@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/core/entities/realm/service.mjs

@@ -13,14 +13,12 @@ import { EntityNotFoundError, ValidationError } from "@authup/errors";
 var RealmService = class extends AbstractEntityService {
 	repository;
 	validator;
-	webClientProvisioner;
-	keyProvisioner;
+	realmProvisioners;
 	logger;
 	constructor(ctx) {
 		super();
 		this.repository = ctx.repository;
-		this.webClientProvisioner = ctx.webClientProvisioner;
-		this.keyProvisioner = ctx.keyProvisioner;
+		this.realmProvisioners = ctx.realmProvisioners;
 		this.logger = ctx.logger;
 		this.validator = new RealmValidator();
 	}
@@ -81,12 +79,11 @@ var RealmService = class extends AbstractEntityService {
 		});
 		entity = this.repository.create(validated);
 		await this.repository.save(entity);
-		if (this.webClientProvisioner) try {
-			await this.webClientProvisioner.ensureForRealm(entity);
+		if (this.realmProvisioners) for (const provisioner of this.realmProvisioners) try {
+			await provisioner.ensureForRealm(entity);
 		} catch (e) {
-			if (this.logger) this.logger.warn(`Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
+			if (this.logger) this.logger.warn(`${provisioner.constructor.name} failed for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`);
 		}
-		if (this.keyProvisioner) await this.keyProvisioner.ensureForRealm(entity);
 		return {
 			entity,
 			created: true

