@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/core/entities/identity-provider-account/error.d.ts

@@ -0,0 +1,7 @@
+import { ValidationError } from '@authup/errors';
+export declare const IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE: unique symbol;
+export declare class IdentityProviderAccountUnlinkBlockedError extends ValidationError {
+    constructor();
+}
+export declare function isIdentityProviderAccountUnlinkBlockedError(input: unknown): input is IdentityProviderAccountUnlinkBlockedError;
+//# sourceMappingURL=error.d.ts.map

package/dist/core/entities/identity-provider-account/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAEH,eAAe,EAIlB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,uDAAuD,eAA8E,CAAC;AAEnJ,qBAAa,yCAA0C,SAAQ,eAAe;;CAQ7E;AAED,wBAAgB,2CAA2C,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yCAAyC,CAI9H"}

package/dist/core/entities/identity-provider-account/error.mjs

@@ -0,0 +1,24 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ErrorCode, ValidationError, isAuthupError, markInstanceof, matchesInstanceof } from "@authup/errors";
+//#region src/core/entities/identity-provider-account/error.ts
+const IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE = Symbol.for("@authup/server-core/IdentityProviderAccountUnlinkBlockedError");
+var IdentityProviderAccountUnlinkBlockedError = class extends ValidationError {
+	constructor() {
+		super({
+			code: ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED,
+			message: "The last linked account of a user without a password can not be removed."
+		});
+		markInstanceof(this, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE);
+	}
+};
+function isIdentityProviderAccountUnlinkBlockedError(input) {
+	if (matchesInstanceof(input, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE)) return true;
+	if (!isAuthupError(input)) return false;
+	return input.code === ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED;
+}
+//#endregion
+export { IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountUnlinkBlockedError, isIdentityProviderAccountUnlinkBlockedError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/core/entities/identity-provider-account/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["ErrorCode","ValidationError","isAuthupError","markInstanceof","matchesInstanceof","IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE","Symbol","for","IdentityProviderAccountUnlinkBlockedError","code","IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED","message","isIdentityProviderAccountUnlinkBlockedError","input"],"sources":["../../../../src/core/entities/identity-provider-account/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    ErrorCode, \n    ValidationError, \n    isAuthupError, \n    markInstanceof, \n    matchesInstanceof,\n} from '@authup/errors';\n\nexport const IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE = Symbol.for('@authup/server-core/IdentityProviderAccountUnlinkBlockedError');\n\nexport class IdentityProviderAccountUnlinkBlockedError extends ValidationError {\n    constructor() {\n        super({\n            code: ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED,\n            message: 'The last linked account of a user without a password can not be removed.',\n        });\n        markInstanceof(this, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE);\n    }\n}\n\nexport function isIdentityProviderAccountUnlinkBlockedError(input: unknown): input is IdentityProviderAccountUnlinkBlockedError {\n    if (matchesInstanceof(input, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE)) return true;\n    if (!isAuthupError(input)) return false;\n    return input.code === ErrorCode.IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED;\n}\n"],"mappings":";;;;;AAeA,MAAaK,0DAA0DC,OAAOC,IAAI,+DAAA;AAElF,IAAaC,4CAAb,cAA+DP,gBAAAA;CAC3D,cAAc;EACV,MAAM;GACFQ,MAAMT,UAAUU;GAChBC,SAAS;EACb,CAAA;EACAR,eAAe,MAAME,uDAAAA;CACzB;AACJ;AAEA,SAAgBO,4CAA4CC,OAAc;CACtE,IAAIT,kBAAkBS,OAAOR,uDAAAA,GAA0D,OAAO;CAC9F,IAAI,CAACH,cAAcW,KAAAA,GAAQ,OAAO;CAClC,OAAOA,MAAMJ,SAAST,UAAUU;AACpC"}

package/dist/core/entities/identity-provider-account/index.d.ts

@@ -0,0 +1,5 @@
+export * from './error.ts';
+export * from './service.ts';
+export * from './types.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/identity-provider-account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/identity-provider-account/index.mjs

@@ -0,0 +1,8 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from "./types.mjs";
+import { identityProviderAccountSchema } from "./schema.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountUnlinkBlockedError, isIdentityProviderAccountUnlinkBlockedError } from "./error.mjs";
+import { IdentityProviderAccountService } from "./service.mjs";
+export { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, identityProviderAccountSchema, isIdentityProviderAccountUnlinkBlockedError };

package/dist/core/entities/identity-provider-account/schema.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+export declare const identityProviderAccountSchema: import("@rapiq/core").Schema<IdentityProviderAccount, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/identity-provider-account/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAShE,eAAO,MAAM,6BAA6B,4DAsCxC,CAAC"}

