@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/app/modules/provisioning/lazy-wildcard.mjs

@@ -0,0 +1,23 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ProvisioningInjectionKey } from "./constants.mjs";
+//#region src/app/modules/provisioning/lazy-wildcard.ts
+/**
+* The wildcard realm provisioner is registered by ProvisionerModule AFTER
+* the async provisioning-source load, and the HTTP module does not depend
+* on the provisioning module's boot order — resolve it lazily at request
+* time. No wildcard entry declared => no-op.
+*/ var LazyWildcardRealmProvisioner = class {
+	container;
+	constructor(container) {
+		this.container = container;
+	}
+	async ensureForRealm(realm) {
+		if (this.container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) await this.container.resolve(ProvisioningInjectionKey.WildcardRealmProvisioner).ensureForRealm(realm);
+	}
+};
+//#endregion
+export { LazyWildcardRealmProvisioner };
+
+//# sourceMappingURL=lazy-wildcard.mjs.map

package/dist/app/modules/provisioning/lazy-wildcard.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lazy-wildcard.mjs","names":["ProvisioningInjectionKey","LazyWildcardRealmProvisioner","container","ensureForRealm","realm","has","WildcardRealmProvisioner","resolve"],"sources":["../../../../src/app/modules/provisioning/lazy-wildcard.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport type { IRealmProvisioner } from '../../../core/index.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\n\n/**\n * The wildcard realm provisioner is registered by ProvisionerModule AFTER\n * the async provisioning-source load, and the HTTP module does not depend\n * on the provisioning module's boot order — resolve it lazily at request\n * time. No wildcard entry declared => no-op.\n */\nexport class LazyWildcardRealmProvisioner implements IRealmProvisioner {\n    protected container: IContainer;\n\n    constructor(container: IContainer) {\n        this.container = container;\n    }\n\n    async ensureForRealm(realm: Realm): Promise<void> {\n        if (this.container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            await this.container\n                .resolve(ProvisioningInjectionKey.WildcardRealmProvisioner)\n                .ensureForRealm(realm);\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAkBA,IAAaC,+BAAb,MAAaA;CACCC;CAEV,YAAYA,WAAuB;EAC/B,KAAKA,YAAYA;CACrB;CAEA,MAAMC,eAAeC,OAA6B;EAC9C,IAAI,KAAKF,UAAUG,IAAIL,yBAAyBM,wBAAwB,GACpE,MAAM,KAAKJ,UACNK,QAAQP,yBAAyBM,wBAAwB,CAAA,CACzDH,eAAeC,KAAAA;CAE5B;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAWxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAWrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAuKjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAiBxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAarC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAyNjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -16,7 +16,7 @@ import { RolePermissionEntity } from "../../../adapters/database/domains/role-pe
 import { UserPermissionEntity } from "../../../adapters/database/domains/user-permission/entity.mjs";
 import { UserRoleEntity } from "../../../adapters/database/domains/user-role/entity.mjs";
 import "../../../adapters/database/domains/index.mjs";
-import { WebClientProvisioner } from "../../../core/entities/client/web-client.mjs";
+import { SystemClientProvisioner } from "../../../core/entities/client/system-clients.mjs";
 import "../../../core/entities/client/index.mjs";
 import { KeyProvisioner } from "../../../core/key/provisioner.mjs";
 import "../../../core/key/index.mjs";
@@ -29,6 +29,8 @@ import { GraphProvisioningSynchronizer } from "../../../core/provisioning/synchr
 import { ScopeProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "../../../core/provisioning/synchronizer/user/module.mjs";
 import "../../../core/provisioning/synchronizer/index.mjs";
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "../../../core/provisioning/wildcard/module.mjs";
+import "../../../core/provisioning/wildcard/index.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
 import { getAppOrigins } from "../config/origins.mjs";
@@ -54,6 +56,8 @@ import { DatabaseInjectionKey } from "../database/constants.mjs";
 import { LoggerInjectionKey } from "../logger/constants.mjs";
 import "../logger/index.mjs";
 import "../database/index.mjs";
+import { OAuth2InjectionToken } from "../oauth2/constants.mjs";
+import { ProvisioningInjectionKey } from "./constants.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
@@ -80,6 +84,9 @@ var ProvisionerModule = class {
 			logger: container.resolve(LoggerInjectionKey)
 		}));
 		const data = await new CompositeProvisioningSource(sources).load(container);
+		const wildcardEntry = extractWildcardRealmEntry(data);
+		let wildcardVariants;
+		if (wildcardEntry) wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);
 		const dataSource = container.resolve(DatabaseInjectionKey.DataSource);
