (!result.success || !result.data.logger) {
 			container.register(LoggerInjectionKey, { useFactory: createNoopLogger });

package/dist/app/modules/logger/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createLogger","createNoopLogger","ModuleName","ConfigInjectionKey","LoggerInjectionKey","LoggerModule","name","dependencies","LOGGER","CONFIG","setup","container","result","tryResolve","success","data","logger","register","useFactory","env","directory","writableDirectoryPath"],"sources":["../../../../src/app/modules/logger/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createLogger, createNoopLogger } from '@authup/server-kit';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { LoggerInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class LoggerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.LOGGER;\n        this.dependencies = [ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const result = container.tryResolve(ConfigInjectionKey);\n        if (!result.success || !result.data.logger) {\n            container.register(LoggerInjectionKey, { useFactory: createNoopLogger });\n\n            return;\n        }\n\n        container.register(LoggerInjectionKey, {\n            useFactory: () => createLogger({\n                env: result.data.env,\n                directory: result.data.writableDirectoryPath,\n            }),\n        });\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaK,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe,CAACL,WAAWO,MAAO;CAC3C;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,WAAWV,kBAAAA;EACpC,IAAI,CAACS,OAAOE,WAAW,CAACF,OAAOG,KAAKC,QAAQ;GACxCL,UAAUM,SAASb,oBAAoB,EAAEc,YAAYjB,iBAAiB,CAAA;GAEtE;EACJ;EAEAU,UAAUM,SAASb,oBAAoB,EACnCc,kBAAkBlB,aAAa;GAC3BmB,KAAKP,OAAOG,KAAKI;GACjBC,WAAWR,OAAOG,KAAKM;EAC3B,CAAA,EACJ,CAAA;CACJ;AAGJ"}
+{"version":3,"file":"module.mjs","names":["createLogger","createNoopLogger","ModuleName","ConfigInjectionKey","LoggerInjectionKey","LoggerModule","name","dependencies","LOGGER","CONFIG","setup","container","has","result","tryResolve","success","data","logger","register","useFactory","env","directory","writableDirectoryPath"],"sources":["../../../../src/app/modules/logger/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createLogger, createNoopLogger } from '@authup/server-kit';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { LoggerInjectionKey } from './constants.ts';\nimport type { IContainer } from 'eldin';\n\nexport class LoggerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.LOGGER;\n        this.dependencies = [ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        // A pre-registered logger wins (test injection, mirroring the\n        // MailInjectionKey / UIHttpClient pattern), so a fake can capture\n        // what the server writes.\n        if (container.has(LoggerInjectionKey)) {\n            return;\n        }\n\n        const result = container.tryResolve(ConfigInjectionKey);\n        if (!result.success || !result.data.logger) {\n            container.register(LoggerInjectionKey, { useFactory: createNoopLogger });\n\n            return;\n        }\n\n        container.register(LoggerInjectionKey, {\n            useFactory: () => createLogger({\n                env: result.data.env,\n                directory: result.data.writableDirectoryPath,\n            }),\n        });\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaK,eAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe,CAACL,WAAWO,MAAO;CAC3C;CAEA,MAAMC,MAAMC,WAAsC;EAI9C,IAAIA,UAAUC,IAAIR,kBAAAA,GACd;EAGJ,MAAMS,SAASF,UAAUG,WAAWX,kBAAAA;EACpC,IAAI,CAACU,OAAOE,WAAW,CAACF,OAAOG,KAAKC,QAAQ;GACxCN,UAAUO,SAASd,oBAAoB,EAAEe,YAAYlB,iBAAiB,CAAA;GAEtE;EACJ;EAEAU,UAAUO,SAASd,oBAAoB,EACnCe,kBAAkBnB,aAAa;GAC3BoB,KAAKP,OAAOG,KAAKI;GACjBC,WAAWR,OAAOG,KAAKM;EAC3B,CAAA,EACJ,CAAA;CACJ;AAGJ"}