package/dist/core/entities/identity-provider-account/schema.mjs

@@ -0,0 +1,52 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from "./types.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/identity-provider-account/schema.ts
+const schemaMapping = { provider: EntityType.IDENTITY_PROVIDER };
+const identityProviderAccountSchema = defineSchema({
+	name: EntityType.IDENTITY_PROVIDER_ACCOUNT,
+	indexes: [
+		["id"],
+		["providerId", "userId"],
+		["userId"],
+		["userRealmId"],
+		["providerUserId", "providerId"],
+		["providerRealmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
+	fields: { default: [
+		"id",
+		"providerUserId",
+		"providerUserName",
+		"providerUserEmail",
+		"createdAt",
+		"updatedAt",
+		"userId",
+		"userRealmId",
+		"providerId",
+		"providerRealmId"
+	] },
+	filters: {
+		allowed: [...IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, "providerRealmId"],
+		indexed: true
+	},
+	relations: {
+		allowed: ["provider"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sorts: {
+		allowed: ["createdAt", "updatedAt"],
+		indexed: true
+	},
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { identityProviderAccountSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/identity-provider-account/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS","createRelationsReadGate","schemaMapping","provider","IDENTITY_PROVIDER","identityProviderAccountSchema","name","IDENTITY_PROVIDER_ACCOUNT","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider-account/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\n// `provider` is a deliberately ungated include target: the provider list\n// is anonymous and the entity columns are benign (secrets live in EA).\nconst schemaMapping = { provider: EntityType.IDENTITY_PROVIDER };\n\nexport const identityProviderAccountSchema = defineSchema<IdentityProviderAccount>({\n    name: EntityType.IDENTITY_PROVIDER_ACCOUNT,\n    indexes: [\n        ['id'],\n        ['providerId', 'userId'],\n        ['userId'],\n        ['userRealmId'],\n        ['providerUserId', 'providerId'],\n        ['providerRealmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        // `default` (not just `allowed`) so the adapter's plan-039\n        // force-select can dedupe against an explicit projection. The\n        // external-token columns (accessToken/refreshToken + their expiry\n        // metadata) are `select: false` on the entity, so they can never\n        // ride ANY read surface — the collection projection, an explicit\n        // `fields=accessToken`, or the un-projected single-record read —\n        // and are auto-exempt from the boot field-coverage assertion.\n        default: [\n            'id',\n            'providerUserId',\n            'providerUserName',\n            'providerUserEmail',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'userRealmId',\n            'providerId',\n            'providerRealmId',\n        ],\n    },\n    filters: { allowed: [...IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, 'providerRealmId'], indexed: true },\n    relations: { allowed: ['provider'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAeA,MAAMI,gBAAgB,EAAEC,UAAUJ,WAAWK,kBAAkB;AAE/D,MAAaC,gCAAgCP,aAAsC;CAC/EQ,MAAMP,WAAWQ;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,cAAc,QAAS;EACxB,CAAC,QAAS;EACV,CAAC,aAAc;EACf,CAAC,kBAAkB,YAAa;EAChC,CAAC,iBAAkB;EACnB,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EAQJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS,CAAIZ,GAAAA,uCAAuC,iBAAkB;EAAEa,SAAS;CAAK;CACjGC,WAAW;EAAEF,SAAS,CAAC,UAAW;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CACrFc,OAAO;EAAEJ,SAAS,CAAC,aAAa,WAAY;EAAEC,SAAS;CAAK;CAC5DI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/identity-provider-account/service.d.ts

@@ -0,0 +1,24 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { IUserIdentityRepository } from '../../identity/entities/user/types.ts';
+import type { EventRequestContext, IEventService } from '../event/index.ts';
+import type { IIdentityProviderAccountRepository, IIdentityProviderAccountService, IdentityProviderAccountServiceReadOptions } from './types.ts';
+export type IdentityProviderAccountServiceContext = {
+    repository: IIdentityProviderAccountRepository;
+    userRepository: IUserIdentityRepository;
+    eventService?: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+};
+export declare class IdentityProviderAccountService extends AbstractEntityService implements IIdentityProviderAccountService {
+    protected repository: IIdentityProviderAccountRepository;
+    protected userRepository: IUserIdentityRepository;
+    protected eventService?: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    constructor(ctx: IdentityProviderAccountServiceContext);
+    protected isOwnedBy(entity: IdentityProviderAccount, actor: ActorContext): boolean;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    getOne(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+    delete(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/identity-provider-account/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG5E,OAAO,KAAK,EACR,kCAAkC,EAClC,+BAA+B,EAC/B,yCAAyC,EAC5C,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,qCAAqC,GAAG;IAChD,UAAU,EAAE,kCAAkC,CAAC;IAC/C,cAAc,EAAE,uBAAuB,CAAC;IACxC,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;CAC1D,CAAC;AAEF,qBAAa,8BAA+B,SAAQ,qBAAsB,YAAW,+BAA+B;IAChH,SAAS,CAAC,UAAU,EAAE,kCAAkC,CAAC;IAEzD,SAAS,CAAC,cAAc,EAAE,uBAAuB,CAAC;IAElD,SAAS,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;gBAErD,GAAG,EAAE,qCAAqC;IAQtD,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IAM5E,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yCAA8C,GACxD,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAsD7D,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yCAA8C,GACxD,OAAO,CAAC,uBAAuB,CAAC;IAsB7B,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,yCAA8C,GACxD,OAAO,CAAC,uBAAuB,CAAC;CA2DtC"}

