@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/core/provisioning/entities/realm/validator.d.ts

@@ -1,6 +1,17 @@
+import type { ContainerInput, ContainerRunOptions } from 'validup';
 import { Container } from 'validup';
+import { RealmWildcardProvisioningValidator } from './wildcard-validator.ts';
 import type { RealmProvisioningEntity } from './types.ts';
 export declare class RealmProvisioningValidator extends Container<RealmProvisioningEntity> {
+    protected wildcardValidator: RealmWildcardProvisioningValidator;
     protected initialize(): void;
+    /**
+     * A realm entry named with the literal wildcard ('*') is a selector
+     * over all realms and follows its own, stricter contract — dispatch it
+     * to the wildcard validator. Anything else (including partial patterns
+     * like 'tenant-*') runs the regular realm validation, where a
+     * non-name-safe character fails the name check.
+     */
+    run(input?: ContainerInput<RealmProvisioningEntity>, options?: ContainerRunOptions<RealmProvisioningEntity>): Promise<RealmProvisioningEntity>;
 }
 //# sourceMappingURL=validator.d.ts.map

package/dist/core/provisioning/entities/realm/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,qBAAa,0BAA2B,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IAC9E,SAAS,CAAC,UAAU;CAYvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,qBAAa,0BAA2B,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IAC9E,SAAS,CAAC,iBAAiB,qCAA4C;IAEvE,SAAS,CAAC,UAAU;IAapB;;;;;;OAMG;IACY,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,uBAAuB,CAAC,EAC/C,OAAO,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,GACvD,OAAO,CAAC,uBAAuB,CAAC;CAWtC"}

package/dist/core/provisioning/entities/realm/validator.mjs

@@ -1,13 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import "../../constants.mjs";
 import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
 import "../../strategy/index.mjs";
 import { RealmProvisioningRelationsValidator } from "./relations-validator.mjs";
+import { RealmWildcardProvisioningValidator } from "./wildcard-validator.mjs";
+import { isObject } from "@authup/kit";
 import { RealmValidator } from "@authup/core-kit";
 import { Container } from "validup";
 //#region src/core/provisioning/entities/realm/validator.ts
 var RealmProvisioningValidator = class extends Container {
+	wildcardValidator = new RealmWildcardProvisioningValidator();
 	initialize() {
 		super.initialize();
 		const strategyValidator = new ProvisioningStrategyValidator();
@@ -17,6 +21,16 @@ var RealmProvisioningValidator = class extends Container {
 		const relationsValidator = new RealmProvisioningRelationsValidator();
 		this.mount("relations", { optional: true }, relationsValidator);
 	}
+	/**
+	* A realm entry named with the literal wildcard ('*') is a selector
+	* over all realms and follows its own, stricter contract — dispatch it
+	* to the wildcard validator. Anything else (including partial patterns
+	* like 'tenant-*') runs the regular realm validation, where a
+	* non-name-safe character fails the name check.
+	*/ async run(input, options) {
+		if (isObject(input) && isObject(input.attributes) && input.attributes.name === "*") return this.wildcardValidator.run(input, options);
+		return super.run(input, options);
+	}
 };
 //#endregion
 export { RealmProvisioningValidator };

package/dist/core/provisioning/entities/realm/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["RealmValidator","Container","ProvisioningStrategyValidator","RealmProvisioningRelationsValidator","RealmProvisioningValidator","initialize","strategyValidator","mount","optional","attributesValidator","relationsValidator"],"sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { RealmValidator } from '@authup/core-kit';\nimport { Container } from 'validup';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\n\nimport type { RealmProvisioningEntity } from './types.ts';\n\nexport class RealmProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new RealmValidator();\n        this.mount('attributes', attributesValidator);\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n}\n"],"mappings":";;;;;;;;;AAcA,IAAaI,6BAAb,cAAgDH,UAAAA;CAClCI,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIJ,8BAAAA;EAC9B,KAAKK,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIT,eAAAA;EAChC,KAAKO,MAAM,cAAcE,mBAAAA;EAEzB,MAAMC,qBAAqB,IAAIP,oCAAAA;EAC/B,KAAKI,MAAM,aAAa,EAAEC,UAAU,KAAK,GAAGE,kBAAAA;CAChD;AACJ"}
+{"version":3,"file":"validator.mjs","names":["RealmValidator","isObject","Container","REALM_WILDCARD_NAME","ProvisioningStrategyValidator","RealmProvisioningRelationsValidator","RealmWildcardProvisioningValidator","RealmProvisioningValidator","wildcardValidator","initialize","strategyValidator","mount","optional","attributesValidator","relationsValidator","run","input","options","attributes","name"],"sources":["../../../../../src/core/provisioning/entities/realm/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { RealmValidator } from '@authup/core-kit';\nimport { isObject } from '@authup/kit';\nimport type { ContainerInput, ContainerRunOptions } from 'validup';\nimport { Container } from 'validup';\nimport { REALM_WILDCARD_NAME } from '../../constants.ts';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\nimport { RealmWildcardProvisioningValidator } from './wildcard-validator.ts';\n\nimport type { RealmProvisioningEntity } from './types.ts';\n\nexport class RealmProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected wildcardValidator = new RealmWildcardProvisioningValidator();\n\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new RealmValidator();\n        this.mount('attributes', attributesValidator);\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n\n    /**\n     * A realm entry named with the literal wildcard ('*') is a selector\n     * over all realms and follows its own, stricter contract — dispatch it\n     * to the wildcard validator. Anything else (including partial patterns\n     * like 'tenant-*') runs the regular realm validation, where a\n     * non-name-safe character fails the name check.\n     */\n    override async run(\n        input?: ContainerInput<RealmProvisioningEntity>,\n        options?: ContainerRunOptions<RealmProvisioningEntity>,\n    ): Promise<RealmProvisioningEntity> {\n        if (\n            isObject(input) &&\n            isObject(input.attributes) &&\n            input.attributes.name === REALM_WILDCARD_NAME\n        ) {\n            return this.wildcardValidator.run(input, options);\n        }\n\n        return super.run(input, options);\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,IAAaO,6BAAb,cAAgDL,UAAAA;CAClCM,oBAAoB,IAAIF,mCAAAA;CAExBG,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIN,8BAAAA;EAC9B,KAAKO,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIb,eAAAA;EAChC,KAAKW,MAAM,cAAcE,mBAAAA;EAEzB,MAAMC,qBAAqB,IAAIT,oCAAAA;EAC/B,KAAKM,MAAM,aAAa,EAAEC,UAAU,KAAK,GAAGE,kBAAAA;CAChD;;;;;;;IASA,MAAeC,IACXC,OACAC,SACgC;EAChC,IACIhB,SAASe,KAAAA,KACTf,SAASe,MAAME,UAAU,KACzBF,MAAME,WAAWC,SAAAA,KAEjB,OAAO,KAAKX,kBAAkBO,IAAIC,OAAOC,OAAAA;EAG7C,OAAO,MAAMF,IAAIC,OAAOC,OAAAA;CAC5B;AACJ"}