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts

@@ -1,5 +1,7 @@
 import type { SessionToken } from '@authup/core-kit';
-import type { DataSource, Repository } from 'typeorm';
+import type { IQuery } from '@rapiq/core';
+import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DataSource, Repository, SelectQueryBuilder } from 'typeorm';
 import { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';
 import type { ISessionTokenRepository, SessionTokenCreateInput, SessionTokenRef } from '../../../../../core/index.ts';
 export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepository {
@@ -12,6 +14,28 @@ export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepos
     hasConsumedChild(parentId: string): Promise<boolean>;
     revokeById(id: string, at: string): Promise<void>;
     revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
+    /**
+     * Join the session and pin the columns authorization reads.
+     *
+     * A token row carries no realm or subject, so `SessionTokenService`
+     * resolves both through `session`. The join is unconditional and the three
+     * columns are selected regardless of the client's `fields` projection, so
+     * a projection cannot neutralize the gate the way a stripped `realmId`
+     * once could on the entity repositories (plan 039).
+     */
+    protected joinSessionForGate(qb: SelectQueryBuilder<SessionTokenEntity>): void;
+    /**
+     * Always expose only a client SUMMARY (id / name / displayName) on the
+     * read paths — the consent-list shape. `client` is deliberately absent
+     * from the schema's relations allow-list, so a raw `?include=client`
+     * cannot force the full-column join (redirect patterns, grant types,
+     * secret storage flags, accessPolicyId), while a self-service reader
+     * without CLIENT_READ still gets the application name per token row.
+     */
+    protected joinClientSummary(qb: SelectQueryBuilder<SessionTokenEntity>): void;
+    findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>>;
+    findOneWithSessionById(id: string): Promise<SessionToken | null>;
+    findAllByQuery(query: IQuery): Promise<SessionToken[]>;
     deleteExpired(before: string): Promise<number>;
 }
 //# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AACvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IAyB7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB5E,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAG1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAGvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IA0C7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsBlF;;;;;;;;OAQG;IACH,SAAS,CAAC,kBAAkB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAavE;;;;;;;OAOG;IACH,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAShE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAmB9E,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUhE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAUtD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs

@@ -3,6 +3,11 @@ import "node:url";
 import.meta.url;
 import { SessionTokenEntity } from "../../../../../adapters/database/domains/session-token/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
+import { SessionTokenRelationMissingError } from "../../../../../core/oauth2/session-token/error.mjs";
+import "../../../../../core/index.mjs";
+import { applyQuery, redactFieldConditions } from "../../../database/repositories/query.mjs";
+import { isForeignKeyConstraintDatabaseError } from "../../../../../adapters/database/errors/driver.mjs";
+import "../../../../../adapters/database/errors/index.mjs";
 import { In, LessThan } from "typeorm";
 //#region src/app/modules/oauth2/repositories/session-token/repository.ts
 var SessionTokenRepositoryAdapter = class {
@@ -14,6 +19,7 @@ var SessionTokenRepositoryAdapter = class {
 		const entity = this.repository.create({
 			id: input.id,
 			sessionId: input.sessionId,
+			clientId: input.clientId ?? null,
 			kind: input.kind,
 			parentId: input.parentId ?? null,
 			refreshTokenId: input.refreshTokenId ?? null,
@@ -23,7 +29,12 @@ var SessionTokenRepositoryAdapter = class {
 			revokedAt: null,
 			expiresAt: input.expiresAt
 		});
-		await this.repository.insert(entity);
+		try {
+			await this.repository.insert(entity);
+		} catch (e) {
+			if (isForeignKeyConstraintDatabaseError(e)) throw new SessionTokenRelationMissingError();
+			throw e;
+		}
 		entity.createdAt = entity.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
 		return entity;
 	}
@@ -56,6 +67,64 @@ var SessionTokenRepositoryAdapter = class {
 		if (refs.length > 0) await this.repository.createQueryBuilder().update(SessionTokenEntity).set({ revokedAt: at }).where({ id: In(refs.map((ref) => ref.id)) }).andWhere("revokedAt IS NULL").execute();
 		return refs;
 	}
+	/**
+	* Join the session and pin the columns authorization reads.
+	*
+	* A token row carries no realm or subject, so `SessionTokenService`
+	* resolves both through `session`. The join is unconditional and the three
+	* columns are selected regardless of the client's `fields` projection, so
+	* a projection cannot neutralize the gate the way a stripped `realmId`
+	* once could on the entity repositories (plan 039).
+	*/ joinSessionForGate(qb) {
+		if (!qb.expressionMap.joinAttributes.some((join) => join.alias.name === "session")) qb.leftJoin("sessionToken.session", "session");
+		qb.addSelect([
+			"session.id",
+			"session.sub",
+			"session.subKind",
+			"session.realmId"
+		]);
+	}
+	/**
+	* Always expose only a client SUMMARY (id / name / displayName) on the
+	* read paths — the consent-list shape. `client` is deliberately absent
+	* from the schema's relations allow-list, so a raw `?include=client`
+	* cannot force the full-column join (redirect patterns, grant types,
+	* secret storage flags, accessPolicyId), while a self-service reader
+	* without CLIENT_READ still gets the application name per token row.
+	*/ joinClientSummary(qb) {
+		qb.leftJoin("sessionToken.client", "client");
+		qb.addSelect([
+			"client.id",
+			"client.name",
+			"client.displayName"
+		]);
+	}
+	async findMany(query) {
+		const qb = this.repository.createQueryBuilder("sessionToken");
+		const { pagination } = applyQuery(qb, query);
+		this.joinSessionForGate(qb);
+		this.joinClientSummary(qb);
+		const [entities, total] = await qb.getManyAndCount();
+		return {
+			data: redactFieldConditions(query, entities),
+			meta: {
+				total,
+				...pagination
+			}
+		};
+	}
+	async findOneWithSessionById(id) {
+		const qb = this.repository.createQueryBuilder("sessionToken").where("sessionToken.id = :id", { id });
+		this.joinSessionForGate(qb);
+		this.joinClientSummary(qb);
+		return qb.getOne();
+	}
+	async findAllByQuery(query) {
+		const qb = this.repository.createQueryBuilder("sessionToken");
+		applyQuery(qb, query);
+		this.joinSessionForGate(qb);
+		return qb.getMany();
+	}
 	async deleteExpired(before) {
 		return (await this.repository.delete({ expiresAt: LessThan(before) })).affected ?? 0;