package/dist/core/entities/identity-provider-account/service.mjs

@@ -0,0 +1,129 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { identityProviderAccountSchema } from "./schema.mjs";
+import { decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
+import { IdentityProviderAccountUnlinkBlockedError } from "./error.mjs";
+import { EventName, EventRefType, EventScope, IdentityType, PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+//#region src/core/entities/identity-provider-account/service.ts
+var IdentityProviderAccountService = class extends AbstractEntityService {
+	repository;
+	userRepository;
+	eventService;
+	requestContext;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.userRepository = ctx.userRepository;
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+	}
+	isOwnedBy(entity, actor) {
+		return !!actor.identity && actor.identity.type === IdentityType.USER && entity.userId === actor.identity.data.id;
+	}
+	async getMany(query, actor, options = {}) {
+		const parsed = await decodeQuery(query, {
+			schema: identityProviderAccountSchema,
+			actor
+		});
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });
+		} catch (e) {
+			if (!actor.identity || actor.identity.type !== IdentityType.USER) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(parsed, {
+			userId: actor.identity.data.id,
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const { data: entities, meta } = await this.repository.findMany(parsed, { ...options.realmId ? { realmId: options.realmId } : {} });
+		const data = [];
+		let { total } = meta;
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						[BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null
+					})
+				});
+				data.push(entity);
+			} catch {
+				total -= 1;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.userRealmId !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					[BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null
+				})
+			});
+		}
+		return entity;
+	}
+	async delete(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.userRealmId !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					[BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null
+				})
+			});
+		}
+		const user = await this.userRepository.findOneById(entity.userId);
+		const userHasOtherLogin = !user || !!user.password;
+		const { id: entityId } = entity;
+		if (!await this.repository.removeGuarded(entity, userHasOtherLogin)) throw new IdentityProviderAccountUnlinkBlockedError();
+		entity.id = entityId;
+		const requestContext = this.requestContext ? this.requestContext() : void 0;
+		await this.eventService?.record({
+			scope: EventScope.IDENTITY,
+			name: EventName.IDENTITY_PROVIDER_UNLINKED,
+			refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,
+			refId: entityId,
+			realmId: entity.userRealmId ?? null,
+			actorType: actor.identity?.type ?? null,
+			actorId: actor.identity?.data.id ?? null,
+			actorName: actor.identity?.data.name ?? null,
+			sessionId: requestContext?.sessionId ?? null,
+			requestPath: requestContext?.requestPath ?? null,
+			requestMethod: requestContext?.requestMethod ?? null,
+			requestIpAddress: requestContext?.requestIpAddress ?? null,
+			requestUserAgent: requestContext?.requestUserAgent ?? null,
+			data: { providerId: entity.providerId }
+		});
+		return entity;
+	}
+};
+//#endregion
+export { IdentityProviderAccountService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/identity-provider-account/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","EntityNotFoundError","EventName","EventRefType","EventScope","IdentityType","PermissionName","AbstractEntityService","decodeQuery","IdentityProviderAccountUnlinkBlockedError","identityProviderAccountSchema","IdentityProviderAccountService","repository","userRepository","eventService","requestContext","ctx","isOwnedBy","entity","actor","identity","type","USER","userId","data","id","getMany","query","options","parsed","schema","canReadAll","permissionEvaluator","preEvaluate","name","IDENTITY_PROVIDER_ACCOUNT_READ","e","findMany","realmId","entities","meta","total","push","evaluate","ATTRIBUTES","REALM_MATCH","userRealmId","getOne","findOneById","delete","IDENTITY_PROVIDER_ACCOUNT_DELETE","user","userHasOtherLogin","password","entityId","removed","removeGuarded","undefined","record","scope","IDENTITY","IDENTITY_PROVIDER_UNLINKED","refType","IDENTITY_PROVIDER_ACCOUNT","refId","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","providerId"],"sources":["../../../../src/core/entities/identity-provider-account/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { EntityNotFoundError } from '@authup/errors';\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport {\n    EventName, \n    EventRefType, \n    EventScope, \n    IdentityType, \n    PermissionName,\n} from '@authup/core-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { decodeQuery } from '../../query/index.ts';\nimport type { IUserIdentityRepository } from '../../identity/entities/user/types.ts';\nimport type { EventRequestContext, IEventService } from '../event/index.ts';\nimport { IdentityProviderAccountUnlinkBlockedError } from './error.ts';\nimport { identityProviderAccountSchema } from './schema.ts';\nimport type {\n    IIdentityProviderAccountRepository,\n    IIdentityProviderAccountService,\n    IdentityProviderAccountServiceReadOptions,\n} from './types.ts';\n\nexport type IdentityProviderAccountServiceContext = {\n    repository: IIdentityProviderAccountRepository,\n    userRepository: IUserIdentityRepository,\n    eventService?: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n};\n\nexport class IdentityProviderAccountService extends AbstractEntityService implements IIdentityProviderAccountService {\n    protected repository: IIdentityProviderAccountRepository;\n\n    protected userRepository: IUserIdentityRepository;\n\n    protected eventService?: IEventService;\n\n    protected requestContext?: () => EventRequestContext | undefined;\n\n    constructor(ctx: IdentityProviderAccountServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.userRepository = ctx.userRepository;\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n    }\n\n    protected isOwnedBy(entity: IdentityProviderAccount, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            actor.identity.type === IdentityType.USER &&\n            entity.userId === actor.identity.data.id;\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: IdentityProviderAccountServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>> {\n        const parsed = await decodeQuery(query, { schema: identityProviderAccountSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });\n        } catch (e) {\n            // Rows are always user-owned, so only a user identity has a\n            // self-service scope to fall back to.\n            if (!actor.identity || actor.identity.type !== IdentityType.USER) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            return this.repository.findMany(parsed, {\n                userId: actor.identity!.data.id,\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // No compile() WHERE-pushdown here: the compiled realm-reach\n        // condition binds the row's `realmId` column and this entity\n        // carries none (the owner realm is `userRealmId`), so the per-row\n        // evaluation below is the sound path.\n        const { data: entities, meta } = await this.repository.findMany(parsed, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n\n        const data: IdentityProviderAccount[] = [];\n        let { total } = meta;\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        [BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null,\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                total -= 1;\n            }\n        }\n\n        return { data, meta: { ...meta, total } };\n    }\n\n    async getOne(\n        id: string,\n        actor: ActorContext,\n        options: IdentityProviderAccountServiceReadOptions = {},\n    ): Promise<IdentityProviderAccount> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.userRealmId !== options.realmId)) {\n            // A realm mismatch on the nested mount fails as not-found (no\n            // cross-realm existence oracle).\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    [BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null,\n                }),\n            });\n        }\n\n        return entity;\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n        options: IdentityProviderAccountServiceReadOptions = {},\n    ): Promise<IdentityProviderAccount> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.userRealmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    [BuiltInPolicyType.REALM_MATCH]: entity.userRealmId ?? null,\n                }),\n            });\n        }\n\n        // Lockout guard, enforced for EVERY caller (admin included): the\n        // last linked account of a user with no alternative login (no\n        // password) is their only way in. An admin sets a password first.\n        // The count and the delete run atomically in the repository (one\n        // transaction, the user's rows locked), so two concurrent unlinks\n        // cannot both pass the guard and strand the account. `password` is\n        // immutable on this path, so reading it here (outside the\n        // transaction) is safe: a concurrent password set can only make the\n        // guard more permissive, never less.