 		const realmRepository = container.resolve(RealmEntity);
 		const permissionRepository = new PermissionRepositoryAdapter({
@@ -156,21 +163,34 @@ var ProvisionerModule = class {
 			realmSynchronizer,
 			scopeSynchronizer
 		}).synchronize(data);
-		const webClientProvisioner = new WebClientProvisioner({
+		const systemClientProvisioner = new SystemClientProvisioner({
 			clientRepository,
 			scopeRepository,
 			clientScopeRepository,
 			appOrigins: getAppOrigins(config),
 			logger: container.resolve(LoggerInjectionKey)
 		});
+		const keyStore = container.has(OAuth2InjectionToken.KeyStore) ? container.resolve(OAuth2InjectionToken.KeyStore) : new KeyRepositoryAdapter(dataSource, { secretsCipher: config.secretsEncryptionKey ? new SymmetricCipher(config.secretsEncryptionKey) : null });
 		const keyProvisioner = new KeyProvisioner({
-			keyStore: new KeyRepositoryAdapter(dataSource, { secretsCipher: config.secretsEncryptionKey ? new SymmetricCipher(config.secretsEncryptionKey) : null }),
+			keyStore,
 			logger: container.resolve(LoggerInjectionKey)
 		});
+		let wildcardProvisioner;
+		if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);
+		if (wildcardEntry) {
+			wildcardProvisioner = new WildcardRealmProvisioner({
+				relations: wildcardEntry.relations ?? {},
+				relationsByRealmName: wildcardVariants,
+				synchronizer: realmSynchronizer,
+				logger: container.resolve(LoggerInjectionKey)
+			});
+			container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });
+		}
 		const realms = await realmRepository.find();
 		for (const realm of realms) {
-			await webClientProvisioner.ensureForRealm(realm);
+			await systemClientProvisioner.ensureForRealm(realm);
 			await keyProvisioner.ensureForRealm(realm);
+			if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) await wildcardProvisioner.ensureForRealm(realm);
 		}
 		if (config.permissionsDefaultPolicyAssignment) await this.assignDefaultPolicy(dataSource, policyRepository);
 	}

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","WebClientProvisioner","KeyProvisioner","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","webClientProvisioner","appOrigins","keyProvisioner","keyStore","secretsCipher","secretsEncryptionKey","realms","find","realm","ensureForRealm","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { WebClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm public `web` client. Single provisioning mechanism:\n        // list every realm (incl. pre-existing) and upsert its web client.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const webClientProvisioner = new WebClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use. The\n        // adapter is constructed locally (NOT resolved from the oauth2\n        // module's registration) so provisioning stays runnable in minimal\n        // module graphs (test setup, CLI); the KEK handling is identical.\n        const keyProvisioner = new KeyProvisioner({\n            keyStore: new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            }),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await webClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,IAAakD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQlB,kBAAAA;EACjC,MAAMmB,kBAAkBpB,KAAKqB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIvB,GAAGwB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAElC,MAAMa,aAAab,UAAUE,QAAQtB,qBAAqBkC,UAAU;EACpE,MAAMC,kBAAkBf,UAAUE,QAA2BvD,WAAAA;EAE7D,MAAMqE,uBAAuB,IAAI7C,4BAA4B;GACzD8C,YAAYjB,UAAUE,QAAsCxD,gBAAAA;GAC5DqE;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI9C,wBAAwB;GACjD6C,YAAY,IAAI9D,iBAAiB0D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIjD,kCACnC8B,UAAUE,QAAsChD,sBAAAA,CAAAA;EAGpD,MAAMkE,qBAAqB,IAAI5D,+BAA+B;GAC1DyD,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI9C,sBAAsB;GAC7C0C,YAAYjB,UAAUE,QAA0BtD,UAAAA;GAChDmE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIxD,wBAAwB;GACjDmD,YAAYjB,UAAUE,QAA4B5D,YAAAA;GAClDyE;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAI/C,uBAAuB;GAC/CyC,YAAYjB,UAAUE,QAA2BpD,WAAAA;GACjDiE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAIxD,6BAC9BgC,UAAUE,QAAiCzD,iBAAAA,CAAAA;EAG/C,MAAMgF,yBAAyB,IAAIlE,mCAAmC;GAClE0D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIhE,6BAA6B;GACtDuD,YAAYI;GACZL;GACAW,0BAA0B,IAAIrD,gCAC1B0B,UAAUE,QAAoCrD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAM+E,qBAAqB,IAAIvE,+BAA+B;GAC1DiE;GACAO,sBAAsB,IAAI9D,4BACtBiC,UAAUE,QAAgC1D,gBAAAA,CAAAA;GAE9CsF,4BAA4B,IAAIjE,kCAC5BmC,UAAUE,QAAsC3D,sBAAAA,CAAAA;GAEpDiF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAInE,6BAA6B;GACtDoE,gBAAgB,IAAItD,sBAAsB;IACtCuC,YAAY,IAAI7D,eAAeyD,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAItD,0BACpBqB,UAAUE,QAA8BlD,cAAAA,CAAAA;GAE5CkF,0BAA0B,IAAIzD,gCAC1BuB,UAAUE,QAAoCnD,oBAAAA,CAAAA;GAGlDuE;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAIxE,8BAA8B,EAAEsD,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAI3E,8BAA8B;GACxDwD,YAAY,IAAI5C,uBAAuB0C