package/dist/core/provisioning/entities/realm/wildcard-validator.d.ts

@@ -0,0 +1,19 @@
+import type { ContainerInput, ContainerRunOptions } from 'validup';
+import { Container } from 'validup';
+import type { RealmProvisioningEntity } from './types.ts';
+/**
+ * Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard
+ * entry is a selector over realms, not a realm declaration, so it is
+ * relations-only: `attributes` may carry nothing but the literal wildcard
+ * name, and a realm-level `strategy` is rejected (`absent` would mean
+ * "delete every realm"). Child strategies stay fully supported.
+ *
+ * Reserved client names (system / console clients) are rejected: a
+ * template stamping one into every realm would fight the system client
+ * MERGE on every boot.
+ */
+export declare class RealmWildcardProvisioningValidator extends Container<RealmProvisioningEntity> {
+    protected initialize(): void;
+    run(input?: ContainerInput<RealmProvisioningEntity>, options?: ContainerRunOptions<RealmProvisioningEntity>): Promise<RealmProvisioningEntity>;
+}
+//# sourceMappingURL=wildcard-validator.d.ts.map

package/dist/core/provisioning/entities/realm/wildcard-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildcard-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAS,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAiC,MAAM,SAAS,CAAC;AAInE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IACtF,SAAS,CAAC,UAAU;IA8BL,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,uBAAuB,CAAC,EAC/C,OAAO,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,GACvD,OAAO,CAAC,uBAAuB,CAAC;CAsBtC"}

package/dist/core/provisioning/entities/realm/wildcard-validator.mjs

@@ -0,0 +1,65 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "../../constants.mjs";
+import { RealmProvisioningRelationsValidator } from "./relations-validator.mjs";
+import { CLIENT_RESERVED_NAMES } from "@authup/core-kit";
+import { Container, ValidupError, defineIssueItem } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+//#region src/core/provisioning/entities/realm/wildcard-validator.ts
+/**
+* Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard
+* entry is a selector over realms, not a realm declaration, so it is
+* relations-only: `attributes` may carry nothing but the literal wildcard
+* name, and a realm-level `strategy` is rejected (`absent` would mean
+* "delete every realm"). Child strategies stay fully supported.
+*
+* Reserved client names (system / console clients) are rejected: a
+* template stamping one into every realm would fight the system client
+* MERGE on every boot.
+*/ var RealmWildcardProvisioningValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("attributes", createValidator(z.looseObject({ name: z.literal("*") }).check((ctx) => {
+			if (Object.keys(ctx.value).length > 1) ctx.issues.push({
+				code: "custom",
+				input: ctx.value,
+				message: "A wildcard realm entry is relations-only and can not declare realm attributes."
+			});
+		})));
+		this.mount("strategy", { optional: true }, createValidator(z.any().check((ctx) => {
+			ctx.issues.push({
+				code: "custom",
+				input: ctx.value,
+				message: "A wildcard realm entry can not declare a realm-level strategy."
+			});
+		})));
+		const relationsValidator = new RealmProvisioningRelationsValidator();
+		this.mount("relations", { optional: true }, relationsValidator);
+	}
+	async run(input, options) {
+		const output = await super.run(input, options);
+		const issues = [];
+		(output.relations?.clients ?? []).forEach((client, index) => {
+			const name = client.attributes?.name;
+			if (name && CLIENT_RESERVED_NAMES.includes(name)) issues.push(defineIssueItem({
+				path: [
+					"relations",
+					"clients",
+					index,
+					"attributes",
+					"name"
+				],
+				message: `The client name "${name}" is reserved for system clients and can not be declared in a wildcard realm entry.`,
+				received: name
+			}));
+		});
+		if (issues.length > 0) throw new ValidupError(issues);
+		return output;
+	}
+};
+//#endregion
+export { RealmWildcardProvisioningValidator };
+
+//# sourceMappingURL=wildcard-validator.mjs.map