\n        const user = await this.userRepository.findOneById(entity.userId);\n        const userHasOtherLogin = !user || !!user.password;\n\n        const { id: entityId } = entity;\n        const removed = await this.repository.removeGuarded(entity, userHasOtherLogin);\n        if (!removed) {\n            throw new IdentityProviderAccountUnlinkBlockedError();\n        }\n        entity.id = entityId;\n\n        const requestContext = this.requestContext ?\n            this.requestContext() :\n            undefined;\n\n        await this.eventService?.record({\n            scope: EventScope.IDENTITY,\n            name: EventName.IDENTITY_PROVIDER_UNLINKED,\n            refType: EventRefType.IDENTITY_PROVIDER_ACCOUNT,\n            refId: entityId,\n            realmId: entity.userRealmId ?? null,\n            actorType: actor.identity?.type ?? null,\n            actorId: actor.identity?.data.id ?? null,\n            actorName: actor.identity?.data.name ?? null,\n            sessionId: requestContext?.sessionId ?? null,\n            requestPath: requestContext?.requestPath ?? null,\n            requestMethod: requestContext?.requestMethod ?? null,\n            requestIpAddress: requestContext?.requestIpAddress ?? null,\n            requestUserAgent: requestContext?.requestUserAgent ?? null,\n            data: { providerId: entity.providerId },\n        });\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAqCA,IAAaY,iCAAb,cAAoDJ,sBAAAA;CACtCK;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA4C;EACpD,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKC,iBAAiBG,IAAIH;EAC1B,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,iBAAiBC,IAAID;CAC9B;CAEUE,UAAUC,QAAiCC,OAA8B;EAC/E,OAAO,CAAC,CAACA,MAAMC,YACXD,MAAMC,SAASC,SAAShB,aAAaiB,QACrCJ,OAAOK,WAAWJ,MAAMC,SAASI,KAAKC;CAC9C;CAEA,MAAMC,QACFC,OACAR,OACAS,UAAqD,CAAC,GACU;EAChE,MAAMC,SAAS,MAAMrB,YAAYmB,OAAO;GAAEG,QAAQpB;GAA+BS;EAAM,CAAA;EAEvF,IAAIY,aAAa;EACjB,IAAI;GACA,MAAMZ,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5B,eAAe6B,+BAA+B,CAAA;EACtG,SAASC,GAAG;GAGR,IAAI,CAACjB,MAAMC,YAAYD,MAAMC,SAASC,SAAShB,aAAaiB,MACxD,MAAMc;GAEVL,aAAa;EACjB;EAEA,IAAI,CAACA,YACD,OAAO,KAAKnB,WAAWyB,SAASR,QAAQ;GACpCN,QAAQJ,MAAMC,SAAUI,KAAKC;GAC7B,GAAIG,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAOJ,MAAM,EAAEd,MAAMe,UAAUC,SAAS,MAAM,KAAK5B,WAAWyB,SAASR,QAAQ,EAAE,GAAID,QAAQU,UAAU,EAAEA,SAASV,QAAQU,QAAQ,IAAI,CAAC,EAAG,CAAA;EAEnI,MAAMd,OAAkC,CAAA;EACxC,IAAI,EAAEiB,UAAUD;EAEhB,KAAK,MAAMtB,UAAUqB,UAAU;GAC3B,IAAI,KAAKtB,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BK,KAAKkB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMa,oBAAoBW,SAAS;KACrCT,MAAM5B,eAAe6B;KACrBX,MAAMxB,iBAAiB;OAClBD,kBAAkB6C,aAAa1B;OAC/BnB,kBAAkB8C,cAAc3B,OAAO4B,eAAe;KAC3D,CAAA;IACJ,CAAA;IACAtB,KAAKkB,KAAKxB,MAAAA;GACd,QAAQ;IACJuB,SAAS;GACb;EACJ;EAEA,OAAO;GAAEjB;GAAMgB,MAAM;IAAE,GAAGA;IAAMC;GAAM;EAAE;CAC5C;CAEA,MAAMM,OACFtB,IACAN,OACAS,UAAqD,CAAC,GACtB;EAChC,MAAMV,SAAS,MAAM,KAAKN,WAAWoC,YAAYvB,EAAAA;EACjD,IAAI,CAACP,UAAWU,QAAQU,WAAWpB,OAAO4B,gBAAgBlB,QAAQU,SAG9D,MAAM,IAAIrC,oBAAAA;EAGd,IAAI,CAAC,KAAKgB,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5B,eAAe6B,+BAA+B,CAAA;GAClG,MAAMhB,MAAMa,oBAAoBW,SAAS;IACrCT,MAAM5B,eAAe6B;IACrBX,MAAMxB,iBAAiB;MAClBD,kBAAkB6C,aAAa1B;MAC/BnB,kBAAkB8C,cAAc3B,OAAO4B,eAAe;IAC3D,CAAA;GACJ,CAAA;EACJ;EAEA,OAAO5B;CACX;CAEA,MAAM+B,OACFxB,IACAN,OACAS,UAAqD,CAAC,GACtB;EAChC,MAAMV,SAAS,MAAM,KAAKN,WAAWoC,YAAYvB,EAAAA;EACjD,IAAI,CAACP,UAAWU,QAAQU,WAAWpB,OAAO4B,gBAAgBlB,QAAQU,SAC9D,MAAM,IAAIrC,oBAAAA;EAGd,IAAI,CAAC,KAAKgB,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMa,oBAAoBC,YAAY,EAAEC,MAAM5B,eAAe4C,iCAAiC,CAAA;GACpG,MAAM/B,MAAMa,oBAAoBW,SAAS;IACrCT,MAAM5B,eAAe4C;IACrB1B,MAAMxB,iBAAiB;MAClBD,kBAAkB6C,aAAa1B;MAC/BnB,kBAAkB8C,cAAc3B,OAAO4B,eAAe;IAC3D,CAAA;GACJ,CAAA;EACJ;EAWA,MAAMK,OAAO,MAAM,KAAKtC,eAAemC,YAAY9B,OAAOK,MAAM;EAChE,MAAM6B,oBAAoB,CAACD,QAAQ,CAAC,CAACA,KAAKE;EAE1C,MAAM,EAAE5B,IAAI6B,aAAapC;EAEzB,IAAI,CAACqC,MADiB,KAAK3C,WAAW4C,cAActC,QAAQkC,iBAAAA,GAExD,MAAM,IAAI3C,0CAAAA;EAEdS,OAAOO,KAAK6B;EAEZ,MAAMvC,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnB0C,KAAAA;EAEJ,MAAM,KAAK3C,cAAc4C,OAAO;GAC5BC,OAAOvD,WAAWwD;GAClB1B,MAAMhC,UAAU2D;GAChBC,SAAS3D,aAAa4D;GACtBC,OAAOV;GACPhB,SAASpB,OAAO4B,eAAe;GAC/BmB,WAAW9C,MAAMC,UAAUC,QAAQ;GACnC6C,SAAS/C,MAAMC,UAAUI,KAAKC,MAAM;GACpC0C,WAAWhD,MAAMC,UAAUI,KAAKU,QAAQ;GACxCkC,WAAWrD,gBAAgBqD,aAAa;GACxCC,aAAatD,gBAAgBsD,eAAe;GAC5CC,eAAevD,gBAAgBuD,iBAAiB;GAChDC,kBAAkBxD,gBAAgBwD,oBAAoB;GACtDC,kBAAkBzD,gBAAgByD,oBAAoB;GACtDhD,MAAM,EAAEiD,YAAYvD,OAAOuD,WAAW;EAC1C,CAAA;EAEA,OAAOvD;CACX;AACJ"}