 	}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["In","LessThan","SessionTokenEntity","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        await this.repository.insert(entity);\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;AAiBA,IAAaG,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcJ,kBAAAA;CAC/C;CAEA,MAAMK,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,MAAMJ,MAAMI;GACZC,UAAUL,MAAMK,YAAY;GAC5BC,gBAAgBN,MAAMM,kBAAkB;GACxCC,WAAWP,MAAMO;GACjBC,WAAWR,MAAMQ;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWX,MAAMW;EACrB,CAAA;EAEA,MAAM,KAAKf,WAAWgB,OAAOX,MAAAA;EAM7BA,OAAOY,YAAYZ,OAAOY,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOd;CACX;CAEA,MAAMe,YAAYd,IAA0C;EACxD,OAAO,KAAKN,WAAWqB,QAAQ,EAAEC,OAAO,EAAEhB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMiB,gBAAgBhB,WAA4C;EAC9D,OAAO,KAAKP,WAAWwB,KAAK,EAAEF,OAAO,EAAEf,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMkB,oBAAoBnB,IAAYoB,IAA8B;EAUhE,SAAQC,MATa,KAAK3B,WAAW4B,mBAAkB,CAAA,CAClDC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEjB,YAAYa,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,gBAAgB,EAAEvB,MAAM,UAAU,CAAA,CAAA,CAC3CuB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiBzB,UAAoC;EAMvD,OAAO0B,MALa,KAAKnC,WAAW4B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEb,SAAS,CAAA,CAAA,CACtDsB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAW/B,IAAYoB,IAA2B;EACpD,MAAM,KAAK1B,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAEhB,GAAG,CAAA,CAAA,CACvByB,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkB/B,WAAmBmB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKvC,WAAWwB,KAAK;GACpCF,OAAO,EAAEf,UAAU;GACnBiC,QAAQ;IAAElC,IAAI;IAAMS,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC2B,KAAKC,SAAS;GAC/CrC,IAAIqC,IAAIrC;GACRS,WAAW4B,IAAI5B;EACnB,EAAA;EACA,IAAI0B,KAAKG,SAAS,GACd,MAAM,KAAK5C,WAAW4B,mBAAkB,CAAA,CACnCC,OAAO/B,kBAAAA,CAAAA,CACPgC,IAAI,EAAEhB,WAAWY,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAEhB,IAAIV,GAAG6C,KAAKC,KAAKG,QAAQA,IAAIvC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1CyB,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;CAEA,MAAMK,cAAcC,QAAiC;EAGjD,QAAOpB,MAFc,KAAK3B,WAAWgD,OAAO,EAAEjC,WAAWlB,SAASkD,MAAAA,EAAQ,CAAA,EAAA,CAE5Dd,YAAY;CAC9B;AACJ"}
+{"version":3,"file":"repository.mjs","names":["In","LessThan","applyQuery","redactFieldConditions","SessionTokenEntity","isForeignKeyConstraintDatabaseError","SessionTokenRelationMissingError","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","clientId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","e","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","joinSessionForGate","qb","expressionMap","joinAttributes","some","join","alias","name","leftJoin","addSelect","joinClientSummary","findMany","query","pagination","entities","total","getManyAndCount","data","meta","findOneWithSessionById","getOne","findAllByQuery","getMany","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DataSource, Repository, SelectQueryBuilder } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isForeignKeyConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport { SessionTokenRelationMissingError } from '../../../../../core/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            clientId: input.clientId ?? null,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        try {\n            await this.repository.insert(entity);\n        } catch (e) {\n            // A rejection means one of the two parents was deleted between the\n            // caller resolving it and this write: the session (a concurrent\n            // replay reaction, logout, force-logout or sweep) or the client the\n            // token is attributed to. Both cascade onto this table, so either\n            // way the token rows are already gone and the caller's answer is the\n            // same, which is why the error names neither. Report that condition\n            // instead of letting a driver error escape as an unhandled internal\n            // error (issue #3435).\n            if (isForeignKeyConstraintDatabaseError(e)) {\n                throw new SessionTokenRelationMissingError();\n            }\n\n            throw e;\n        }\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    /**\n     * Join the session and pin the columns authorization reads.\n     *\n     * A token row carries no realm or subject, so `SessionTokenService`\n     * resolves both through `session`. The join is unconditional and the three\n     * columns are selected regardless of the client's `fields` projection, so\n     * a projection cannot neutralize the gate the way a stripped `realmId`\n     * once could on the entity repositories (plan 039).