package/dist/core/entities/realm/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","decodeQuery","realmSchema","RealmService","repository","validator","webClientProvisioner","keyProvisioner","logger","ctx","getMany","query","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","builtIn","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IWebClientProvisioner } from '../client/types.ts';\nimport type { IKeyProvisioner } from '../../key/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { realmSchema } from './schema.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    webClientProvisioner?: IWebClientProvisioner;\n    keyProvisioner?: IKeyProvisioner;\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected webClientProvisioner?: IWebClientProvisioner;\n\n    protected keyProvisioner?: IKeyProvisioner;\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.webClientProvisioner = ctx.webClientProvisioner;\n        this.keyProvisioner = ctx.keyProvisioner;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(await decodeQuery(query, { schema: realmSchema }));\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's public `web` client via the system-level\n        // provisioner (NOT clientService.create) — it must not be gated on\n        // the actor's CLIENT_CREATE, since a realm creator may lack it.\n        // Realm creation must stay atomic from the caller's perspective: the\n        // realm is already persisted, so a provisioning failure is logged and\n        // swallowed (startup provisioning reconciles every realm's web client).\n        if (this.webClientProvisioner) {\n            try {\n                await this.webClientProvisioner.ensureForRealm(entity);\n            } catch (e) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Failed to provision web client for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                    );\n                }\n            }\n        }\n\n        // Mint the realm's sig + enc keys eagerly (plan 071 hybrid model) —\n        // same system-level, never-fail posture as the web client above.\n        if (this.keyProvisioner) {\n            await this.keyProvisioner.ensureForRealm(entity);\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AA+BA,IAAaa,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKL,aAAaK,IAAIL;EACtB,KAAKE,uBAAuBG,IAAIH;EAChC,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,SAASC,IAAID;EAClB,KAAKH,YAAY,IAAIN,eAAAA;CACzB;CAEA,MAAMW,QACFC,OAC8C;EAC9C,OAAO,KAAKP,WAAWQ,SAAS,MAAMX,YAAYU,OAAO,EAAEE,QAAQX,YAAY,CAAA,CAAA;CACnF;CAEA,MAAMY,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKZ,WAAWa,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIrB,oBAAAA;EAGd,OAAOqB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAIjC,OAAOqB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKZ,WAAW0B,UAAUH,KAAAA;GAGzC,IAAI,CAACX,WAAWS,QAAQD,cAAcG,MAAMC,KACxC,MAAM,IAAIjC,oBAAAA;EAElB,OAAO,IAAI8B,QAAQD,YACf,MAAM,IAAI7B,oBAAAA;EAGd,IAAIqB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAeoC,aAAa,CAAA;GAChFP,QAAQlC,eAAe0C;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAesC,aAAa,CAAA;GAChFT,QAAQlC,eAAe4C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAKhC,UAAUiC,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKtB,WAAWmC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAMhC,eAAeoC;IACrBd,MAAM5B,iBAAiB,GAClBD,kBAAkBmD,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS/B,qBAAqBL,cAAc4C,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAIjC,gBAAgB,mBAAmBE,kBAAkB,qBAAqB;GAGxFkB,SAAS,KAAKZ,WAAWsC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAKjC,WAAWiB,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAMhC,eAAesC;GACrBhB,MAAM5B,iBAAiB,GAAGD,kBAAkBmD,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKZ,WAAWc,OAAOmB,SAAAA;EAChC,MAAM,KAAKjC,WAAWiB,KAAKL,MAAAA;EAQ3B,IAAI,KAAKV,sBACL,IAAI;GACA,MAAM,KAAKA,qBAAqBsC,eAAe5B,MAAAA;EACnD,SAAS6B,GAAG;GACR,IAAI,KAAKrC,QACL,KAAKA,OAAOsC,KACR,4CAA4C9B,OAAOY,GAAG,IAAIiB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAGlH;EAKJ,IAAI,KAAKtC,gBACL,MAAM,KAAKA,eAAeqC,eAAe5B,MAAAA;EAG7C,OAAO;GACHA;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMO,OACFtB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAMhC,eAAesD,aAAa,CAAA;EAEhF,MAAMnC,SAAS,MAAM,KAAKZ,WAAW0B,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIrB,oBAAAA;EAGd,IAAIqB,OAAOoC,SACP,MAAM,IAAIxD,gBAAgB,sCAAA;EAG9B,MAAMwB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAMhC,eAAesD;GACrBhC,MAAM5B,iBAAiB,GAAGD,kBAAkBmD,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAIyB,aAAarC;EACzB,MAAM,KAAKZ,WAAWkD,OAAOtC,MAAAA;EAC7BA,OAAOY,KAAKyB;EAEZ,OAAOrC;CACX;AACJ"}