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuB/E,8BAA8B;GACvD8D;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY3B,IAAAA;EAOnC,MAAM4B,uBAAuB,IAAInD,qBAAqB;GAClDkC;GACAC;GACAC;GACAgB,YAAYvD,cAAcgB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAQA,MAAMsD,iBAAiB,IAAIpD,eAAe;GACtCqD,UAAU,IAAIzE,qBAAqB4C,YAAY,EAC3C8B,eAAe1C,OAAO2C,uBAClB,IAAI1D,gBAAgBe,OAAO2C,oBAAoB,IAC/C,KACR,CAAA;GACAnC,QAAQT,UAAUE,QAAQf,kBAAAA;EAC9B,CAAA;EAEA,MAAM0D,SAAS,MAAM9B,gBAAgB+B,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMN,qBAAqBS,eAAeD,KAAAA;GAC1C,MAAMN,eAAeO,eAAeD,KAAAA;EACxC;EAEA,IAAI9C,OAAOgD,oCACP,MAAM,KAAKC,oBAAoBrC,YAAYK,gBAAAA;CAEnD;CAEA,MAAgBgC,oBACZrC,YACAK,kBACa;EACb,MAAMiC,gBAAgB,MAAMjC,iBAAiBkC,cAAcnG,iBAAiBoG,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBzC,WAAW0C,cAAc7G,gBAAAA;EAChD,MAAM8G,eAAe3C,WAAW0C,cAAcrG,sBAAAA;EAE9C,MAAMuG,cAAc,MAAMH,eAAeR,KAAI;EAC7C,KAAK,MAAMY,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","WildcardRealmProvisioner","expandWildcardRealmEntry","extractWildcardRealmEntry","ProvisioningInjectionKey","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","SystemClientProvisioner","KeyProvisioner","OAuth2InjectionToken","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","wildcardEntry","wildcardVariants","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","systemClientProvisioner","appOrigins","keyStore","has","KeyStore","secretsCipher","secretsEncryptionKey","keyProvisioner","wildcardProvisioner","unregister","relations","relationsByRealmName","synchronizer","register","useValue","realms","find","realm","ensureForRealm","hasExplicitEntry","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { RealmProvisioningRelations } from '../../../core/provisioning/entities/index.ts';\nimport {\n    WildcardRealmProvisioner,\n    expandWildcardRealmEntry,\n    extractWildcardRealmEntry,\n} from '../../../core/provisioning/wildcard/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { SystemClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport type { IKeyStore } from '../../../core/key/index.ts';\nimport { OAuth2InjectionToken } from '../oauth2/constants.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        // ---------------------------------------------------------------\n        // Wildcard realm entry (plan 082): split the `name: \"*\"` entry out\n        // of `data.realms` and deep-merge it UNDER every explicit realm\n        // entry (explicit wins per attribute, relation lists union) so the\n        // graph sync below covers declared realms in one pass. Realms\n        // without an explicit entry get the wildcard applied by the\n        // backfill loop; runtime-created realms via the DI-registered\n        // provisioner (RealmService hook).\n        // ---------------------------------------------------------------\n        const wildcardEntry = extractWildcardRealmEntry(data);\n        let wildcardVariants : Map<string, RealmProvisioningRelations> | undefined;\n        if (wildcardEntry) {\n            wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm system clients (web, admin-console, account-console).\n        // Single provisioning mechanism: list every realm (incl.\n        // pre-existing) and upsert its clients.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const systemClientProvisioner = new SystemClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use.\n        //\n        // The oauth2 module's registration is PREFERRED but optional, so\n        // provisioning stays runnable in minimal module graphs (test setup,\n        // CLI) where oauth2 never registered one; the locally constructed\n        // fallback handles the KEK identically. Sharing the instance when\n        // it exists matters because mint de-duplication is per adapter\n        // (see KeyRepositoryAdapter.mintExclusive): a second adapter has\n        // its own in-flight map, so this backfill and a concurrent\n        // realm-create request would each mint their own key.\n        const keyStore = container.has(OAuth2InjectionToken.KeyStore) ?\n            container.resolve<IKeyStore>(OAuth2InjectionToken.KeyStore) :\n            new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            });\n\n        const keyProvisioner = new KeyProvisioner({\n            keyStore,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Wildcard realm provisioning (plan 082): one shared instance for\n        // the boot backfill below AND the runtime realm-create hook (the\n        // realm controller factory resolves the DI key lazily), so the two\n        // paths cannot drift. Registered only when a wildcard entry was\n        // declared.