package/dist/core/entities/identity-provider-account/types.d.ts

@@ -0,0 +1,69 @@
+import type { IdentityProviderAccount } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+import type { DeepPartial } from 'typeorm';
+import type { IdentityProviderIdentity } from '../../identity/provider/types.ts';
+/**
+ * Filter keys an identity-provider-account list query may target.
+ */
+export declare const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS: readonly ["id", "userId", "providerId", "userRealmId", "providerUserId"];
+export type IdentityProviderAccountFindManyOptions = {
+    /**
+     * Force the result to a single user (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    userId?: string;
+    /**
+     * Restrict the result to a single owner realm (the nested
+     * `/realms/:realmId/identity-provider-accounts` mount). The owner
+     * realm of a row is `userRealmId`.
+     */
+    realmId?: string;
+};
+/**
+ * Unified port: the entity CRUD surface (management API) plus the
+ * account-manager methods the federated login and link flows consume.
+ * One adapter implements both concerns over the same table.
+ */
+export interface IIdentityProviderAccountRepository {
+    findMany(query: IQuery, options?: IdentityProviderAccountFindManyOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    findOneById(id: string): Promise<IdentityProviderAccount | null>;
+    remove(entity: IdentityProviderAccount): Promise<void>;
+    /**
+     * Atomically remove the account, refusing (returning `false`) when it
+     * is the user's LAST linked account and `userHasOtherLogin` is false —
+     * the unlink lockout guard. The count and the delete run in one
+     * transaction with the user's account rows locked (on drivers that
+     * support row locks), so two concurrent unlinks for the same user
+     * cannot both pass the guard and strand a password-less user with no
+     * login. Fires the entity subscriber like `remove`. Returns `true`
+     * when the row was removed.
+     */
+    removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean>;
+    /**
+     * Find identity account with user relation (federated login + link flow).
+     */
+    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;
+    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;
+}
+export type IdentityProviderAccountServiceReadOptions = {
+    realmId?: string;
+};
+export interface IIdentityProviderAccountService {
+    /**
+     * List linked accounts. An actor without
+     * `IDENTITY_PROVIDER_ACCOUNT_READ` is scoped to its own rows.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;
+    /**
+     * Read a single linked account. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+    /**
+     * Unlink. Own rows need no permission. Refuses for EVERY caller when
+     * the row is the user's last linked account and the user has no
+     * password (lockout guard).
+     */
+    delete(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/identity-provider-account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,qCAAqC,0EAMxC,CAAC;AAEX,MAAM,MAAM,sCAAsC,GAAG;IACjD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,kCAAkC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sCAAsC,GAAG,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE5I,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEjE,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;;;;;;OASG;IACH,aAAa,CAAC,MAAM,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7F;;OAEG;IACH,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAEvG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxF;AAED,MAAM,MAAM,yCAAyC,GAAG;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC5C;;;OAGG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,yCAAyC,GACpD,OAAO,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEpE;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yCAAyC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE/H;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yCAAyC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAClI"}

package/dist/core/entities/identity-provider-account/types.mjs

@@ -0,0 +1,17 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/identity-provider-account/types.ts
+/**
+* Filter keys an identity-provider-account list query may target.
+*/ const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS = [
+	"id",
+	"userId",
+	"providerId",
+	"userRealmId",
+	"providerUserId"
+];
+//#endregion
+export { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/entities/identity-provider-account/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS"],"sources":["../../../../src/core/entities/identity-provider-account/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DeepPartial } from 'typeorm';\nimport type { IdentityProviderIdentity } from '../../identity/provider/types.ts';\n\n/**\n * Filter keys an identity-provider-account list query may target.\n */\nexport const IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS = [\n    'id',\n    'userId',\n    'providerId',\n    'userRealmId',\n    'providerUserId',\n] as const;\n\nexport type IdentityProviderAccountFindManyOptions = {\n    /**\n     * Force the result to a single user (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    userId?: string,\n    /**\n     * Restrict the result to a single owner realm (the nested\n     * `/realms/:realmId/identity-provider-accounts` mount). The owner\n     * realm of a row is `userRealmId`.\n     */\n    realmId?: string,\n};\n\n/**\n * Unified port: the entity CRUD surface (management API) plus the\n * account-manager methods the federated login and link flows consume.\n * One adapter implements both concerns over the same table.\n */\nexport interface IIdentityProviderAccountRepository {\n    findMany(query: IQuery, options?: IdentityProviderAccountFindManyOptions): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;\n\n    findOneById(id: string): Promise<IdentityProviderAccount | null>;\n\n    remove(entity: IdentityProviderAccount): Promise<void>;\n\n    /**\n     * Atomically remove the account, refusing (returning `false`) when it\n     * is the user's LAST linked account and `userHasOtherLogin` is false —\n     * the unlink lockout guard. The count and the delete run in one\n     * transaction with the user's account rows locked (on drivers that\n     * support row locks), so two concurrent unlinks for the same user\n     * cannot both pass the guard and strand a password-less user with no\n     * login. Fires the entity subscriber like `remove`. Returns `true`\n     * when the row was removed.\n     */\n    removeGuarded(entity: IdentityProviderAccount, userHasOtherLogin: boolean): Promise<boolean>;\n\n    /**\n     * Find identity account with user relation (federated login + link flow).\n     */\n    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;\n\n    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;\n}\n\nexport type IdentityProviderAccountServiceReadOptions = {\n    realmId?: string,\n};\n\nexport interface IIdentityProviderAccountService {\n    /**\n     * List linked accounts. An actor without\n     * `IDENTITY_PROVIDER_ACCOUNT_READ` is scoped to its own rows.\n     */\n    getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options?: IdentityProviderAccountServiceReadOptions\n    ): Promise<EntityRepositoryFindManyResult<IdentityProviderAccount>>;\n\n    /**\n     * Read a single linked account. Own rows need no permission.\n     */\n    getOne(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;\n\n    /**\n     * Unlink. Own rows need no permission. Refuses for EVERY caller when\n     * the row is the user's last linked account and the user has no\n     * password (lockout guard).\n     */\n    delete(id: string, actor: ActorContext, options?: IdentityProviderAccountServiceReadOptions): Promise<IdentityProviderAccount>;\n}\n"],"mappings":";;;;;;GAgBA,MAAaA,wCAAwC;CACjD;CACA;CACA;CACA;CACA;AACH"}