package/dist/core/provisioning/entities/realm/wildcard-validator.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildcard-validator.mjs","names":["CLIENT_RESERVED_NAMES","createValidator","Container","ValidupError","defineIssueItem","z","REALM_WILDCARD_NAME","RealmProvisioningRelationsValidator","RealmWildcardProvisioningValidator","initialize","mount","looseObject","name","literal","check","ctx","keys","Object","value","length","issues","push","code","input","message","optional","any","relationsValidator","run","options","output","clients","relations","forEach","client","index","attributes","includes","path","received"],"sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_RESERVED_NAMES } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport type { ContainerInput, ContainerRunOptions, Issue } from 'validup';\nimport { Container, ValidupError, defineIssueItem } from 'validup';\nimport { z } from 'zod';\nimport { REALM_WILDCARD_NAME } from '../../constants.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\nimport type { RealmProvisioningEntity } from './types.ts';\n\n/**\n * Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard\n * entry is a selector over realms, not a realm declaration, so it is\n * relations-only: `attributes` may carry nothing but the literal wildcard\n * name, and a realm-level `strategy` is rejected (`absent` would mean\n * \"delete every realm\"). Child strategies stay fully supported.\n *\n * Reserved client names (system / console clients) are rejected: a\n * template stamping one into every realm would fight the system client\n * MERGE on every boot.\n */\nexport class RealmWildcardProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount('attributes', createValidator(\n            z.looseObject({ name: z.literal(REALM_WILDCARD_NAME) }).check((ctx) => {\n                const keys = Object.keys(ctx.value);\n                if (keys.length > 1) {\n                    ctx.issues.push({\n                        code: 'custom',\n                        input: ctx.value,\n                        message: 'A wildcard realm entry is relations-only and can not declare realm attributes.',\n                    });\n                }\n            }),\n        ));\n\n        this.mount('strategy', { optional: true }, createValidator(\n            z.any().check((ctx) => {\n                ctx.issues.push({\n                    code: 'custom',\n                    input: ctx.value,\n                    message: 'A wildcard realm entry can not declare a realm-level strategy.',\n                });\n            }),\n        ));\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n\n    override async run(\n        input?: ContainerInput<RealmProvisioningEntity>,\n        options?: ContainerRunOptions<RealmProvisioningEntity>,\n    ): Promise<RealmProvisioningEntity> {\n        const output = await super.run(input, options);\n\n        const issues : Issue[] = [];\n        const clients = output.relations?.clients ?? [];\n        clients.forEach((client, index) => {\n            const name = client.attributes?.name;\n            if (name && (CLIENT_RESERVED_NAMES as string[]).includes(name)) {\n                issues.push(defineIssueItem({\n                    path: ['relations', 'clients', index, 'attributes', 'name'],\n                    message: `The client name \"${name}\" is reserved for system clients and can not be declared in a wildcard realm entry.`,\n                    received: name,\n                }));\n            }\n        });\n\n        if (issues.length > 0) {\n            throw new ValidupError(issues);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;GA2BA,IAAaQ,qCAAb,cAAwDN,UAAAA;CAC1CO,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MAAM,cAAcT,gBACrBI,EAAEM,YAAY,EAAEC,MAAMP,EAAEQ,QAAAA,GAAQP,EAAqB,CAAA,CAAA,CAAGQ,OAAOC,QAAAA;GAE3D,IADaE,OAAOD,KAAKD,IAAIG,KACzBF,CAAAA,CAAKG,SAAS,GACdJ,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EAER,CAAA,CAAA,CAAA;EAGJ,KAAKd,MAAM,YAAY,EAAEe,UAAU,KAAK,GAAGxB,gBACvCI,EAAEqB,IAAG,CAAA,CAAGZ,OAAOC,QAAAA;GACXA,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EACJ,CAAA,CAAA,CAAA;EAGJ,MAAMG,qBAAqB,IAAIpB,oCAAAA;EAC/B,KAAKG,MAAM,aAAa,EAAEe,UAAU,KAAK,GAAGE,kBAAAA;CAChD;CAEA,MAAeC,IACXL,OACAM,SACgC;EAChC,MAAMC,SAAS,MAAM,MAAMF,IAAIL,OAAOM,OAAAA;EAEtC,MAAMT,SAAmB,CAAA;EAEzBW,CADgBD,OAAOE,WAAWD,WAAW,CAAA,EAAA,CACrCE,SAASC,QAAQC,UAAAA;GACrB,MAAMvB,OAAOsB,OAAOE,YAAYxB;GAChC,IAAIA,QAAQ,sBAAoCyB,SAASzB,IAAAA,GACrDQ,OAAOC,KAAKjB,gBAAgB;IACxBkC,MAAM;KAAC;KAAa;KAAWH;KAAO;KAAc;IAAO;IAC3DX,SAAS,oBAAoBZ,KAAK;IAClC2B,UAAU3B;GACd,CAAA,CAAA;EAER,CAAA;EAEA,IAAIQ,OAAOD,SAAS,GAChB,MAAM,IAAIhB,aAAaiB,MAAAA;EAG3B,OAAOU;CACX;AACJ"}