\n        let wildcardProvisioner : WildcardRealmProvisioner | undefined;\n        if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);\n        }\n        if (wildcardEntry) {\n            wildcardProvisioner = new WildcardRealmProvisioner({\n                relations: wildcardEntry.relations ?? {},\n                relationsByRealmName: wildcardVariants,\n                synchronizer: realmSynchronizer,\n                logger: container.resolve(LoggerInjectionKey),\n            });\n            container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });\n        }\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await systemClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n            // Realms with an explicit entry were already covered by the\n            // wildcard expansion inside the graph sync above.\n            if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) {\n                await wildcardProvisioner.ensureForRealm(realm);\n            }\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,IAAauD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOb,WAAWgB;EACvB,KAAKF,eAAe,CAACd,WAAWiB,QAAQjB,WAAWkB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQnB,kBAAAA;EACjC,MAAMoB,kBAAkBrB,KAAKsB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIxB,GAAGyB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMyB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAWlC,MAAMa,gBAAgBnD,0BAA0BiD,IAAAA;EAChD,IAAIG;EACJ,IAAID,eACAC,mBAAmBrD,yBAAyBoD,eAAeF,IAAAA;EAG/D,MAAMI,aAAaf,UAAUE,QAAQvB,qBAAqBqC,UAAU;EACpE,MAAMC,kBAAkBjB,UAAUE,QAA2B5D,WAAAA;EAE7D,MAAM4E,uBAAuB,IAAIhD,4BAA4B;GACzDiD,YAAYnB,UAAUE,QAAsC7D,gBAAAA;GAC5D4E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIjD,wBAAwB;GACjDgD,YAAY,IAAIrE,iBAAiBiE,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIpD,kCACnC+B,UAAUE,QAAsCrD,sBAAAA,CAAAA;EAGpD,MAAMyE,qBAAqB,IAAInE,+BAA+B;GAC1DgE,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIjD,sBAAsB;GAC7C6C,YAAYnB,UAAUE,QAA0B3D,UAAAA;GAChD0E;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAI3D,wBAAwB;GACjDsD,YAAYnB,UAAUE,QAA4BjE,YAAAA;GAClDgF;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAIlD,uBAAuB;GAC/C4C,YAAYnB,UAAUE,QAA2BzD,WAAAA;GACjDwE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAI3D,6BAC9BiC,UAAUE,QAAiC9D,iBAAAA,CAAAA;EAG/C,MAAMuF,yBAAyB,IAAIzE,mCAAmC;GAClEiE,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIvE,6BAA6B;GACtD8D,YAAYI;GACZL;GACAW,0BAA0B,IAAIxD,gCAC1B2B,UAAUE,QAAoC1D,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMsF,qBAAqB,IAAI9E,+BAA+B;GAC1DwE;GACAO,sBAAsB,IAAIjE,4BACtBkC,UAAUE,QAAgC/D,gBAAAA,CAAAA;GAE9C6F,4BAA4B,IAAIpE,kCAC5BoC,UAAUE,QAAsChE,sBAAAA,CAAAA;GAEpDwF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI1E,6BAA6B;GACtD2E,gBAAgB,IAAIzD,sBAAsB;IACtC0C,YAAY,IAAIpE,eAAegE,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAIzD,0BACpBsB,UAAUE,QAA8BvD,cAAAA,CAAAA;GAE5CyF,0BAA0B,IAAI5D,gCAC1BwB,UAAUE,QAAoCxD,oBAAAA,CAAAA;GAGlD8E;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAI/E,8BAA8B,EAAE6D,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAIlF,8BAA8B;GACxD+D,YAAY,IAAI/C,uBAAuB6C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuBtF,8BAA8B;GACvDqE;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY7B,IAAAA;EAQnC,MAAM8B,0BAA0B,IAAItD,wBAAwB;GACxDqC;GACAC;GACAC;GACAgB,YAAY1D,cAAciB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAcA,MAAMyD,WAAW3C,UAAU4C,IAAIvD,qBAAqBwD,QAAQ,IACxD7C,UAAUE,QAAmBb,qBAAqBwD,QAAQ,IAC1D,IAAI7E,qBAAqB+C,YAAY,EACjC+B,eAAe7C,OAAO8C,uBAClB,IAAI9D,gBAAgBgB,OAAO8C,oBAAoB,IAC/C,KACR,CAAA;EAEJ,MAAMC,iBAAiB,IAAI5D,eAAe;GACtCuD;GACAlC,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAOA,IAAI+D;EACJ,IAAIjD,UAAU4C,IAAIjF,yBAAyBH,wBAAwB,GAC/DwC,UAAUkD,WAAWvF,yBAAyBH,wBAAwB;EAE1E,IAAIqD,eAAe;GACfoC,sBAAsB,IAAIzF,yBAAyB;IAC/C2F,WAAWtC,cAAcsC,aAAa,CAAC;IACvCC,sBAAsBtC;IACtBuC,cAAcf;IACd7B,QAAQT,UAAUE,QAAQhB,kBAAAA;GAC9B,CAAA;GACAc,UAAUsD,SAAS3F,yBAAyBH,0BAA0B,EAAE+F,UAAUN,oBAAoB,CAAA;EAC1G;EAEA,MAAMO,SAAS,MAAMvC,gBAAgBwC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMf,wBAAwBkB,eAAeD,KAAAA;GAC7C,MAAMV,eAAeW,eAAeD,KAAAA;GAGpC,IAAIT,uBAAuB,CAACA,oBAAoBW,iBAAiBF,KAAAA,GAC7D,MAAMT,oBAAoBU,eAAeD,KAAAA;EAEjD;EAEA,IAAIzD,OAAO4D,oCACP,MAAM,KAAKC,oBAAoB/C,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB0C,oBACZ/C,YACAK,kBACa;EACb,MAAM2C,gBAAgB,MAAM3C,iBAAiB4C,cAAcpH,iBAAiBqH,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBnD,WAAWoD,cAAc9H,gBAAAA;EAChD,MAAM+H,eAAerD,WAAWoD,cAActH,sBAAAA;EAE9C,MAAMwH,cAAc,MAAMH,eAAeT,KAAI;EAC7C,KAAK,MAAMa,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/module.d.ts

@@ -6,24 +6,5 @@ export declare class CompositeProvisioningSource implements IProvisioningSource
     constructor(sources: IProvisioningSource[]);
     load(container: IContainer): Promise<RootProvisioningEntity>;
     merge(target: RootProvisioningEntity, source: RootProvisioningEntity): void;
-    private buildEntityKey;
-    private mergeEntities;
-    /**
-     * Deep-merge two entries sharing a composite key. The later source wins
-     * per attribute, but relations are UNIONED — a later source (e.g. a
-     * mounted provisioning file) extending a built-in entry (the default
-     * source's master realm) must not silently drop the built-in relations
-     * (admin user, system client).