package/dist/core/entities/identity-provider-role-mapping/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAMpE,eAAO,MAAM,iCAAiC,gEAuB5C,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAMpE,eAAO,MAAM,iCAAiC,gEAgC5C,CAAC"}

package/dist/core/entities/identity-provider-role-mapping/schema.mjs

@@ -11,6 +11,15 @@ const schemaMapping = {
 };
 const identityProviderRoleMappingSchema = defineSchema({
 	name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,
+	indexes: [
+		["id"],
+		["providerId", "roleId"],
+		["roleId"],
+		["providerRealmId"],
+		["roleRealmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"name",
@@ -24,16 +33,28 @@ const identityProviderRoleMappingSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: ["roleId", "providerId"] },
+	filters: {
+		allowed: [
+			"roleId",
+			"providerId",
+			"id",
+			"providerRealmId",
+			"roleRealmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["role", "provider"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/identity-provider-role-mapping/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","provider","IDENTITY_PROVIDER","identityProviderRoleMappingSchema","name","IDENTITY_PROVIDER_ROLE_MAPPING","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, provider: EntityType.IDENTITY_PROVIDER };\n\nexport const identityProviderRoleMappingSchema = defineSchema<IdentityProviderRoleMapping>({\n    name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'valueIsRegex',\n            'synchronizationMode',\n            'providerId',\n            'providerRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'providerId'] },\n    relations: { allowed: ['role', 'provider'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,UAAUL,WAAWM;AAAkB;AAEtF,MAAaC,oCAAoCR,aAA0C;CACvFS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,YAAa,EAAC;CAC7CC,WAAW;EAAED,SAAS,CAAC,QAAQ,UAAW;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC7Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","provider","IDENTITY_PROVIDER","identityProviderRoleMappingSchema","name","IDENTITY_PROVIDER_ROLE_MAPPING","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider-role-mapping/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProviderRoleMapping } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, provider: EntityType.IDENTITY_PROVIDER };\n\nexport const identityProviderRoleMappingSchema = defineSchema<IdentityProviderRoleMapping>({\n    name: EntityType.IDENTITY_PROVIDER_ROLE_MAPPING,\n    indexes: [\n        ['id'],\n        ['providerId', 'roleId'],\n        ['roleId'],\n        ['providerRealmId'],\n        ['roleRealmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'valueIsRegex',\n            'synchronizationMode',\n            'providerId',\n            'providerRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'providerId', 'id', 'providerRealmId', 'roleRealmId'], indexed: true },\n    relations: { allowed: ['role', 'provider'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,UAAUL,WAAWM;AAAkB;AAEtF,MAAaC,oCAAoCR,aAA0C;CACvFS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,cAAc,QAAS;EACxB,CAAC,QAAS;EACV,CAAC,iBAAkB;EACnB,CAAC,aAAc;EACf,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAU;GAAc;GAAM;GAAmB;EAAc;EAAEC,SAAS;CAAK;CACpGC,WAAW;EAAEF,SAAS,CAAC,QAAQ,UAAW;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC7FgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/index.d.ts

@@ -5,6 +5,7 @@ export * from './client-scope/index.ts';
 export * from './consent/index.ts';
 export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './identity-provider-account/index.ts';
 export * from './key/index.ts';
 export * from './permission/index.ts';
 export * from './permission-policy/index.ts';
@@ -15,6 +16,7 @@ export * from './role-attribute/index.ts';
 export * from './role-permission/index.ts';
 export * from './scope/index.ts';
 export * from './session/index.ts';
+export * from './session-token/index.ts';
 export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';

package/dist/core/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2CAA2C,CAAC"}