+{"version":3,"file":"service.mjs","names":["BuiltInPolicyType","definePolicyData","ValidatorGroup","isPropertySet","isUUID","EntityNotFoundError","ValidationError","PermissionName","REALM_MASTER_NAME","RealmValidator","AbstractEntityService","decodeQuery","realmSchema","RealmService","repository","validator","realmProvisioners","logger","ctx","getMany","query","findMany","schema","getOne","idOrName","entity","findOneByIdOrName","create","data","actor","save","undefined","update","updateOnly","options","group","where","id","name","findOneBy","permissionEvaluator","preEvaluate","REALM_UPDATE","UPDATE","REALM_CREATE","CREATE","validated","run","validateJoinColumns","evaluate","ATTRIBUTES","merge","created","provisioner","ensureForRealm","e","warn","Error","message","String","delete","REALM_DELETE","builtIn","entityId","remove"],"sources":["../../../../src/core/entities/realm/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { ValidatorGroup, isPropertySet, isUUID } from '@authup/kit';\nimport { EntityNotFoundError, ValidationError } from '@authup/errors';\nimport {\n    PermissionName,\n    REALM_MASTER_NAME,\n    RealmValidator,\n} from '@authup/core-kit';\nimport type { Realm } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger  } from '@authup/server-kit';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { IRealmProvisioner } from '../../provisioning/types.ts';\nimport type { IRealmRepository, IRealmService } from './types.ts';\nimport { decodeQuery } from '../../query/index.ts';\nimport { realmSchema } from './schema.ts';\n\nexport type RealmServiceContext = {\n    repository: IRealmRepository;\n    /**\n     * Applied in order on realm CREATE (system clients, keys, wildcard\n     * provisioning defaults). Never-fail: a provisioner failure is logged\n     * and swallowed.\n     */\n    realmProvisioners?: IRealmProvisioner[];\n    logger?: Logger;\n};\n\nexport class RealmService extends AbstractEntityService implements IRealmService {\n    protected repository: IRealmRepository;\n\n    protected validator: RealmValidator;\n\n    protected realmProvisioners?: IRealmProvisioner[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: RealmServiceContext) {\n        super();\n        this.repository = ctx.repository;\n        this.realmProvisioners = ctx.realmProvisioners;\n        this.logger = ctx.logger;\n        this.validator = new RealmValidator();\n    }\n\n    async getMany(\n        query: Record<string, any>,\n    ): Promise<EntityRepositoryFindManyResult<Realm>> {\n        return this.repository.findMany(await decodeQuery(query, { schema: realmSchema }));\n    }\n\n    async getOne(\n        idOrName: string,\n    ): Promise<Realm> {\n        const entity = await this.repository.findOneByIdOrName(idOrName);\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        return entity;\n    }\n\n    async create(\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(undefined, data, actor);\n        return entity;\n    }\n\n    async update(\n        idOrName: string,\n        data: Record<string, any>,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        const { entity } = await this.save(idOrName, data, actor, { updateOnly: true });\n        return entity;\n    }\n\n    async save(\n        idOrName: string | undefined,\n        data: Record<string, any>,\n        actor: ActorContext,\n        options: { updateOnly?: boolean } = {},\n    ): Promise<{\n        entity: Realm,\n        created: boolean \n    }> {\n        let group: string;\n\n        let entity: Realm | null | undefined;\n        if (idOrName) {\n            const where: Record<string, any> = {};\n            if (isUUID(idOrName)) {\n                where.id = idOrName;\n            } else {\n                where.name = idOrName;\n            }\n\n            entity = await this.repository.findOneBy(where);\n            // Only a NAME key may upsert-create. A UUID addresses one specific\n            // row, so a miss is a 404 (creating would write a different id).\n            if (!entity && (options.updateOnly || where.id)) {\n                throw new EntityNotFoundError();\n            }\n        } else if (options.updateOnly) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_UPDATE });\n            group = ValidatorGroup.UPDATE;\n        } else {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_CREATE });\n            group = ValidatorGroup.CREATE;\n        }\n\n        const validated = await this.validator.run(data, { group });\n\n        await this.repository.validateJoinColumns(validated);\n\n        if (entity) {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.REALM_UPDATE,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: {\n                        ...entity,\n                        ...validated,\n                    },\n                }),\n            });\n\n            if (entity.name === REALM_MASTER_NAME && isPropertySet(validated, 'name') && entity.name !== validated.name) {\n                throw new ValidationError(`The name of the ${REALM_MASTER_NAME} can not be changed.