-     *
-     * Policy extraAttributes merge per key with the later source winning —
-     * like attributes, NOT like relations: an EA value (a names denylist,
-     * an ATTRIBUTES query tree) is policy configuration, and unioning would
-     * make shrinking a list impossible and fabricate predicates neither
-     * source authored.
-     */
-    private mergeEntity;
-    private mergeRecord;
-    private mergeValue;
-    private isEntityArray;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/app/modules/provisioning/sources/composite/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAmBxC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;IAQpE,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,aAAa;IAyBrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;CAKxB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AAEtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;CAOvE"}

package/dist/app/modules/provisioning/sources/composite/module.mjs

@@ -1,7 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { isObject } from "@authup/kit";
+import { mergeProvisioningEntities } from "../../../../../core/provisioning/merge/module.mjs";
+import "../../../../../core/provisioning/merge/index.mjs";
 //#region src/app/modules/provisioning/sources/composite/module.ts
 var CompositeProvisioningSource = class {
 	sources;
@@ -14,82 +15,11 @@ var CompositeProvisioningSource = class {
 		return output;
 	}
 	merge(target, source) {
-		target.policies = this.mergeEntities(target.policies, source.policies);
-		target.permissions = this.mergeEntities(target.permissions, source.permissions);
-		target.roles = this.mergeEntities(target.roles, source.roles);
-		target.scopes = this.mergeEntities(target.scopes, source.scopes);
-		target.realms = this.mergeEntities(target.realms, source.realms);
-	}
-	buildEntityKey(attributes) {
-		if (!attributes.name) return void 0;
-		return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
-	}
-	mergeEntities(target, source) {
-		if (!source) return target;
-		if (!target) return [...source];
-		const result = [...target];
-		source.forEach((item) => {
-			const key = this.buildEntityKey(item.attributes);
-			if (!key) {
-				result.push(item);
-				return;
-			}
-			const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);
-			if (idx !== -1) result[idx] = this.mergeEntity(result[idx], item);
-			else result.push(item);
-		});
-		return result;
-	}
-	/**
-	* Deep-merge two entries sharing a composite key. The later source wins
-	* per attribute, but relations are UNIONED — a later source (e.g. a
-	* mounted provisioning file) extending a built-in entry (the default
-	* source's master realm) must not silently drop the built-in relations
-	* (admin user, system client).
-	*
-	* Policy extraAttributes merge per key with the later source winning —
-	* like attributes, NOT like relations: an EA value (a names denylist,
-	* an ATTRIBUTES query tree) is policy configuration, and unioning would
-	* make shrinking a list impossible and fabricate predicates neither
-	* source authored.
-	*/ mergeEntity(target, source) {
-		const output = {
-			...target,
-			...source
-		};
-		output.attributes = {
-			...target.attributes,
-			...source.attributes
-		};
-		if (target.strategy && !source.strategy) output.strategy = target.strategy;
-		if (target.relations && source.relations) output.relations = this.mergeRecord(target.relations, source.relations);
-		else if (target.relations && !source.relations) output.relations = target.relations;
-		if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
-			...target.extraAttributes,
-			...source.extraAttributes
-		};
-		else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
-		if (target.children && source.children) output.children = this.mergeEntities(target.children, source.children);
-		else if (target.children && !source.children) output.children = target.children;
-		return output;
-	}
-	mergeRecord(target, source) {
-		const output = { ...target };
-		for (const key of Object.keys(source)) output[key] = key in target ? this.mergeValue(target[key], source[key]) : source[key];
-		return output;
-	}
-	mergeValue(target, source) {
-		if (typeof target === "undefined") return source;
-		if (typeof source === "undefined") return target;
-		if (Array.isArray(target) && Array.isArray(source)) {
-			if (this.isEntityArray(target) || this.isEntityArray(source)) return this.mergeEntities(target, source);
-			return [.../* @__PURE__ */ new Set([...target, ...source])];
-		}
-		if (isObject(target) && isObject(source)) return this.mergeRecord(target, source);
-		return source;
-	}
-	isEntityArray(value) {
-		return value.some((item) => isObject(item) && "attributes" in item);
+		target.policies = mergeProvisioningEntities(target.policies, source.policies);
+		target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);
+		target.roles = mergeProvisioningEntities(target.roles, source.roles);
+		target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);
+		target.realms = mergeProvisioningEntities(target.realms, source.realms);
 	}
 };
 //#endregion