package/dist/core/entities/index.mjs

@@ -11,6 +11,8 @@ import { clientScopeSchema } from "./client-scope/schema.mjs";
 import { consentSchema } from "./consent/schema.mjs";
 import { eventSchema } from "./event/schema.mjs";
 import { identityProviderSchema } from "./identity-provider/schema.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS } from "./identity-provider-account/types.mjs";
+import { identityProviderAccountSchema } from "./identity-provider-account/schema.mjs";
 import { identityProviderRoleMappingSchema } from "./identity-provider-role-mapping/schema.mjs";
 import { keySchema } from "./key/schema.mjs";
 import { permissionSchema } from "./permission/schema.mjs";
@@ -22,6 +24,7 @@ import { roleAttributeSchema } from "./role-attribute/schema.mjs";
 import { rolePermissionSchema } from "./role-permission/schema.mjs";
 import { scopeSchema } from "./scope/schema.mjs";
 import { sessionSchema } from "./session/schema.mjs";
+import { sessionTokenSchema } from "./session-token/schema.mjs";
 import { trustAnchorSchema } from "./trust-anchor/schema.mjs";
 import { userSchema } from "./user/schema.mjs";
 import { userAttributeSchema } from "./user-attribute/schema.mjs";
@@ -29,7 +32,7 @@ import { userAuthenticatorSchema } from "./user-authenticator/schema.mjs";
 import { userPermissionSchema } from "./user-permission/schema.mjs";
 import { userRoleSchema } from "./user-role/schema.mjs";
 import { ClientService } from "./client/service.mjs";
-import { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes } from "./client/web-client.mjs";
+import { SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, SystemClientProvisioner, buildSystemClientAttributes } from "./client/system-clients.mjs";
 import "./client/index.mjs";
 import { ClientPermissionService } from "./client-permission/service.mjs";
 import "./client-permission/index.mjs";
@@ -45,6 +48,9 @@ import { sanitizeEventData } from "./event/sanitize.mjs";
 import { EventService } from "./event/service.mjs";
 import "./event/index.mjs";
 import "./identity-provider/index.mjs";
+import { IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountUnlinkBlockedError, isIdentityProviderAccountUnlinkBlockedError } from "./identity-provider-account/error.mjs";
+import { IdentityProviderAccountService } from "./identity-provider-account/service.mjs";
+import "./identity-provider-account/index.mjs";
 import { KeyService } from "./key/service.mjs";
 import "./key/index.mjs";
 import { PermissionService } from "./permission/service.mjs";
@@ -65,6 +71,8 @@ import { ScopeService } from "./scope/service.mjs";
 import "./scope/index.mjs";
 import { SessionService } from "./session/service.mjs";
 import "./session/index.mjs";
+import { SESSION_TOKEN_FILTER_KEYS, SessionTokenService } from "./session-token/service.mjs";
+import "./session-token/index.mjs";
 import { TrustAnchorService } from "./trust-anchor/service.mjs";
 import "./trust-anchor/index.mjs";
 import { UserService } from "./user/service.mjs";
@@ -83,4 +91,4 @@ import { UserRoleService } from "./user-role/service.mjs";
 import "./user-role/index.mjs";
 import { IdentityProviderRoleMappingService } from "./identity-provider-role-mapping/service.mjs";
 import "./identity-provider-role-mapping/index.mjs";
-export { CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, ScopeService, SessionService, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildEntityDiff, buildWebClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderRoleMappingSchema, identityProviderSchema, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };
+export { CLIENT_READ_PERMISSIONS, CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH, ClientPermissionService, ClientRoleService, ClientScopeService, ClientService, ConsentService, EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, IDENTITY_PROVIDER_ACCOUNT_FILTER_KEYS, IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED_ERROR_INSTANCE, IdentityProviderAccountService, IdentityProviderAccountUnlinkBlockedError, IdentityProviderRoleMappingService, KeyService, PermissionPolicyService, PermissionService, PolicyService, RealmService, RoleAttributeService, RolePermissionService, RoleService, SESSION_TOKEN_FILTER_KEYS, SYSTEM_CLIENT_DEFINITIONS, SYSTEM_CLIENT_SCOPE_NAMES, ScopeService, SessionService, SessionTokenService, SystemClientProvisioner, TrustAnchorService, USER_AUTHENTICATOR_ATTEMPT_CACHE_PREFIX, USER_AUTHENTICATOR_ATTEMPT_LOCK_FACTOR, USER_AUTHENTICATOR_ATTEMPT_LOCK_MAX, USER_AUTHENTICATOR_ATTEMPT_WINDOW, USER_AUTHENTICATOR_EMAIL_CODE_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_CODE_EXPIRES_IN_MINUTES, USER_AUTHENTICATOR_EMAIL_CODE_LENGTH, USER_AUTHENTICATOR_EMAIL_SEND_CACHE_PREFIX, USER_AUTHENTICATOR_EMAIL_SEND_COOLDOWN, USER_AUTHENTICATOR_FILTER_KEYS, USER_AUTHENTICATOR_RECOVERY_CODE_COUNT, USER_AUTHENTICATOR_THROTTLE_CACHE_PREFIX, USER_AUTHENTICATOR_TOTP_ALGORITHM, USER_AUTHENTICATOR_TOTP_DIGITS, USER_AUTHENTICATOR_TOTP_PERIOD, USER_AUTHENTICATOR_VERIFY_LOCK_CACHE_PREFIX, USER_AUTHENTICATOR_VERIFY_LOCK_RENEW_INTERVAL, USER_AUTHENTICATOR_VERIFY_LOCK_TTL, USER_AUTHENTICATOR_WEBAUTHN_AUTH_CACHE_PREFIX, USER_AUTHENTICATOR_WEBAUTHN_CHALLENGE_WINDOW, USER_AUTHENTICATOR_WEBAUTHN_REG_CACHE_PREFIX, UserAttributeService, UserAuthenticatorService, UserPermissionService, UserRoleService, UserService, buildEntityDiff, buildSystemClientAttributes, buildWebauthnAuthenticationOptions, buildWebauthnRegistrationOptions, clientPermissionSchema, clientRoleSchema, clientSchema, clientScopeSchema, consentSchema, eventSchema, generateNumericCode, generateRecoveryCode, guessUserAuthenticatorKindByResponse, identityProviderAccountSchema, identityProviderRoleMappingSchema, identityProviderSchema, isIdentityProviderAccountUnlinkBlockedError, keySchema, permissionPolicySchema, permissionSchema, policySchema, realmSchema, roleAttributeSchema, rolePermissionSchema, roleSchema, sanitizeEventData, scopeSchema, sessionSchema, sessionTokenSchema, trustAnchorSchema, userAttributeSchema, userAuthenticatorSchema, userPermissionSchema, userRoleSchema, userSchema, verifyWebauthnAuthentication, verifyWebauthnRegistration };

package/dist/core/entities/key/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAM5C,eAAO,MAAM,SAAS,wCAyCpB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/key/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAM5C,eAAO,MAAM,SAAS,wCAuDpB,CAAC"}