package/dist/core/provisioning/index.d.ts

@@ -1,5 +1,8 @@
+export * from './constants.ts';
 export * from './entities/index.ts';
+export * from './merge/index.ts';
 export * from './strategy/index.ts';
 export * from './synchronizer/index.ts';
 export * from './types.ts';
+export * from './wildcard/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC"}

package/dist/core/provisioning/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { REALM_WILDCARD_NAME } from "./constants.mjs";
 import { ProvisioningEntityStrategyType } from "./strategy/constants.mjs";
 import { normalizeEntityProvisioningStrategy } from "./strategy/normalize.mjs";
 import { ProvisioningStrategyValidator } from "./strategy/validator.mjs";
@@ -13,9 +14,12 @@ import { ClientProvisioningValidator } from "./entities/client/validator.mjs";
 import { PolicyProvisioningValidator } from "./entities/policy/validator.mjs";
 import { ScopeProvisioningValidator } from "./entities/scope/validator.mjs";
 import { UserProvisioningValidator } from "./entities/user/validator.mjs";
+import { RealmWildcardProvisioningValidator } from "./entities/realm/wildcard-validator.mjs";
 import { RealmProvisioningValidator } from "./entities/realm/validator.mjs";
 import { RootProvisioningValidator } from "./entities/root/validator.mjs";
 import "./entities/index.mjs";
+import { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity } from "./merge/module.mjs";
+import "./merge/index.mjs";
 import { ProvisioningEntityResolver } from "./synchronizer/entity-resolver.mjs";
 import { ProvisioningJunctionSynchronizer } from "./synchronizer/junction-synchronizer.mjs";
 import { ClientProvisioningSynchronizer } from "./synchronizer/client/module.mjs";
@@ -27,4 +31,6 @@ import { GraphProvisioningSynchronizer } from "./synchronizer/root/module.mjs";
 import { ScopeProvisioningSynchronizer } from "./synchronizer/scope/module.mjs";
 import { UserProvisioningSynchronizer } from "./synchronizer/user/module.mjs";
 import "./synchronizer/index.mjs";
-export { ClientProvisioningSynchronizer, ClientProvisioningValidator, GraphProvisioningSynchronizer, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, RealmProvisioningSynchronizer, RealmProvisioningValidator, RoleProvisioningSynchronizer, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, UserProvisioningSynchronizer, UserProvisioningValidator, createProvisioningEntitiesValidator, normalizeEntityProvisioningStrategy };
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./wildcard/module.mjs";
+import "./wildcard/index.mjs";
+export { ClientProvisioningSynchronizer, ClientProvisioningValidator, GraphProvisioningSynchronizer, PermissionProvisioningRelationsValidator, PermissionProvisioningSynchronizer, PermissionProvisioningValidator, PolicyProvisioningSynchronizer, PolicyProvisioningValidator, ProvisioningEntityResolver, ProvisioningEntityStrategyType, ProvisioningJunctionSynchronizer, ProvisioningStrategyValidator, REALM_WILDCARD_NAME, RealmProvisioningSynchronizer, RealmProvisioningValidator, RealmWildcardProvisioningValidator, RoleProvisioningSynchronizer, RoleProvisioningValidator, RootProvisioningValidator, ScopeProvisioningSynchronizer, ScopeProvisioningValidator, UserProvisioningSynchronizer, UserProvisioningValidator, WildcardRealmProvisioner, buildProvisioningEntityKey, createProvisioningEntitiesValidator, expandWildcardRealmEntry, extractWildcardRealmEntry, mergeProvisioningEntities, mergeProvisioningEntity, normalizeEntityProvisioningStrategy };

package/dist/core/provisioning/merge/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/merge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/merge/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/merge/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity } from "./module.mjs";
+export { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity };

package/dist/core/provisioning/merge/module.d.ts

@@ -0,0 +1,18 @@
+import type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';
+export declare function buildProvisioningEntityKey(attributes: MergeableProvisioningEntity['attributes']): string | undefined;
+export declare function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(target: T[] | undefined, source: T[] | undefined, options?: MergeProvisioningOptions): T[] | undefined;
+/**
+ * Deep-merge two entries sharing a composite key. The later (source) side
+ * wins per attribute, but relations are UNIONED — a later source (e.g. a
+ * mounted provisioning file) extending a built-in entry (the default
+ * source's master realm) must not silently drop the built-in relations
+ * (admin user, system client).
+ *
+ * Policy extraAttributes merge per key with the later source winning —
+ * like attributes, NOT like relations: an EA value (a names denylist,
+ * an ATTRIBUTES query tree) is policy configuration, and unioning would
+ * make shrinking a list impossible and fabricate predicates neither
+ * source authored.
+ */
+export declare function mergeProvisioningEntity(target: MergeableProvisioningEntity, source: MergeableProvisioningEntity, options?: MergeProvisioningOptions): MergeableProvisioningEntity;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/merge/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/merge/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAExF,wBAAgB,0BAA0B,CACtC,UAAU,EAAE,2BAA2B,CAAC,YAAY,CAAC,GACtD,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,2BAA2B,EAC3E,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,EACvB,MAAM,EAAE,CAAC,EAAE,GAAG,SAAS,EACvB,OAAO,GAAE,wBAA6B,GACvC,CAAC,EAAE,GAAG,SAAS,CAoBjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,2BAA2B,EACnC,MAAM,EAAE,2BAA2B,EACnC,OAAO,GAAE,wBAA6B,GACvC,2BAA2B,CAiC7B"}