`);\n            }\n\n            entity = this.repository.merge(entity, validated);\n            await this.repository.save(entity);\n\n            return {\n                entity,\n                created: false, \n            };\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_CREATE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: validated }),\n        });\n\n        entity = this.repository.create(validated);\n        await this.repository.save(entity);\n\n        // Provision the realm's baseline (system clients, sig + enc keys,\n        // wildcard provisioning defaults) via the system-level realm\n        // provisioners (NOT the entity services) — they must not be gated\n        // on the actor's permissions, since a realm creator may lack e.g.\n        // CLIENT_CREATE. Realm creation must stay atomic from the caller's\n        // perspective: the realm is already persisted, so a provisioner\n        // failure is logged and swallowed (startup provisioning reconciles\n        // every realm on the next boot).\n        if (this.realmProvisioners) {\n            for (const provisioner of this.realmProvisioners) {\n                try {\n                    await provisioner.ensureForRealm(entity);\n                } catch (e) {\n                    if (this.logger) {\n                        this.logger.warn(\n                            `${provisioner.constructor.name} failed for realm ${entity.id}: ${e instanceof Error ? e.message : String(e)}`,\n                        );\n                    }\n                }\n            }\n        }\n\n        return {\n            entity,\n            created: true,\n        };\n    }\n\n    async delete(\n        id: string,\n        actor: ActorContext,\n    ): Promise<Realm> {\n        await actor.permissionEvaluator.preEvaluate({ name: PermissionName.REALM_DELETE });\n\n        const entity = await this.repository.findOneBy({ id });\n        if (!entity) {\n            throw new EntityNotFoundError();\n        }\n\n        if (entity.builtIn) {\n            throw new ValidationError('A built-in realm can not be deleted.');\n        }\n\n        await actor.permissionEvaluator.evaluate({\n            name: PermissionName.REALM_DELETE,\n            data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: entity }),\n        });\n\n        const { id: entityId } = entity;\n        await this.repository.remove(entity);\n        entity.id = entityId;\n\n        return entity;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAkCA,IAAaa,eAAb,cAAkCH,sBAAAA;CACpBI;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EACL,KAAKJ,aAAaI,IAAIJ;EACtB,KAAKE,oBAAoBE,IAAIF;EAC7B,KAAKC,SAASC,IAAID;EAClB,KAAKF,YAAY,IAAIN,eAAAA;CACzB;CAEA,MAAMU,QACFC,OAC8C;EAC9C,OAAO,KAAKN,WAAWO,SAAS,MAAMV,YAAYS,OAAO,EAAEE,QAAQV,YAAY,CAAA,CAAA;CACnF;CAEA,MAAMW,OACFC,UACc;EACd,MAAMC,SAAS,MAAM,KAAKX,WAAWY,kBAAkBF,QAAAA;EACvD,IAAI,CAACC,QACD,MAAM,IAAIpB,oBAAAA;EAGd,OAAOoB;CACX;CAEA,MAAME,OACFC,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKC,KAAAA,GAAWH,MAAMC,KAAAA;EACpD,OAAOJ;CACX;CAEA,MAAMO,OACFR,UACAI,MACAC,OACc;EACd,MAAM,EAAEJ,WAAW,MAAM,KAAKK,KAAKN,UAAUI,MAAMC,OAAO,EAAEI,YAAY,KAAK,CAAA;EAC7E,OAAOR;CACX;CAEA,MAAMK,KACFN,UACAI,MACAC,OACAK,UAAoC,CAAC,GAItC;EACC,IAAIC;EAEJ,IAAIV;EACJ,IAAID,UAAU;GACV,MAAMY,QAA6B,CAAC;GACpC,IAAIhC,OAAOoB,QAAAA,GACPY,MAAMC,KAAKb;QAEXY,MAAME,OAAOd;GAGjBC,SAAS,MAAM,KAAKX,WAAWyB,UAAUH,KAAAA;GAGzC,IAAI,CAACX,WAAWS,QAAQD,cAAcG,MAAMC,KACxC,MAAM,IAAIhC,oBAAAA;EAElB,OAAO,IAAI6B,QAAQD,YACf,MAAM,IAAI5B,oBAAAA;EAGd,IAAIoB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAemC,aAAa,CAAA;GAChFP,QAAQjC,eAAeyC;EAC3B,OAAO;GACH,MAAMd,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAeqC,aAAa,CAAA;GAChFT,QAAQjC,eAAe2C;EAC3B;EAEA,MAAMC,YAAY,MAAM,KAAK/B,UAAUgC,IAAInB,MAAM,EAAEO,MAAM,CAAA;EAEzD,MAAM,KAAKrB,WAAWkC,oBAAoBF,SAAAA;EAE1C,IAAIrB,QAAQ;GACR,MAAMI,MAAMW,oBAAoBS,SAAS;IACrCX,MAAM/B,eAAemC;IACrBd,MAAM3B,iBAAiB,GAClBD,kBAAkBkD,aAAa;KAC5B,GAAGzB;KACH,GAAGqB;IACP,EACJ,CAAA;GACJ,CAAA;GAEA,IAAIrB,OAAOa,SAAS9B,qBAAqBL,cAAc2C,WAAW,MAAA,KAAWrB,OAAOa,SAASQ,UAAUR,MACnG,MAAM,IAAIhC,gBAAgB,mBAAmBE,kBAAkB,qBAAqB;GAGxFiB,SAAS,KAAKX,WAAWqC,MAAM1B,QAAQqB,SAAAA;GACvC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;GAE3B,OAAO;IACHA;IACA2B,SAAS;GACb;EACJ;EAEA,MAAMvB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM/B,eAAeqC;GACrBhB,MAAM3B,iBAAiB,GAAGD,kBAAkBkD,aAAaJ,UAAU,CAAA;EACvE,CAAA;EAEArB,SAAS,KAAKX,WAAWa,OAAOmB,SAAAA;EAChC,MAAM,KAAKhC,WAAWgB,KAAKL,MAAAA;EAU3B,IAAI,KAAKT,mBACL,KAAK,MAAMqC,eAAe,KAAKrC,mBAC3B,IAAI;GACA,MAAMqC,YAAYC,eAAe7B,MAAAA;EACrC,SAAS8B,GAAG;GACR,IAAI,KAAKtC,QACL,KAAKA,OAAOuC,KACR,GAAGH,YAAY,YAAYf,KAAK,oBAAoBb,OAAOY,GAAG,IAAIkB,aAAaE,QAAQF,EAAEG,UAAUC,OAAOJ,CAAAA,GAAI;EAG1H;EAIR,OAAO;GACH9B;GACA2B,SAAS;EACb;CACJ;CAEA,MAAMQ,OACFvB,IACAR,OACc;EACd,MAAMA,MAAMW,oBAAoBC,YAAY,EAAEH,MAAM/B,eAAesD,aAAa,CAAA;EAEhF,MAAMpC,SAAS,MAAM,KAAKX,WAAWyB,UAAU,EAAEF,GAAG,CAAA;EACpD,IAAI,CAACZ,QACD,MAAM,IAAIpB,oBAAAA;EAGd,IAAIoB,OAAOqC,SACP,MAAM,IAAIxD,gBAAgB,sCAAA;EAG9B,MAAMuB,MAAMW,oBAAoBS,SAAS;GACrCX,MAAM/B,eAAesD;GACrBjC,MAAM3B,iBAAiB,GAAGD,kBAAkBkD,aAAazB,OAAO,CAAA;EACpE,CAAA;EAEA,MAAM,EAAEY,IAAI0B,aAAatC;EACzB,MAAM,KAAKX,WAAWkD,OAAOvC,MAAAA;EAC7BA,OAAOY,KAAK0B;EAEZ,OAAOtC;CACX;AACJ"}