\n     */\n    protected joinSessionForGate(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        if (!qb.expressionMap.joinAttributes.some((join) => join.alias.name === 'session')) {\n            qb.leftJoin('sessionToken.session', 'session');\n        }\n\n        qb.addSelect([\n            'session.id',\n            'session.sub',\n            'session.subKind',\n            'session.realmId',\n        ]);\n    }\n\n    /**\n     * Always expose only a client SUMMARY (id / name / displayName) on the\n     * read paths — the consent-list shape. `client` is deliberately absent\n     * from the schema's relations allow-list, so a raw `?include=client`\n     * cannot force the full-column join (redirect patterns, grant types,\n     * secret storage flags, accessPolicyId), while a self-service reader\n     * without CLIENT_READ still gets the application name per token row.\n     */\n    protected joinClientSummary(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        qb.leftJoin('sessionToken.client', 'client');\n        qb.addSelect([\n            'client.id',\n            'client.name',\n            'client.displayName',\n        ]);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        const { pagination } = applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneWithSessionById(id: string): Promise<SessionToken | null> {\n        const qb = this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.id = :id', { id });\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        return qb.getOne();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<SessionToken[]> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n\n        return qb.getMany();\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaO,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,kBAAAA;CAC/C;CAEA,MAAMO,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,UAAUJ,MAAMI,YAAY;GAC5BC,MAAML,MAAMK;GACZC,UAAUN,MAAMM,YAAY;GAC5BC,gBAAgBP,MAAMO,kBAAkB;GACxCC,WAAWR,MAAMQ;GACjBC,WAAWT,MAAMS;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWZ,MAAMY;EACrB,CAAA;EAEA,IAAI;GACA,MAAM,KAAKhB,WAAWiB,OAAOZ,MAAAA;EACjC,SAASa,GAAG;GASR,IAAIrB,oCAAoCqB,CAAAA,GACpC,MAAM,IAAIpB,iCAAAA;GAGd,MAAMoB;EACV;EAMAb,OAAOc,YAAYd,OAAOc,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOhB;CACX;CAEA,MAAMiB,YAAYhB,IAA0C;EACxD,OAAO,KAAKN,WAAWuB,QAAQ,EAAEC,OAAO,EAAElB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMmB,gBAAgBlB,WAA4C;EAC9D,OAAO,KAAKP,WAAW0B,KAAK,EAAEF,OAAO,EAAEjB,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMoB,oBAAoBrB,IAAYsB,IAA8B;EAUhE,SAAQC,MATa,KAAK7B,WAAW8B,mBAAkB,CAAA,CAClDC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAElB,YAAYc,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiB1B,UAAoC;EAMvD,OAAO2B,MALa,KAAKrC,WAAW8B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEd,SAAS,CAAA,CAAA,CACtDuB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYsB,IAA2B;EACpD,MAAM,KAAK5B,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkBjC,WAAmBqB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKzC,WAAW0B,KAAK;GACpCF,OAAO,EAAEjB,UAAU;GACnBmC,QAAQ;IAAEpC,IAAI;IAAMU,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC4B,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRU,WAAW6B,IAAI7B;EACnB,EAAA;EACA,IAAI2B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAElB,IAAId,GAAGmD,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C2B,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;;;;;;;;;IAWA,mBAA6BM,IAA4C;EACrE,IAAI,CAACA,GAAGC,cAAcC,eAAeC,MAAMC,SAASA,KAAKC,MAAMC,SAAS,SAAA,GACpEN,GAAGO,SAAS,wBAAwB,SAAA;EAGxCP,GAAGQ,UAAU;GACT;GACA;GACA;GACA;EACH,CAAA;CACL;;;;;;;;IAUA,kBAA4BR,IAA4C;EACpEA,GAAGO,SAAS,uBAAuB,QAAA;EACnCP,GAAGQ,UAAU;GACT;GACA;GACA;EACH,CAAA;CACL;CAEA,MAAME,SAASC,OAAsE;EACjF,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9C,MAAM,EAAE+B,eAAenE,WAAWuD,IAAIW,KAAAA;EAEtC,KAAKZ,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,MAAM,CAACa,UAAUC,SAAS,MAAMd,GAAGe,gBAAe;EAElD,OAAO;GACHC,MAAMtE,sBAAsBiE,OAAOE,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,uBAAuB7D,IAA0C;EACnE,MAAM2C,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA,CAAA,CACzCN,MAAM,yBAAyB,EAAElB,GAAG,CAAA;EAEzC,KAAK0C,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,OAAOA,GAAGmB,OAAM;CACpB;CAEA,MAAMC,eAAeT,OAAwC;EACzD,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9CpC,WAAWuD,IAAIW,KAAAA;EAEf,KAAKZ,mBAAmBC,EAAAA;EAExB,OAAOA,GAAGqB,QAAO;CACrB;CAEA,MAAMC,cAAcC,QAAiC;EAGjD,QAAO3C,MAFc,KAAK7B,WAAWyE,OAAO,EAAEzD,WAAWvB,SAAS+E,MAAAA,EAAQ,CAAA,EAAA,CAE5DrC,YAAY;CAC9B;AACJ"}

package/dist/app/modules/provisioning/constants.d.ts

@@ -0,0 +1,12 @@
+import { TypedToken } from 'eldin';
+import type { IRealmProvisioner } from '../../../core/index.ts';
+export declare const ProvisioningInjectionKey: {
+    /**
+     * Registered by ProvisionerModule.setup iff the loaded provisioning
+     * data carries a wildcard realm entry. Resolved lazily (request time)
+     * by the realm controller factory, so the HTTP module never depends
+     * on provisioning-module boot order.
+     */
+    readonly WildcardRealmProvisioner: TypedToken<IRealmProvisioner>;
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/app/modules/provisioning/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,eAAO,MAAM,wBAAwB;IACjC;;;;;OAKG;;CAEG,CAAC"}

package/dist/app/modules/provisioning/constants.mjs

@@ -0,0 +1,16 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { TypedToken } from "eldin";
+//#region src/app/modules/provisioning/constants.ts
+const ProvisioningInjectionKey = { 
+/**
+* Registered by ProvisionerModule.setup iff the loaded provisioning
+* data carries a wildcard realm entry. Resolved lazily (request time)
+* by the realm controller factory, so the HTTP module never depends
+* on provisioning-module boot order.
+*/ WildcardRealmProvisioner: new TypedToken("WildcardRealmProvisioner") };
+//#endregion
+export { ProvisioningInjectionKey };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/app/modules/provisioning/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["TypedToken","ProvisioningInjectionKey","WildcardRealmProvisioner"],"sources":["../../../../src/app/modules/provisioning/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { IRealmProvisioner } from '../../../core/index.ts';\n\nexport const ProvisioningInjectionKey = {\n    /**\n     * Registered by ProvisionerModule.setup iff the loaded provisioning\n     * data carries a wildcard realm entry. Resolved lazily (request time)\n     * by the realm controller factory, so the HTTP module never depends\n     * on provisioning-module boot order.\n     */\n    WildcardRealmProvisioner: new TypedToken<IRealmProvisioner>('WildcardRealmProvisioner'),\n} as const;\n"],"mappings":";;;;;AAUA,MAAaC,2BAA2B;;;;;;GAOpCC,0BAA0B,IAAIF,WAA8B,0BAAA,EAChE"}

package/dist/app/modules/provisioning/index.d.ts

@@ -1,3 +1,5 @@
+export * from './constants.ts';
+export * from './lazy-wildcard.ts';
 export * from './sources/index.ts';
 export * from './module.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/provisioning/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC"}

package/dist/app/modules/provisioning/index.mjs

@@ -1,9 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { ProvisioningInjectionKey } from "./constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./lazy-wildcard.mjs";
 import { DefaultProvisioningSource } from "./sources/default/module.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
 import { ProvisionerModule } from "./module.mjs";
-export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource, ProvisionerModule };
+export { CompositeProvisioningSource, DefaultProvisioningSource, FileProvisioningSource, LazyWildcardRealmProvisioner, ProvisionerModule, ProvisioningInjectionKey };

package/dist/app/modules/provisioning/lazy-wildcard.d.ts

@@ -0,0 +1,15 @@
+import type { Realm } from '@authup/core-kit';
+import type { IContainer } from 'eldin';
+import type { IRealmProvisioner } from '../../../core/index.ts';
+/**
+ * The wildcard realm provisioner is registered by ProvisionerModule AFTER
+ * the async provisioning-source load, and the HTTP module does not depend
+ * on the provisioning module's boot order — resolve it lazily at request
+ * time. No wildcard entry declared => no-op.
+ */
+export declare class LazyWildcardRealmProvisioner implements IRealmProvisioner {
+    protected container: IContainer;
+    constructor(container: IContainer);
+    ensureForRealm(realm: Realm): Promise<void>;
+}
+//# sourceMappingURL=lazy-wildcard.d.ts.map

package/dist/app/modules/provisioning/lazy-wildcard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-wildcard.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/lazy-wildcard.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,iBAAiB;IAClE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEpB,SAAS,EAAE,UAAU;IAI3B,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;CAOpD"}