package/dist/core/provisioning/merge/module.mjs

@@ -0,0 +1,82 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isObject } from "@authup/kit";
+//#region src/core/provisioning/merge/module.ts
+function buildProvisioningEntityKey(attributes) {
+	if (!attributes.name) return void 0;
+	return `${attributes.name}:${attributes.realmId || ""}:${attributes.clientId || ""}`;
+}
+function mergeProvisioningEntities(target, source, options = {}) {
+	if (!source) return target;
+	if (!target) return [...source];
+	const result = [...target];
+	source.forEach((item) => {
+		const key = buildProvisioningEntityKey(item.attributes);
+		if (!key) {
+			result.push(item);
+			return;
+		}
+		const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);
+		if (idx !== -1) result[idx] = mergeProvisioningEntity(result[idx], item, options);
+		else result.push(item);
+	});
+	return result;
+}
+/**
+* Deep-merge two entries sharing a composite key. The later (source) side
+* wins per attribute, but relations are UNIONED — a later source (e.g. a
+* mounted provisioning file) extending a built-in entry (the default
+* source's master realm) must not silently drop the built-in relations
+* (admin user, system client).
+*
+* Policy extraAttributes merge per key with the later source winning —
+* like attributes, NOT like relations: an EA value (a names denylist,
+* an ATTRIBUTES query tree) is policy configuration, and unioning would
+* make shrinking a list impossible and fabricate predicates neither
+* source authored.
+*/ function mergeProvisioningEntity(target, source, options = {}) {
+	const output = {
+		...target,
+		...source
+	};
+	output.attributes = {
+		...target.attributes,
+		...source.attributes
+	};
+	const inheritStrategy = options.inheritStrategy ?? true;
+	if (target.strategy && !source.strategy) if (inheritStrategy) output.strategy = target.strategy;
+	else delete output.strategy;
+	if (target.relations && source.relations) output.relations = mergeProvisioningRecord(target.relations, source.relations, options);
+	else if (target.relations && !source.relations) output.relations = target.relations;
+	if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
+		...target.extraAttributes,
+		...source.extraAttributes
+	};
+	else if (target.extraAttributes && !source.extraAttributes) output.extraAttributes = target.extraAttributes;
+	if (target.children && source.children) output.children = mergeProvisioningEntities(target.children, source.children, options);
+	else if (target.children && !source.children) output.children = target.children;
+	return output;
+}
+function mergeProvisioningRecord(target, source, options = {}) {
+	const output = { ...target };
+	for (const key of Object.keys(source)) output[key] = key in target ? mergeProvisioningValue(target[key], source[key], options) : source[key];
+	return output;
+}
+function mergeProvisioningValue(target, source, options = {}) {
+	if (typeof target === "undefined") return source;
+	if (typeof source === "undefined") return target;
+	if (Array.isArray(target) && Array.isArray(source)) {
+		if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) return mergeProvisioningEntities(target, source, options);
+		return [.../* @__PURE__ */ new Set([...target, ...source])];
+	}
+	if (isObject(target) && isObject(source)) return mergeProvisioningRecord(target, source, options);
+	return source;
+}
+function isProvisioningEntityArray(value) {
+	return value.some((item) => isObject(item) && "attributes" in item);
+}
+//#endregion
+export { buildProvisioningEntityKey, mergeProvisioningEntities, mergeProvisioningEntity };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/provisioning/merge/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["isObject","buildProvisioningEntityKey","attributes","name","undefined","realmId","clientId","mergeProvisioningEntities","target","source","options","result","forEach","item","key","push","idx","findIndex","r","mergeProvisioningEntity","output","inheritStrategy","strategy","relations","mergeProvisioningRecord","extraAttributes","children","Object","keys","mergeProvisioningValue","Array","isArray","isProvisioningEntityArray","Set","value","some"],"sources":["../../../../src/core/provisioning/merge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';\n\nexport function buildProvisioningEntityKey(\n    attributes: MergeableProvisioningEntity['attributes'],\n): string | undefined {\n    if (!attributes.name) return undefined;\n    return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n}\n\nexport function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(\n    target: T[] | undefined,\n    source: T[] | undefined,\n    options: MergeProvisioningOptions = {},\n): T[] | undefined {\n    if (!source) return target;\n    if (!target) return [...source];\n\n    const result = [...target];\n    source.forEach((item) => {\n        const key = buildProvisioningEntityKey(item.attributes);\n        if (!key) {\n            result.push(item);\n            return;\n        }\n\n        const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);\n        if (idx !