package/dist/core/entities/role/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAqBrB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM7C,eAAO,MAAM,UAAU,yCAgCrB,CAAC"}

package/dist/core/entities/role/schema.mjs

@@ -8,6 +8,21 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const roleSchema = defineSchema({
 	name: EntityType.ROLE,
+	indexes: [
+		["id"],
+		[
+			"name",
+			"clientId",
+			"realmId"
+		],
+		["displayName"],
+		["builtIn"],
+		["target"],
+		["clientId"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"builtIn",
@@ -20,24 +35,31 @@ const roleSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"builtIn",
-		"name",
-		"target",
-		"clientId",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"builtIn",
+			"name",
+			"displayName",
+			"target",
+			"clientId",
+			"realmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"name",
-		"updatedAt",
-		"createdAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"updatedAt",
+			"createdAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/role/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","roleSchema","name","ROLE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Role } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const roleSchema = defineSchema<Role>({\n    name: EntityType.ROLE,\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'target',\n            'description',\n            'clientId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'builtIn', 'name', 'target', 'clientId', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAQ;EAAU;EAAY;CAAU,EAAC;CAC/EE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","roleSchema","name","ROLE","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Role } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const roleSchema = defineSchema<Role>({\n    name: EntityType.ROLE,\n    indexes: [\n        ['id'],\n        ['name', 'clientId', 'realmId'],\n        ['displayName'],\n        ['builtIn'],\n        ['target'],\n        ['clientId'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'target',\n            'description',\n            'clientId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'builtIn', 'name', 'displayName', 'target', 'clientId', 'realmId'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'name', 'updatedAt', 'createdAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,aAAaN,aAAmB;CACzCO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN;GAAC;GAAQ;GAAY;EAAU;EAC/B,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,UAAW;EACZ,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAED,SAAS;GAAC;GAAM;GAAW;GAAQ;GAAe;GAAU;GAAY;EAAU;EAAEE,SAAS;CAAK;CAC7GC,WAAW;EAAEH,SAAS,CAAC,OAAQ;EAAEI,UAAUb,wBAAwBC,aAAAA;CAAe;CAClFa,OAAO;EAAEL,SAAS;GAAC;GAAM;GAAQ;GAAa;EAAY;EAAEE,SAAS;CAAK;CAC1EI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/role-attribute/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-attribute/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,eAAO,MAAM,mBAAmB,kDA4B9B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-attribute/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMtD,eAAO,MAAM,mBAAmB,kDAqC9B,CAAC"}

package/dist/core/entities/role-attribute/schema.mjs

@@ -11,6 +11,14 @@ const schemaMapping = {
 };
 const roleAttributeSchema = defineSchema({
 	name: EntityType.ROLE_ATTRIBUTE,
+	indexes: [
+		["id"],
+		["name", "roleId"],
+		["roleId"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"name",
@@ -20,24 +28,30 @@ const roleAttributeSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"name",
-		"roleId",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"name",
+			"roleId",
+			"realmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["role", "realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"name",
-		"roleId",
-		"realmId",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"roleId",
+			"realmId",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/role-attribute/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","realm","REALM","roleAttributeSchema","name","ROLE_ATTRIBUTE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, realm: EntityType.REALM };\n\nexport const roleAttributeSchema = defineSchema<RoleAttribute>({\n    name: EntityType.ROLE_ATTRIBUTE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'roleId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'roleId', 'realmId'] },\n    relations: { allowed: ['role', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: {\n        allowed: [\n            'id',\n            'name',\n            'roleId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAM;EAAQ;EAAU;CAAU,EAAC;CACxDC,WAAW;EAAED,SAAS,CAAC,QAAQ,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC1Fc,MAAM,EACFH,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","realm","REALM","roleAttributeSchema","name","ROLE_ATTRIBUTE","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-attribute/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RoleAttribute } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, realm: EntityType.REALM };\n\nexport const roleAttributeSchema = defineSchema<RoleAttribute>({\n    name: EntityType.ROLE_ATTRIBUTE,\n    indexes: [\n        ['id'],\n        ['name', 'roleId'],\n        ['roleId'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'name',\n            'value',\n            'roleId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'name', 'roleId', 'realmId'], indexed: true },\n    relations: { allowed: ['role', 'realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: {\n        allowed: [\n            'id',\n            'name',\n            'roleId',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n        indexed: true,\n    },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,OAAOL,WAAWM;AAAM;AAEvE,MAAaC,sBAAsBR,aAA4B;CAC3DS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,QAAS;EAClB,CAAC,QAAS;EACV,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAM;GAAQ;GAAU;EAAU;EAAEC,SAAS;CAAK;CACvEC,WAAW;EAAEF,SAAS,CAAC,QAAQ,OAAQ;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC1FgB,OAAO;EACHJ,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS;CACb;CACAI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/role-permission/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMvD,eAAO,MAAM,oBAAoB,mDAqB/B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/role-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMvD,eAAO,MAAM,oBAAoB,mDA+B/B,CAAC"}