package/dist/app/modules/provisioning/sources/composite/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["isObject","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","mergeEntities","permissions","roles","scopes","realms","buildEntityKey","attributes","name","undefined","realmId","clientId","result","forEach","item","key","push","idx","findIndex","r","mergeEntity","strategy","relations","mergeRecord","extraAttributes","children","Object","keys","mergeValue","Array","isArray","isEntityArray","Set","value","some"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\n/**\n * Structural view of a provisioning entity used by the composite merge.\n * Covers every entity shape (realm, client, user, role, permission, scope,\n * policy): the composite-key attribute bag plus the deep-mergeable groups.\n */\ntype MergeableProvisioningEntity = {\n    attributes: {\n        name?: string,\n        realmId?: string | null,\n        clientId?: string | null,\n    },\n    strategy?: unknown,\n    relations?: Record<string, unknown>,\n    children?: MergeableProvisioningEntity[],\n    extraAttributes?: Record<string, unknown>,\n};\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = this.mergeEntities(target.policies, source.policies);\n        target.permissions = this.mergeEntities(target.permissions, source.permissions);\n        target.roles = this.mergeEntities(target.roles, source.roles);\n        target.scopes = this.mergeEntities(target.scopes, source.scopes);\n        target.realms = this.mergeEntities(target.realms, source.realms);\n    }\n\n    private buildEntityKey(\n        attributes: MergeableProvisioningEntity['attributes'],\n    ): string | undefined {\n        if (!attributes.name) return undefined;\n        return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n    }\n\n    private mergeEntities<T extends MergeableProvisioningEntity>(\n        target: T[] | undefined,\n        source: T[] | undefined,\n    ): T[] | undefined {\n        if (!source) return target;\n        if (!target) return [...source];\n\n        const result = [...target];\n        source.forEach((item) => {\n            const key = this.buildEntityKey(item.attributes);\n            if (!key) {\n                result.push(item);\n                return;\n            }\n\n            const idx = result.findIndex((r) => this.buildEntityKey(r.attributes) === key);\n            if (idx !== -1) {\n                result[idx] = this.mergeEntity(result[idx], item) as T;\n            } else {\n                result.push(item);\n            }\n        });\n        return result;\n    }\n\n    /**\n     * Deep-merge two entries sharing a composite key. The later source wins\n     * per attribute, but relations are UNIONED — a later source (e.g. a\n     * mounted provisioning file) extending a built-in entry (the default\n     * source's master realm) must not silently drop the built-in relations\n     * (admin user, system client).\n     *\n     * Policy extraAttributes merge per key with the later source winning —\n     * like attributes, NOT like relations: an EA value (a names denylist,\n     * an ATTRIBUTES query tree) is policy configuration, and unioning would\n     * make shrinking a list impossible and fabricate predicates neither\n     * source authored.\n     */\n    private mergeEntity(\n        target: MergeableProvisioningEntity,\n        source: MergeableProvisioningEntity,\n    ): MergeableProvisioningEntity {\n        const output = { ...target, ...source };\n\n        output.attributes = { ...target.attributes, ...source.attributes };\n\n        if (target.strategy && !source.strategy) {\n            output.strategy = target.strategy;\n        }\n\n        if (target.relations && source.relations) {\n            output.relations = this.mergeRecord(target.relations, source.relations);\n        } else if (target.relations && !source.relations) {\n            output.relations = target.relations;\n        }\n\n        if (target.extraAttributes && source.extraAttributes) {\n            output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n        } else if (target.extraAttributes && !source.extraAttributes) {\n            output.extraAttributes = target.extraAttributes;\n        }\n\n        if (target.children && source.children) {\n            output.children = this.mergeEntities(target.children, source.children);\n        } else if (target.children && !source.children) {\n            output.children = target.children;\n        }\n\n        return output;\n    }\n\n    private mergeRecord(\n        target: Record<string, unknown>,\n        source: Record<string, unknown>,\n    ): Record<string, unknown> {\n        const output : Record<string, unknown> = { ...target };\n        for (const key of Object.keys(source)) {\n            output[key] = key in target ?