== -1) {\n            result[idx] = mergeProvisioningEntity(result[idx], item, options) as T;\n        } else {\n            result.push(item);\n        }\n    });\n    return result;\n}\n\n/**\n * Deep-merge two entries sharing a composite key. The later (source) side\n * wins per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n *\n * Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\nexport function mergeProvisioningEntity(\n    target: MergeableProvisioningEntity,\n    source: MergeableProvisioningEntity,\n    options: MergeProvisioningOptions = {},\n): MergeableProvisioningEntity {\n    const output = { ...target, ...source };\n\n    output.attributes = { ...target.attributes, ...source.attributes };\n\n    const inheritStrategy = options.inheritStrategy ?? true;\n    if (target.strategy && !source.strategy) {\n        if (inheritStrategy) {\n            output.strategy = target.strategy;\n        } else {\n            delete output.strategy;\n        }\n    }\n\n    if (target.relations && source.relations) {\n        output.relations = mergeProvisioningRecord(target.relations, source.relations, options);\n    } else if (target.relations && !source.relations) {\n        output.relations = target.relations;\n    }\n\n    if (target.extraAttributes && source.extraAttributes) {\n        output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n    } else if (target.extraAttributes && !source.extraAttributes) {\n        output.extraAttributes = target.extraAttributes;\n    }\n\n    if (target.children && source.children) {\n        output.children = mergeProvisioningEntities(target.children, source.children, options);\n    } else if (target.children && !source.children) {\n        output.children = target.children;\n    }\n\n    return output;\n}\n\nfunction mergeProvisioningRecord(\n    target: Record<string, unknown>,\n    source: Record<string, unknown>,\n    options: MergeProvisioningOptions = {},\n): Record<string, unknown> {\n    const output : Record<string, unknown> = { ...target };\n    for (const key of Object.keys(source)) {\n        output[key] = key in target ?\n            mergeProvisioningValue(target[key], source[key], options) :\n            source[key];\n    }\n    return output;\n}\n\nfunction mergeProvisioningValue(\n    target: unknown,\n    source: unknown,\n    options: MergeProvisioningOptions = {},\n): unknown {\n    if (typeof target === 'undefined') return source;\n    if (typeof source === 'undefined') return target;\n\n    if (Array.isArray(target) && Array.isArray(source)) {\n        if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) {\n            return mergeProvisioningEntities(\n                target as MergeableProvisioningEntity[],\n                source as MergeableProvisioningEntity[],\n                options,\n            );\n        }\n        return [...new Set([...target, ...source])];\n    }\n\n    if (isObject(target) && isObject(source)) {\n        return mergeProvisioningRecord(target, source, options);\n    }\n\n    return source;\n}\n\nfunction isProvisioningEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n    return value.some(\n        (item) => isObject(item) && 'attributes' in item,\n    );\n}\n"],"mappings":";;;;;AAUA,SAAgBC,2BACZC,YAAqD;CAErD,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;CAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;AACpF;AAEA,SAAgBC,0BACZC,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,CAACD,QAAQ,OAAOD;CACpB,IAAI,CAACA,QAAQ,OAAO,CAAIC,GAAAA,MAAO;CAE/B,MAAME,SAAS,CAAIH,GAAAA,MAAO;CAC1BC,OAAOG,SAASC,SAAAA;EACZ,MAAMC,MAAMb,2BAA2BY,KAAKX,UAAU;EACtD,IAAI,CAACY,KAAK;GACNH,OAAOI,KAAKF,IAAAA;GACZ;EACJ;EAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAMjB,2BAA2BiB,EAAEhB,UAAU,MAAMY,GAAAA;EACjF,IAAIE,QAAQ,IACRL,OAAOK,OAAOG,wBAAwBR,OAAOK,MAAMH,MAAMH,OAAAA;OAEzDC,OAAOI,KAAKF,IAAAA;CAEpB,CAAA;CACA,OAAOF;AACX;;;;;;;;;;;;;GAeA,SAAgBQ,wBACZX,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAS;EAAE,GAAGZ;EAAQ,GAAGC;CAAO;CAEtCW,OAAOlB,aAAa;EAAE,GAAGM,OAAON;EAAY,GAAGO,OAAOP;CAAW;CAEjE,MAAMmB,kBAAkBX,QAAQW,mBAAmB;CACnD,IAAIb,OAAOc,YAAY,CAACb,OAAOa,UAC3B,IAAID,iBACAD,OAAOE,WAAWd,OAAOc;MAEzB,OAAOF,OAAOE;CAItB,IAAId,OAAOe,aAAad,OAAOc,WAC3BH,OAAOG,YAAYC,wBAAwBhB,OAAOe,WAAWd,OAAOc,WAAWb,OAAAA;MAC5E,IAAIF,OAAOe,aAAa,CAACd,OAAOc,WACnCH,OAAOG,YAAYf,OAAOe;CAG9B,IAAIf,OAAOiB,mBAAmBhB,OAAOgB,iBACjCL,OAAOK,kBAAkB;EAAE,GAAGjB,OAAOiB;EAAiB,GAAGhB,OAAOgB;CAAgB;MAC7E,IAAIjB,OAAOiB,mBAAmB,CAAChB,OAAOgB,iBACzCL,OAAOK,kBAAkBjB,OAAOiB;CAGpC,IAAIjB,OAAOkB,YAAYjB,OAAOiB,UAC1BN,OAAOM,WAAWnB,0BAA0BC,OAAOkB,UAAUjB,OAAOiB,UAAUhB,OAAAA;MAC3E,IAAIF,OAAOkB,YAAY,CAACjB,OAAOiB,UAClCN,OAAOM,WAAWlB,OAAOkB;CAG7B,OAAON;AACX;AAEA,SAASI,wBACLhB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAmC,EAAE,GAAGZ,OAAO;CACrD,KAAK,MAAMM,OAAOa,OAAOC,KAAKnB,MAAAA,GAC1BW,OAAON,OAAOA,OAAON,SACjBqB,uBAAuBrB,OAAOM,MAAML,OAAOK,MAAMJ,OAAAA,IACjDD,OAAOK;CAEf,OAAOM;AACX;AAEA,SAASS,uBACLrB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,OAAOF,WAAW,aAAa,OAAOC;CAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOD;CAE1C,IAAIsB,MAAMC,QAAQvB,MAAAA,KAAWsB,MAAMC,QAAQtB,MAAAA,GAAS;EAChD,IAAIuB,0BAA0BxB,MAAAA,KAAWwB,0BAA0BvB,MAAAA,GAC/D,OAAOF,0BACHC,QACAC,QACAC,OAAAA;EAGR,OAAO,CAAI,mBAAA,IAAIuB,IAAI,CAAIzB,GAAAA,QAAWC,GAAAA,MAAO,CAAA,CAAE;CAC/C;CAEA,IAAIT,SAASQ,MAAAA,KAAWR,SAASS,MAAAA,GAC7B,OAAOe,wBAAwBhB,QAAQC,QAAQC,OAAAA;CAGnD,OAAOD;AACX;AAEA,SAASuB,0BAA0BE,OAAgB;CAC/C,OAAOA,MAAMC,MACRtB,SAASb,SAASa,IAAAA,KAAS,gBAAgBA,IAAAA;AAEpD"}