package/dist/core/entities/role-permission/schema.mjs

@@ -11,6 +11,16 @@ const schemaMapping = {
 };
 const rolePermissionSchema = defineSchema({
 	name: EntityType.ROLE_PERMISSION,
+	indexes: [
+		["id"],
+		["permissionId", "roleId"],
+		["roleId"],
+		["roleRealmId"],
+		["permissionRealmId"],
+		["policyId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"policyId",
@@ -22,16 +32,29 @@ const rolePermissionSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: ["roleId", "permissionId"] },
+	filters: {
+		allowed: [
+			"roleId",
+			"permissionId",
+			"id",
+			"roleRealmId",
+			"permissionRealmId",
+			"policyId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["role", "permission"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/role-permission/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","permission","PERMISSION","rolePermissionSchema","name","ROLE_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RolePermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, permission: EntityType.PERMISSION };\n\nexport const rolePermissionSchema = defineSchema<RolePermission>({\n    name: EntityType.ROLE_PERMISSION,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'permissionId'] },\n    relations: { allowed: ['role', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,YAAYL,WAAWM;AAAW;AAEjF,MAAaC,uBAAuBR,aAA6B;CAC7DS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,UAAU,cAAe,EAAC;CAC/CC,WAAW;EAAED,SAAS,CAAC,QAAQ,YAAa;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC/Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","role","ROLE","permission","PERMISSION","rolePermissionSchema","name","ROLE_PERMISSION","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/role-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { RolePermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { role: EntityType.ROLE, permission: EntityType.PERMISSION };\n\nexport const rolePermissionSchema = defineSchema<RolePermission>({\n    name: EntityType.ROLE_PERMISSION,\n    indexes: [\n        ['id'],\n        ['permissionId', 'roleId'],\n        ['roleId'],\n        ['roleRealmId'],\n        ['permissionRealmId'],\n        ['policyId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['roleId', 'permissionId', 'id', 'roleRealmId', 'permissionRealmId', 'policyId'], indexed: true },\n    relations: { allowed: ['role', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,MAAMH,WAAWI;CAAMC,YAAYL,WAAWM;AAAW;AAEjF,MAAaC,uBAAuBR,aAA6B;CAC7DS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,gBAAgB,QAAS;EAC1B,CAAC,QAAS;EACV,CAAC,aAAc;EACf,CAAC,mBAAoB;EACrB,CAAC,UAAW;EACZ,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAU;GAAgB;GAAM;GAAe;GAAqB;EAAW;EAAEC,SAAS;CAAK;CACpHC,WAAW;EAAEF,SAAS,CAAC,QAAQ,YAAa;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC/FgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/scope/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAM9C,eAAO,MAAM,WAAW,0CAmBtB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAM9C,eAAO,MAAM,WAAW,0CA4BtB,CAAC"}

package/dist/core/entities/scope/schema.mjs

@@ -8,6 +8,15 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const scopeSchema = defineSchema({
 	name: EntityType.SCOPE,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["displayName"],
+		["builtIn"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"builtIn",
@@ -18,22 +27,29 @@ const scopeSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"builtIn",
-		"name",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"builtIn",
+			"name",
+			"displayName",
+			"realmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"name",
-		"updatedAt",
-		"createdAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"name",
+			"updatedAt",
+			"createdAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/scope/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","scopeSchema","name","SCOPE","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Scope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const scopeSchema = defineSchema<Scope>({\n    name: EntityType.SCOPE,\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'builtIn', 'name', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'name', 'updatedAt', 'createdAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,cAAcN,aAAoB;CAC3CO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS;EAAC;EAAM;EAAW;EAAQ;CAAU,EAAC;CACzDE,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAM;EAAQ;EAAa;CAAY,EAAC;CAC1DK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","scopeSchema","name","SCOPE","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Scope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const scopeSchema = defineSchema<Scope>({\n    name: EntityType.SCOPE,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['builtIn'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['id', 'builtIn', 'name', 'displayName', 'realmId'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'name', 'updatedAt', 'createdAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,cAAcN,aAAoB;CAC3CO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAED,SAAS;GAAC;GAAM;GAAW;GAAQ;GAAe;EAAU;EAAEE,SAAS;CAAK;CACvFC,WAAW;EAAEH,SAAS,CAAC,OAAQ;EAAEI,UAAUb,wBAAwBC,aAAAA;CAAe;CAClFa,OAAO;EAAEL,SAAS;GAAC;GAAM;GAAQ;GAAa;EAAY;EAAEE,SAAS;CAAK;CAC1EI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}

package/dist/core/entities/session/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CA0BxB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAWhD,eAAO,MAAM,aAAa,4CAwCxB,CAAC"}