\n                this.mergeValue(target[key], source[key]) :\n                source[key];\n        }\n        return output;\n    }\n\n    private mergeValue(target: unknown, source: unknown): unknown {\n        if (typeof target === 'undefined') return source;\n        if (typeof source === 'undefined') return target;\n\n        if (Array.isArray(target) && Array.isArray(source)) {\n            if (this.isEntityArray(target) || this.isEntityArray(source)) {\n                return this.mergeEntities(\n                    target as MergeableProvisioningEntity[],\n                    source as MergeableProvisioningEntity[],\n                );\n            }\n            return [...new Set([...target, ...source])];\n        }\n\n        if (isObject(target) && isObject(source)) {\n            return this.mergeRecord(target, source);\n        }\n\n        return source;\n    }\n\n    private isEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n        return value.some(\n            (item) => isObject(item) && 'attributes' in item,\n        );\n    }\n}\n"],"mappings":";;;;;AA6BA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAW,KAAKC,cAAcF,OAAOC,UAAUJ,OAAOI,QAAQ;EACrED,OAAOG,cAAc,KAAKD,cAAcF,OAAOG,aAAaN,OAAOM,WAAW;EAC9EH,OAAOI,QAAQ,KAAKF,cAAcF,OAAOI,OAAOP,OAAOO,KAAK;EAC5DJ,OAAOK,SAAS,KAAKH,cAAcF,OAAOK,QAAQR,OAAOQ,MAAM;EAC/DL,OAAOM,SAAS,KAAKJ,cAAcF,OAAOM,QAAQT,OAAOS,MAAM;CACnE;CAEQC,eACJC,YACkB;EAClB,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;EAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;CACpF;CAEQV,cACJF,QACAH,QACe;EACf,IAAI,CAACA,QAAQ,OAAOG;EACpB,IAAI,CAACA,QAAQ,OAAO,CAAIH,GAAAA,MAAO;EAE/B,MAAMgB,SAAS,CAAIb,GAAAA,MAAO;EAC1BH,OAAOiB,SAASC,SAAAA;GACZ,MAAMC,MAAM,KAAKT,eAAeQ,KAAKP,UAAU;GAC/C,IAAI,CAACQ,KAAK;IACNH,OAAOI,KAAKF,IAAAA;IACZ;GACJ;GAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAM,KAAKb,eAAea,EAAEZ,UAAU,MAAMQ,GAAAA;GAC1E,IAAIE,QAAQ,IACRL,OAAOK,OAAO,KAAKG,YAAYR,OAAOK,MAAMH,IAAAA;QAE5CF,OAAOI,KAAKF,IAAAA;EAEpB,CAAA;EACA,OAAOF;CACX;;;;;;;;;;;;;IAeA,YACIb,QACAH,QAC2B;EAC3B,MAAML,SAAS;GAAE,GAAGQ;GAAQ,GAAGH;EAAO;EAEtCL,OAAOgB,aAAa;GAAE,GAAGR,OAAOQ;GAAY,GAAGX,OAAOW;EAAW;EAEjE,IAAIR,OAAOsB,YAAY,CAACzB,OAAOyB,UAC3B9B,OAAO8B,WAAWtB,OAAOsB;EAG7B,IAAItB,OAAOuB,aAAa1B,OAAO0B,WAC3B/B,OAAO+B,YAAY,KAAKC,YAAYxB,OAAOuB,WAAW1B,OAAO0B,SAAS;OACnE,IAAIvB,OAAOuB,aAAa,CAAC1B,OAAO0B,WACnC/B,OAAO+B,YAAYvB,OAAOuB;EAG9B,IAAIvB,OAAOyB,mBAAmB5B,OAAO4B,iBACjCjC,OAAOiC,kBAAkB;GAAE,GAAGzB,OAAOyB;GAAiB,GAAG5B,OAAO4B;EAAgB;OAC7E,IAAIzB,OAAOyB,mBAAmB,CAAC5B,OAAO4B,iBACzCjC,OAAOiC,kBAAkBzB,OAAOyB;EAGpC,IAAIzB,OAAO0B,YAAY7B,OAAO6B,UAC1BlC,OAAOkC,WAAW,KAAKxB,cAAcF,OAAO0B,UAAU7B,OAAO6B,QAAQ;OAClE,IAAI1B,OAAO0B,YAAY,CAAC7B,OAAO6B,UAClClC,OAAOkC,WAAW1B,OAAO0B;EAG7B,OAAOlC;CACX;CAEQgC,YACJxB,QACAH,QACuB;EACvB,MAAML,SAAmC,EAAE,GAAGQ,OAAO;EACrD,KAAK,MAAMgB,OAAOW,OAAOC,KAAK/B,MAAAA,GAC1BL,OAAOwB,OAAOA,OAAOhB,SACjB,KAAK6B,WAAW7B,OAAOgB,MAAMnB,OAAOmB,IAAI,IACxCnB,OAAOmB;EAEf,OAAOxB;CACX;CAEQqC,WAAW7B,QAAiBH,QAA0B;EAC1D,IAAI,OAAOG,WAAW,aAAa,OAAOH;EAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOG;EAE1C,IAAI8B,MAAMC,QAAQ/B,MAAAA,KAAW8B,MAAMC,QAAQlC,MAAAA,GAAS;GAChD,IAAI,KAAKmC,cAAchC,MAAAA,KAAW,KAAKgC,cAAcnC,MAAAA,GACjD,OAAO,KAAKK,cACRF,QACAH,MAAAA;GAGR,OAAO,CAAI,mBAAA,IAAIoC,IAAI,CAAIjC,GAAAA,QAAWH,GAAAA,MAAO,CAAA,CAAE;EAC/C;EAEA,IAAIV,SAASa,MAAAA,KAAWb,SAASU,MAAAA,GAC7B,OAAO,KAAK2B,YAAYxB,QAAQH,MAAAA;EAGpC,OAAOA;CACX;CAEQmC,cAAcE,OAA0D;EAC5E,OAAOA,MAAMC,MACRpB,SAAS5B,SAAS4B,IAAAA,KAAS,gBAAgBA,IAAAA;CAEpD;AACJ"}
+{"version":3,"file":"module.mjs","names":["mergeProvisioningEntities","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","permissions","roles","scopes","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport { mergeProvisioningEntities } from '../../../../../core/provisioning/merge/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = mergeProvisioningEntities(target.policies, source.policies);\n        target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);\n        target.roles = mergeProvisioningEntities(target.roles, source.roles);\n        target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);\n        target.realms = mergeProvisioningEntities(target.realms, source.realms);\n    }\n}\n"],"mappings":";;;;;;AAYA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAWd,0BAA0Ba,OAAOC,UAAUJ,OAAOI,QAAQ;EAC5ED,OAAOE,cAAcf,0BAA0Ba,OAAOE,aAAaL,OAAOK,WAAW;EACrFF,OAAOG,QAAQhB,0BAA0Ba,OAAOG,OAAON,OAAOM,KAAK;EACnEH,OAAOI,SAASjB,0BAA0Ba,OAAOI,QAAQP,OAAOO,MAAM;EACtEJ,OAAOK,SAASlB,0BAA0Ba,OAAOK,QAAQR,OAAOQ,MAAM;CAC1E;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAwEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAyEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -143,6 +143,7 @@ var DefaultProvisioningSource = class {
 					PermissionName.IDENTITY_PROVIDER_CREATE,
 					PermissionName.IDENTITY_PROVIDER_UPDATE,
 					PermissionName.IDENTITY_PROVIDER_DELETE,
+					PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,
 					PermissionName.KEY_CREATE,
 					PermissionName.KEY_UPDATE,
 					PermissionName.KEY_DELETE,