package/dist/core/provisioning/merge/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Structural view of a provisioning entity used by the deep merge.
+ * Covers every entity shape (realm, client, user, role, permission, scope,
+ * policy): the composite-key attribute bag plus the deep-mergeable groups.
+ */
+export type MergeProvisioningOptions = {
+    /**
+     * May a source entry that declares no `strategy` inherit the target's?
+     *
+     * True for the composite source, where target/source are "earlier file"
+     * and "later file" and inheriting an unspecified strategy is the
+     * documented rule.
+     *
+     * False for the wildcard expansion, where the precedence is INVERTED:
+     * the target is the wildcard (low precedence) and the source is an
+     * explicit realm block (high precedence). Inheriting there would let a
+     * wildcard child supply the lifecycle of an entity the operator declared
+     * explicitly, and `absent` is part of that vocabulary, so a wildcard
+     * sweep would delete the very row the explicit block declares.
+     */
+    inheritStrategy?: boolean;
+};
+export type MergeableProvisioningEntity = {
+    attributes: {
+        name?: string;
+        realmId?: string | null;
+        clientId?: string | null;
+    };
+    strategy?: unknown;
+    relations?: Record<string, unknown>;
+    children?: MergeableProvisioningEntity[];
+    extraAttributes?: Record<string, unknown>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/merge/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/merge/types.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,UAAU,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C,CAAC"}

package/dist/core/provisioning/merge/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/provisioning/types.d.ts

@@ -1,8 +1,18 @@
+import type { Realm } from '@authup/core-kit';
 import type { RootProvisioningEntity } from './entities/index.ts';
 import type { IContainer } from 'eldin';
 export interface IProvisioningSource {
     load(container: IContainer): Promise<RootProvisioningEntity>;
 }
+/**
+ * A provisioner invoked for one realm: at startup (backfill over every
+ * existing realm) and on runtime realm creation (`RealmService.save`).
+ * Implementations must be idempotent; a failure must never fail realm
+ * creation (the caller logs and continues).
+ */
+export interface IRealmProvisioner {
+    ensureForRealm(realm: Realm): Promise<void>;
+}
 export interface IProvisioningSynchronizer<T> {
     synchronize(input: T): Promise<T>;
     synchronizeMany(input: T[]): Promise<T[]>;

package/dist/core/provisioning/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/provisioning/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,GAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;CAC9C"}

package/dist/core/provisioning/wildcard/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/provisioning/wildcard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/provisioning/wildcard/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry } from "./module.mjs";
+export { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry };

package/dist/core/provisioning/wildcard/module.d.ts

@@ -0,0 +1,53 @@
+import type { Realm } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
+import type { RealmProvisioningEntity, RealmProvisioningRelations } from '../entities/index.ts';
+import type { IProvisioningSynchronizer, IRealmProvisioner } from '../types.ts';
+import type { WildcardRealmProvisionerContext } from './types.ts';
+/**
+ * Split the wildcard entries (attributes.name === '*') out of
+ * `data.realms`, folding multiples (several files, several entries) into
+ * one via the composite merge rules. The folded entry is stripped to a
+ * relations-only shape: a wildcard entry is a SELECTOR over realms, so
+ * realm-level attributes and a realm-level strategy carry no meaning
+ * (validated away on the file path; discarded structurally here so
+ * programmatic sources get the same semantics).
+ */
+export declare function extractWildcardRealmEntry(data: {
+    realms?: RealmProvisioningEntity[];
+}): RealmProvisioningEntity | undefined;
+/**
+ * Deep-merge the wildcard entry UNDER every explicit realm entry (explicit
+ * wins per attribute, relation lists union, the explicit child's strategy
+ * wins when it carries one) so the graph sync covers those realms in
+ * one pass. Returns the merged relations per canonical realm name, kept
+ * PRISTINE (cloned before the sync mutates anything) for the runtime
+ * creation hook.
+ */
+export declare function expandWildcardRealmEntry(wildcard: RealmProvisioningEntity, data: {
+    realms?: RealmProvisioningEntity[];
+}): Map<string, RealmProvisioningRelations>;
+/**
+ * Applies the wildcard entry's relations to ONE realm, by synthesizing a
+ * realm provisioning entity and pushing it through the regular realm
+ * synchronizer (scopes -> clients -> permissions -> roles -> users; the
+ * realm row itself is resolved by name and, carrying no strategy, is
+ * never modified). The entry is deep-cloned per application: the
+ * synchronizer mutates its input (realmId stamping, `replace` writes the
+ * resolved row id back), so a shared object would leak one realm's ids
+ * into the next realm's sync.
+ */
+export declare class WildcardRealmProvisioner implements IRealmProvisioner {
+    protected relations: RealmProvisioningRelations;
+    protected relationsByRealmName?: Map<string, RealmProvisioningRelations>;
+    protected synchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;
+    protected logger?: Logger;
+    constructor(ctx: WildcardRealmProvisionerContext);
+    /**
+     * True when the loaded config also declares this realm explicitly:
+     * the startup graph sync already covers it (expansion), so the boot
+     * backfill loop skips it.
+     */
+    hasExplicitEntry(realm: Realm): boolean;
+    ensureForRealm(realm: Realm): Promise<void>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/core/provisioning/wildcard/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEhG,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAMlE;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACrC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;CAAE,GAC7C,uBAAuB,GAAG,SAAS,CAyBrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACpC,QAAQ,EAAE,uBAAuB,EACjC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;CAAE,GAC7C,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CA8BzC;AAED;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAC9D,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAEhD,SAAS,CAAC,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAEzE,SAAS,CAAC,YAAY,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAE3E,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,+BAA+B;IAOhD;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO;IAOjC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBpD"}

package/dist/core/provisioning/wildcard/module.mjs

@@ -0,0 +1,91 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "../constants.mjs";
+import { mergeProvisioningEntity } from "../merge/module.mjs";
+import "../merge/index.mjs";
+//#region src/core/provisioning/wildcard/module.ts
+function canonicalizeRealmName(name) {
+	return name.trim().toLowerCase();
+}
+/**
+* Split the wildcard entries (attributes.name === '*') out of
+* `data.realms`, folding multiples (several files, several entries) into
+* one via the composite merge rules. The folded entry is stripped to a
+* relations-only shape: a wildcard entry is a SELECTOR over realms, so
+* realm-level attributes and a realm-level strategy carry no meaning
+* (validated away on the file path; discarded structurally here so
+* programmatic sources get the same semantics).
+*/ function extractWildcardRealmEntry(data) {
+	if (!data.realms || data.realms.length === 0) return;
+	const wildcards = data.realms.filter((entry) => entry.attributes.name === "*");
+	if (wildcards.length === 0) return;
+	data.realms = data.realms.filter((entry) => entry.attributes.name !== "*");
+	let folded = wildcards[0];
+	for (let i = 1; i < wildcards.length; i++) folded = mergeProvisioningEntity(folded, wildcards[i]);
+	return {
+		attributes: { name: "*" },
+		relations: folded.relations ?? {}
+	};
+}
+/**
+* Deep-merge the wildcard entry UNDER every explicit realm entry (explicit
+* wins per attribute, relation lists union, the explicit child's strategy
+* wins when it carries one) so the graph sync covers those realms in
+* one pass. Returns the merged relations per canonical realm name, kept
+* PRISTINE (cloned before the sync mutates anything) for the runtime
+* creation hook.
+*/ function expandWildcardRealmEntry(wildcard, data) {
+	const variants = /* @__PURE__ */ new Map();
+	if (data.realms) data.realms = data.realms.map((entry) => {
+		const merged = mergeProvisioningEntity(structuredClone(wildcard), entry, { inheritStrategy: false });
+		if (entry.attributes.name) variants.set(canonicalizeRealmName(entry.attributes.name), structuredClone(merged.relations ?? {}));
+		return merged;
+	});
+	return variants;
+}
+/**
+* Applies the wildcard entry's relations to ONE realm, by synthesizing a
+* realm provisioning entity and pushing it through the regular realm
+* synchronizer (scopes -> clients -> permissions -> roles -> users; the
+* realm row itself is resolved by name and, carrying no strategy, is
+* never modified). The entry is deep-cloned per application: the
+* synchronizer mutates its input (realmId stamping, `replace` writes the
+* resolved row id back), so a shared object would leak one realm's ids
+* into the next realm's sync.
+*/ var WildcardRealmProvisioner = class {
+	relations;
+	relationsByRealmName;
+	synchronizer;
+	logger;
+	constructor(ctx) {
+		this.relations = ctx.relations;
+		this.relationsByRealmName = ctx.relationsByRealmName;
+		this.synchronizer = ctx.synchronizer;
+		this.logger = ctx.logger;
+	}
+	/**
+	* True when the loaded config also declares this realm explicitly:
+	* the startup graph sync already covers it (expansion), so the boot
+	* backfill loop skips it.
+	*/ hasExplicitEntry(realm) {
+		if (!this.relationsByRealmName || !realm.name) return false;
+		return this.relationsByRealmName.has(canonicalizeRealmName(realm.name));
+	}
+	async ensureForRealm(realm) {
+		if (!realm.name) {
+			this.logger?.warn(`Skipping wildcard realm provisioning for realm ${realm.id}: the realm carries no name.`);
+			return;
+		}
+		const name = canonicalizeRealmName(realm.name);
+		const relations = this.relationsByRealmName?.get(name) ?? this.relations;
+		await this.synchronizer.synchronize(structuredClone({
+			attributes: { name },
+			relations
+		}));
+	}
+};
+//#endregion
+export { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardRealmEntry };
+
+//# sourceMappingURL=module.mjs.map