package/dist/core/entities/session/schema.mjs

@@ -6,9 +6,27 @@ import { createRelationsReadGate } from "../../query/relations.mjs";
 import { EntityType } from "@authup/core-kit";
 import { defineSchema } from "@rapiq/core";
 //#region src/core/entities/session/schema.ts
-const schemaMapping = { realm: EntityType.REALM };
+const schemaMapping = {
+	realm: EntityType.REALM,
+	user: EntityType.USER,
+	client: EntityType.CLIENT
+};
 const sessionSchema = defineSchema({
 	name: EntityType.SESSION,
+	indexes: [
+		["id"],
+		["sub"],
+		["subKind"],
+		["userId"],
+		["clientId"],
+		["realmId"],
+		["seenAt"],
+		["expiresAt"],
+		["userId", "seenAt"],
+		["realmId", "seenAt"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"sub",
@@ -26,17 +44,31 @@ const sessionSchema = defineSchema({
 		"clientId",
 		"realmId"
 	] },
-	filters: { allowed: [...SESSION_FILTER_KEYS] },
+	filters: {
+		allowed: [
+			...SESSION_FILTER_KEYS,
+			"expiresAt",
+			"seenAt"
+		],
+		indexed: true
+	},
 	relations: {
-		allowed: ["realm"],
+		allowed: [
+			"realm",
+			"user",
+			"client"
+		],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"seenAt",
-		"expiresAt",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"seenAt",
+			"expiresAt",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/session/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","sessionSchema","name","SESSION","fields","allowed","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const sessionSchema = defineSchema<Session>({\n    name: EntityType.SESSION,\n    fields: {\n        allowed: [\n            'id',\n            'sub',\n            'subKind',\n            'ipAddress',\n            'userAgent',\n            'authMethod',\n            'mfaAt',\n            'expiresAt',\n            'refreshedAt',\n            'seenAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'clientId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: [...SESSION_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAED,SAAS,CAAIT,GAAAA,mBAAoB,EAAC;CAC7CW,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUX,wBAAwBC,aAAAA;CAAe;CAClFW,MAAM,EAAEJ,SAAS;EAAC;EAAU;EAAa;EAAa;CAAY,EAAC;CACnEK,YAAY,EAAEC,UAAU,GAAG;CAC3Bb;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","SESSION_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","user","USER","client","CLIENT","sessionSchema","name","SESSION","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/session/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Session } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { SESSION_FILTER_KEYS } from '../../authentication/session/types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = {\n    realm: EntityType.REALM,\n    user: EntityType.USER,\n    client: EntityType.CLIENT,\n};\n\nexport const sessionSchema = defineSchema<Session>({\n    name: EntityType.SESSION,\n    indexes: [\n        ['id'],\n        ['sub'],\n        ['subKind'],\n        ['userId'],\n        ['clientId'],\n        ['realmId'],\n        ['seenAt'],\n        ['expiresAt'],\n        ['userId', 'seenAt'],\n        ['realmId', 'seenAt'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'sub',\n            'subKind',\n            'ipAddress',\n            'userAgent',\n            'authMethod',\n            'mfaAt',\n            'expiresAt',\n            'refreshedAt',\n            'seenAt',\n            'createdAt',\n            'updatedAt',\n            'userId',\n            'clientId',\n            'realmId',\n        ],\n    },\n    filters: { allowed: [...SESSION_FILTER_KEYS, 'expiresAt', 'seenAt'], indexed: true },\n    relations: { allowed: ['realm', 'user', 'client'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['seenAt', 'expiresAt', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB;CAClBC,OAAOJ,WAAWK;CAClBC,MAAMN,WAAWO;CACjBC,QAAQR,WAAWS;AACvB;AAEA,MAAaC,gBAAgBX,aAAsB;CAC/CY,MAAMX,WAAWY;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,KAAM;EACP,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,UAAW;EACZ,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,WAAY;EACb,CAAC,UAAU,QAAS;EACpB,CAAC,WAAW,QAAS;EACrB,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAED,SAAS;GAAId,GAAAA;GAAqB;GAAa;EAAS;EAAEgB,SAAS;CAAK;CACnFC,WAAW;EAAEH,SAAS;GAAC;GAAS;GAAQ;EAAS;EAAEI,UAAUjB,wBAAwBC,aAAAA;CAAe;CACpGiB,OAAO;EAAEL,SAAS;GAAC;GAAU;GAAa;GAAa;EAAY;EAAEE,SAAS;CAAK;CACnFI,YAAY,EAAEC,UAAU,GAAG;CAC3BnB;AACJ,CAAA"}

package/dist/core/entities/session-token/index.d.ts

@@ -0,0 +1,4 @@
+export * from './service.ts';
+export * from './types.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/session-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/session-token/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sessionTokenSchema } from "./schema.mjs";
+import { SESSION_TOKEN_FILTER_KEYS, SessionTokenService } from "./service.mjs";
+export { SESSION_TOKEN_FILTER_KEYS, SessionTokenService, sessionTokenSchema };

package/dist/core/entities/session-token/schema.d.ts

@@ -0,0 +1,12 @@
+import type { SessionToken } from '@authup/core-kit';
+/**
+ * The token inventory as a query surface.
+ *
+ * The rows carry no realm or subject of their own, so both the ownership
+ * check and the realm gate resolve through `session`. The repository joins it
+ * unconditionally for that reason: a projection must never be able to strip
+ * the columns the gate reads (the plan-039 discipline, applied through a
+ * relation instead of a column).
+ */
+export declare const sessionTokenSchema: import("@rapiq/core").Schema<SessionToken, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/session-token/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/session-token/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMrD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,iDAoD7B,CAAC"}

package/dist/core/entities/session-token/schema.mjs

@@ -0,0 +1,66 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createRelationsReadGate } from "../../query/relations.mjs";
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/session-token/schema.ts
+const schemaMapping = { session: EntityType.SESSION };
+/**
+* The token inventory as a query surface.
+*
+* The rows carry no realm or subject of their own, so both the ownership
+* check and the realm gate resolve through `session`. The repository joins it
+* unconditionally for that reason: a projection must never be able to strip
+* the columns the gate reads (the plan-039 discipline, applied through a
+* relation instead of a column).
+*/ const sessionTokenSchema = defineSchema({
+	name: EntityType.SESSION_TOKEN,
+	indexes: [
+		["id"],
+		["sessionId"],
+		["clientId"],
+		["kind"],
+		["expiresAt"],
+		["sessionId", "createdAt"],
+		["createdAt"]
+	],
+	fields: { allowed: [
+		"id",
+		"sessionId",
+		"clientId",
+		"kind",
+		"parentId",
+		"refreshTokenId",
+		"ipAddress",
+		"userAgent",
+		"consumedAt",
+		"revokedAt",
+		"expiresAt",
+		"createdAt"
+	] },
+	filters: {
+		allowed: [
+			"id",
+			"sessionId",
+			"clientId",
+			"kind",
+			"expiresAt"
+		],
+		indexed: true
+	},
+	relations: {
+		allowed: ["session"],
+		validate: createRelationsReadGate(schemaMapping)
+	},
+	sorts: {
+		allowed: ["createdAt", "expiresAt"],
+		indexed: true
+	},
+	pagination: { maxLimit: 50 },
+	schemaMapping
+});
+//#endregion
+export { sessionTokenSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/session-token/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","session","SESSION","sessionTokenSchema","name","SESSION_TOKEN","indexes","fields","allowed","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/session-token/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { SessionToken } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { session: EntityType.SESSION };\n\n/**\n * The token inventory as a query surface.\n *\n * The rows carry no realm or subject of their own, so both the ownership\n * check and the realm gate resolve through `session`. The repository joins it\n * unconditionally for that reason: a projection must never be able to strip\n * the columns the gate reads (the plan-039 discipline, applied through a\n * relation instead of a column).\n */\nexport const sessionTokenSchema = defineSchema<SessionToken>({\n    name: EntityType.SESSION_TOKEN,\n    indexes: [\n        ['id'],\n        ['sessionId'],\n        ['clientId'],\n        ['kind'],\n        ['expiresAt'],\n        ['sessionId', 'createdAt'],\n        ['createdAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'sessionId',\n            'clientId',\n            'kind',\n            'parentId',\n            'refreshTokenId',\n            'ipAddress',\n            'userAgent',\n            'consumedAt',\n            'revokedAt',\n            'expiresAt',\n            'createdAt',\n        ],\n    },\n    // Plain columns only. Ownership and realm are NOT client-supplied filters:\n    // the service resolves them from the joined session per row, so a caller\n    // cannot widen its own reach by filtering. These four cover the use cases:\n    // `clientId` answers \"which sessions did this application serve\",\n    // `sessionId` answers \"which applications rode this session\" (the\n    // back-channel logout audience), and the pair scopes a per-application\n    // revoke to one session.\n    filters: {\n        allowed: [\n            'id',\n            'sessionId',\n            'clientId',\n            'kind',\n            'expiresAt',\n        ],\n        indexed: true,\n    },\n    // `client` is deliberately absent: the repository always joins a client\n    // SUMMARY (id / name / displayName — the consent-list shape), so a raw\n    // `?include=client` cannot force the full-column join and a self-service\n    // reader still gets application names without CLIENT_READ.\n    relations: { allowed: ['session'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['createdAt', 'expiresAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,SAASH,WAAWI,QAAQ;;;;;;;;;GAWpD,MAAaC,qBAAqBN,aAA2B;CACzDO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,WAAY;EACb,CAAC,UAAW;EACZ,CAAC,MAAO;EACR,CAAC,WAAY;EACb,CAAC,aAAa,WAAY;EAC1B,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CAQAC,SAAS;EACLD,SAAS;GACL;GACA;GACA;GACA;GACA;EACH;EACDE,SAAS;CACb;CAKAC,WAAW;EAAEH,SAAS,CAAC,SAAU;EAAEI,UAAUb,wBAAwBC,aAAAA;CAAe;CACpFa,OAAO;EAAEL,SAAS,CAAC,aAAa,WAAY;EAAEE,SAAS;CAAK;CAC5DI,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}