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CACH;GACL;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;EACH;CACL;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAyB;IACzGzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAuB;EAC1G;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAU;IAC3B;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IAExBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IACxBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;IAClB;IAIDL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;IAClB,EACL;GACJ;EACJ,CACH;CACL;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C5C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM0C,yBAAyB,IAAI5E,uBAAAA;EAEnC,IAAI6E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXrE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAW;EAC5B;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAU6C,QAAQ,CAC1B;GACIhD,UAAU8C;GACVxE,YAAY;IACRC,MAAM;IACN0E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOrF,mBAAmB,OAAA;IAC1BsF,QAAQV,OAAOW;GACnB;GACAnD,WAAW,EAAEoD,aAAa,CAAC3F,eAAgB,EAAC;EAChD,CACH;EAED,MAAM4F,2BAA2B,IAAIxF,yBAAAA;EAErC,IAAIyF;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;GAAkB;EAC5G;OAEAmF,iBAAiB;GACbhF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;GAAqB;EAC/D;EAGJsE,YAAYzC,YAAYyC,YAAYzC,aAAa,CAAC;EAClDyC,YAAYzC,UAAUwD,UAAU,CAC5B;GACI3D,UAAUyD;GACVnF,YAAY;IACRK,SAAS;IACTiF,YAAYpG,iBAAiBqG;IAC7BC,oBAAoBrG,yBAAyBsG;IAC7CxF,MAAM;IACNyF,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAhE,WAAW,EAAEoD,aAAa,CAAC3F,eAAgB,EAAC;EAChD,CACH;EAED,OAAO,CAACgF,WAAY;CACxB;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQpG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BkG,aAAa,KAAK/E,iBAAgB;GAClCgF,QAAQ,KAAKpE,YAAW;GACxBqE,OAAO,KAAKpE,WAAU;GACtBqE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","IDENTITY_PROVIDER_ACCOUNT_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CACH;GACL;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;EACH;CACL;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAyB;IACzGzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAuB;EAC1G;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAU;IAC3B;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IAExBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IACxBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;IAClB;IAIDL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;IAClB,EACL;GACJ;EACJ,CACH;CACL;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C7C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM2C,yBAAyB,IAAI7E,uBAAAA;EAEnC,IAAI8E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXtE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAW;EAC5B;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAU8C,QAAQ,CAC1B;GACIjD,UAAU+C;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOtF,mBAAmB,OAAA;IAC1BuF,QAAQV,OAAOW;GACnB;GACApD,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,MAAM6F,2BAA2B,IAAIzF,yBAAAA;EAErC,IAAI0F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;GAAkB;EAC5G;OAEAoF,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;GAAqB;EAC/D;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAUyD,UAAU,CAC5B;GACI5D,UAAU0D;GACVpF,YAAY;IACRK,SAAS;IACTkF,YAAYrG,iBAAiBsG;IAC7BC,oBAAoBtG,yBAAyBuG;IAC7CzF,MAAM;IACN0F,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAjE,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,OAAO,CAACiF,WAAY;CACxB;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQrG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BmG,aAAa,KAAKhF,iBAAgB;GAClCiF,QAAQ,KAAKrE,YAAW;GACxBsE,OAAO,KAAKrE,WAAU;GACtBsE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/core/entities/client/index.d.ts

@@ -1,6 +1,6 @@
 export * from './constants.ts';
 export * from './service.ts';
 export * from './types.ts';
-export * from './web-client.ts';
+export * from './system-clients.ts';
 export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC"}

package/dist/core/entities/client/index.mjs

@@ -4,5 +4,5 @@ import.meta.url;
 import { CLIENT_READ_PERMISSIONS } from "./constants.mjs";
 import { clientSchema } from "./schema.mjs";
 import { ClientService } from "./service.mjs";
-import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./web-client.mjs";
-export { CLIENT_READ_PERMISSIONS, ClientService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes, clientSchema };
+import { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes } from "./system-clients.mjs";
+export { CLIENT_READ_PERMISSIONS, ClientService, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes, clientSchema };

package/dist/core/entities/client/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CAiCvB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CA2CvB,CAAC"}

package/dist/core/entities/client/schema.mjs

@@ -47,6 +47,16 @@ const schemaMapping = {
 }
 const clientSchema = defineSchema({
 	name: EntityType.CLIENT,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["displayName"],
+		["realmId"],
+		["active"],
+		["builtIn"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: {
 		default: [
 			"id",
@@ -73,20 +83,29 @@ const clientSchema = defineSchema({
 		allowed: ["secret"],
 		validateMany: createFieldsReadGate({ secret: secretReadGate })
 	},
-	filters: { allowed: [
-		"id",
-		"name",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"name",
+			"displayName",
+			"realmId",
+			"active",
+			"builtIn"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm", "accessPolicy"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });