@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/core/provisioning/wildcard/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["REALM_WILDCARD_NAME","mergeProvisioningEntity","canonicalizeRealmName","name","trim","toLowerCase","extractWildcardRealmEntry","data","realms","length","undefined","wildcards","filter","entry","attributes","folded","i","relations","expandWildcardRealmEntry","wildcard","variants","Map","map","merged","structuredClone","inheritStrategy","set","WildcardRealmProvisioner","relationsByRealmName","synchronizer","logger","ctx","hasExplicitEntry","realm","has","ensureForRealm","warn","id","get","synchronize"],"sources":["../../../../src/core/provisioning/wildcard/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport { REALM_WILDCARD_NAME } from '../constants.ts';\nimport type { RealmProvisioningEntity, RealmProvisioningRelations } from '../entities/index.ts';\nimport { mergeProvisioningEntity } from '../merge/index.ts';\nimport type { IProvisioningSynchronizer, IRealmProvisioner } from '../types.ts';\nimport type { WildcardRealmProvisionerContext } from './types.ts';\n\nfunction canonicalizeRealmName(name: string): string {\n    return name.trim().toLowerCase();\n}\n\n/**\n * Split the wildcard entries (attributes.name === '*') out of\n * `data.realms`, folding multiples (several files, several entries) into\n * one via the composite merge rules. The folded entry is stripped to a\n * relations-only shape: a wildcard entry is a SELECTOR over realms, so\n * realm-level attributes and a realm-level strategy carry no meaning\n * (validated away on the file path; discarded structurally here so\n * programmatic sources get the same semantics).\n */\nexport function extractWildcardRealmEntry(\n    data: { realms?: RealmProvisioningEntity[] },\n): RealmProvisioningEntity | undefined {\n    if (!data.realms || data.realms.length === 0) {\n        return undefined;\n    }\n\n    const wildcards = data.realms.filter(\n        (entry) => entry.attributes.name === REALM_WILDCARD_NAME,\n    );\n    if (wildcards.length === 0) {\n        return undefined;\n    }\n\n    data.realms = data.realms.filter(\n        (entry) => entry.attributes.name !== REALM_WILDCARD_NAME,\n    );\n\n    let folded = wildcards[0];\n    for (let i = 1; i < wildcards.length; i++) {\n        folded = mergeProvisioningEntity(folded, wildcards[i]) as RealmProvisioningEntity;\n    }\n\n    return {\n        attributes: { name: REALM_WILDCARD_NAME },\n        relations: folded.relations ?? {},\n    };\n}\n\n/**\n * Deep-merge the wildcard entry UNDER every explicit realm entry (explicit\n * wins per attribute, relation lists union, the explicit child's strategy\n * wins when it carries one) so the graph sync covers those realms in\n * one pass. Returns the merged relations per canonical realm name, kept\n * PRISTINE (cloned before the sync mutates anything) for the runtime\n * creation hook.\n */\nexport function expandWildcardRealmEntry(\n    wildcard: RealmProvisioningEntity,\n    data: { realms?: RealmProvisioningEntity[] },\n): Map<string, RealmProvisioningRelations> {\n    const variants = new Map<string, RealmProvisioningRelations>();\n\n    if (data.realms) {\n        data.realms = data.realms.map((entry) => {\n            // inheritStrategy: false — the precedence here is inverted\n            // relative to the composite source. The wildcard is the low\n            // precedence side, so it must not supply the lifecycle of an\n            // entity the operator declared explicitly: a wildcard child\n            // carrying `absent` would otherwise delete the very row the\n            // explicit realm block declares. A child that declares no\n            // strategy falls back to the normal default instead.\n            const merged = mergeProvisioningEntity(\n                structuredClone(wildcard),\n                entry,\n                { inheritStrategy: false },\n            ) as RealmProvisioningEntity;\n\n            if (entry.attributes.name) {\n                variants.set(\n                    canonicalizeRealmName(entry.attributes.name),\n                    structuredClone(merged.relations ?? {}),\n                );\n            }\n\n            return merged;\n        });\n    }\n\n    return variants;\n}\n\n/**\n * Applies the wildcard entry's relations to ONE realm, by synthesizing a\n * realm provisioning entity and pushing it through the regular realm\n * synchronizer (scopes -> clients -> permissions -> roles -> users; the\n * realm row itself is resolved by name and, carrying no strategy, is\n * never modified). The entry is deep-cloned per application: the\n * synchronizer mutates its input (realmId stamping, `replace` writes the\n * resolved row id back), so a shared object would leak one realm's ids\n * into the next realm's sync.\n */\nexport class WildcardRealmProvisioner implements IRealmProvisioner {\n    protected relations: RealmProvisioningRelations;\n\n    protected relationsByRealmName?: Map<string, RealmProvisioningRelations>;\n\n    protected synchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;\n\n    protected logger?: Logger;\n\n    constructor(ctx: WildcardRealmProvisionerContext) {\n        this.relations = ctx.relations;\n        this.relationsByRealmName = ctx.relationsByRealmName;\n        this.synchronizer = ctx.synchronizer;\n        this.logger = ctx.logger;\n    }\n\n    /**\n     * True when the loaded config also declares this realm explicitly:\n     * the startup graph sync already covers it (expansion), so the boot\n     * backfill loop skips it.\n     */\n    hasExplicitEntry(realm: Realm): boolean {\n        if (!this.relationsByRealmName || !realm.name) {\n            return false;\n        }\n        return this.relationsByRealmName.has(canonicalizeRealmName(realm.name));\n    }\n\n    async ensureForRealm(realm: Realm): Promise<void> {\n        if (!realm.name) {\n            this.logger?.warn(\n                `Skipping wildcard realm provisioning for realm ${realm.id}: the realm carries no name.`,\n            );\n            return;\n        }\n\n        const name = canonicalizeRealmName(realm.name);\n        const relations = this.relationsByRealmName?.get(name) ?? this.relations;\n\n        await this.synchronizer.synchronize(structuredClone({\n            attributes: { name },\n            relations,\n        }));\n    }\n}\n"],"mappings":";;;;;;;AAeA,SAASE,sBAAsBC,MAAY;CACvC,OAAOA,KAAKC,KAAI,CAAA,CAAGC,YAAW;AAClC;;;;;;;;;GAWA,SAAgBC,0BACZC,MAA4C;CAE5C,IAAI,CAACA,KAAKC,UAAUD,KAAKC,OAAOC,WAAW,GACvC;CAGJ,MAAME,YAAYJ,KAAKC,OAAOI,QACzBC,UAAUA,MAAMC,WAAWX,SAAAA,GAASH;CAEzC,IAAIW,UAAUF,WAAW,GACrB;CAGJF,KAAKC,SAASD,KAAKC,OAAOI,QACrBC,UAAUA,MAAMC,WAAWX,SAAAA,GAASH;CAGzC,IAAIe,SAASJ,UAAU;CACvB,KAAK,IAAIK,IAAI,GAAGA,IAAIL,UAAUF,QAAQO,KAClCD,SAASd,wBAAwBc,QAAQJ,UAAUK,EAAE;CAGzD,OAAO;EACHF,YAAY,EAAEX,MAAAA,IAA0B;EACxCc,WAAWF,OAAOE,aAAa,CAAC;CACpC;AACJ;;;;;;;;GAUA,SAAgBC,yBACZC,UACAZ,MAA4C;CAE5C,MAAMa,2BAAW,IAAIC,IAAAA;CAErB,IAAId,KAAKC,QACLD,KAAKC,SAASD,KAAKC,OAAOc,KAAKT,UAAAA;EAQ3B,MAAMU,SAAStB,wBACXuB,gBAAgBL,QAAAA,GAChBN,OACA,EAAEY,iBAAiB,MAAM,CAAA;EAG7B,IAAIZ,MAAMC,WAAWX,MACjBiB,SAASM,IACLxB,sBAAsBW,MAAMC,WAAWX,IAAI,GAC3CqB,gBAAgBD,OAAON,aAAa,CAAC,CAAA,CAAA;EAI7C,OAAOM;CACX,CAAA;CAGJ,OAAOH;AACX;;;;;;;;;;GAYA,IAAaO,2BAAb,MAAaA;CACCV;CAEAW;CAEAC;CAEAC;CAEV,YAAYC,KAAsC;EAC9C,KAAKd,YAAYc,IAAId;EACrB,KAAKW,uBAAuBG,IAAIH;EAChC,KAAKC,eAAeE,IAAIF;EACxB,KAAKC,SAASC,IAAID;CACtB;;;;;IAOAE,iBAAiBC,OAAuB;EACpC,IAAI,CAAC,KAAKL,wBAAwB,CAACK,MAAM9B,MACrC,OAAO;EAEX,OAAO,KAAKyB,qBAAqBM,IAAIhC,sBAAsB+B,MAAM9B,IAAI,CAAA;CACzE;CAEA,MAAMgC,eAAeF,OAA6B;EAC9C,IAAI,CAACA,MAAM9B,MAAM;GACb,KAAK2B,QAAQM,KACT,kDAAkDH,MAAMI,GAAG,6BAA6B;GAE5F;EACJ;EAEA,MAAMlC,OAAOD,sBAAsB+B,MAAM9B,IAAI;EAC7C,MAAMc,YAAY,KAAKW,sBAAsBU,IAAInC,IAAAA,KAAS,KAAKc;EAE/D,MAAM,KAAKY,aAAaU,YAAYf,gBAAgB;GAChDV,YAAY,EAAEX,KAAK;GACnBc;EACJ,CAAA,CAAA;CACJ;AACJ"}

package/dist/core/provisioning/wildcard/types.d.ts

@@ -0,0 +1,19 @@
+import type { Logger } from '@authup/server-kit';
+import type { RealmProvisioningEntity, RealmProvisioningRelations } from '../entities/index.ts';
+import type { IProvisioningSynchronizer } from '../types.ts';
+export type WildcardRealmProvisionerContext = {
+    /**
+     * The folded wildcard entry's relations, applied to realms without an
+     * explicit realm block.
+     */
+    relations: RealmProvisioningRelations;
+    /**
+     * Merged relations (wildcard deep-merged UNDER the explicit block) per
+     * canonical realm name, for realms the loaded config declares
+     * explicitly. Applied when such a realm is (re-)created at runtime.
+     */
+    relationsByRealmName?: Map<string, RealmProvisioningRelations>;
+    synchronizer: IProvisioningSynchronizer<RealmProvisioningEntity>;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/provisioning/wildcard/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/provisioning/wildcard/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,MAAM,+BAA+B,GAAG;IAC1C;;;OAGG;IACH,SAAS,EAAE,0BAA0B,CAAC;IAEtC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAE/D,YAAY,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;IAEjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/core/provisioning/wildcard/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/query/index.mjs

@@ -3,5 +3,5 @@ import "node:url";
 import.meta.url;
 import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "./describe.mjs";
 import { createRelationsReadGate } from "./relations.mjs";
-import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry } from "./module.mjs";
-export { RECORD_QUERY_PARAMETERS, appendQueryConditions, createRelationsReadGate, decodeQuery, describeQuerySchema, queryCodec, schemaRegistry };
+import { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry, schemas } from "./module.mjs";
+export { RECORD_QUERY_PARAMETERS, appendQueryConditions, createRelationsReadGate, decodeQuery, describeQuerySchema, queryCodec, schemaRegistry, schemas };

package/dist/core/query/module.d.ts

@@ -1,4 +1,4 @@
-import type { ICondition, IQuery, ObjectLiteral } from '@rapiq/core';
+import type { ICondition, IQuery, ObjectLiteral, Schema } from '@rapiq/core';
 import { Query, SchemaRegistry } from '@rapiq/core';
 import type { DecodeQueryOptions } from './types.ts';
 /**
@@ -17,6 +17,12 @@ import type { DecodeQueryOptions } from './types.ts';
  * never auto-derived from entity metadata.
  */
 export declare const schemaRegistry: SchemaRegistry<any>;
+/**
+ * Every registered entity schema. Exported so the invariant guard can
+ * enumerate them: `SchemaRegistry` keeps its map protected and exposes
+ * no iterator (tada5hi/rapiq#904).
+ */
+export declare const schemas: Schema<any>[];
 /**
  * URL transport codec bound to the schema registry: decodes both the
  * v2 expression dialect (stamped or detected) and legacy v1 bracket
@@ -41,20 +47,24 @@ export declare const queryCodec: import("@rapiq/codec-url").URLCodec;
 export declare function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(input: unknown, options: DecodeQueryOptions<RECORD>): Promise<Query>;
 /**
  * Append server-derived conditions (a route realm, an owner scope, ...)
- * onto a decoded query by AND-wrapping its filter tree. The wrap makes
- * the appended scope non-displaceable: unlike a filters merge (per-field
- * replace, flat-root-AND restriction), a client-sent condition on the
- * same field intersects with the scope instead of replacing it, and
- * compound client trees (`or(...)`) are preserved as-is. Same guarantee
- * class as a mandatory `andWhere` at the repository — expressed once in
- * the IR. Appended conditions do not pass through `decodeQuery`, so the
- * schema allow-lists do not constrain them (server-derived context).
+ * onto a decoded query by AND-wrapping its filter tree. A client-sent
+ * condition on the same field intersects with the scope instead of
+ * replacing it, and compound client trees (`or(...)`) are preserved
+ * as-is. Same guarantee class as a mandatory `andWhere` at the
+ * repository — expressed once in the IR. Appended conditions do not
+ * pass through `decodeQuery`, so the schema allow-lists do not
+ * constrain them (server-derived context).
  *
  * Immutable: returns a new `Query` whose filters node is the
  * AND-wrapped successor (`IFilters.and`); every other parameter node is
  * carried over **by reference**, so the input query stays untouched and
  * nothing is copied. The node enumeration mirrors rapiq's
  * `QueryContext` — keep it in sync when the IR gains a parameter.
+ *
+ * Non-displaceability is structural since rapiq beta.19
+ * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so
+ * no later composition step can drop a conjunct and the appended scope
+ * needs no marker to survive.
  */
 export declare function appendQueryConditions(query: IQuery, ...conditions: ICondition[]): Query;
 //# sourceMappingURL=module.d.ts.map

package/dist/core/query/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/query/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,aAAa,EAEhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAY,MAAM,aAAa,CAAC;AAyB9D,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,qBAAuB,CAAC;AAiCnD;;;;GAIG;AACH,eAAO,MAAM,UAAU,qCAAiC,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,EAC1E,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,GACnC,OAAO,CAAC,KAAK,CAAC,CAYjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAI,KAAK,CAQxF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/core/query/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,UAAU,EACV,MAAM,EACN,aAAa,EACb,MAAM,EACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAY,MAAM,aAAa,CAAC;AA2B9D,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,qBAAuB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAG,MAAM,CAAC,GAAG,CAAC,EA2BjC,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,UAAU,qCAAiC,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,MAAM,SAAS,aAAa,GAAG,aAAa,EAC1E,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,GACnC,OAAO,CAAC,KAAK,CAAC,CAYjB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAI,KAAK,CAQxF"}

package/dist/core/query/module.mjs

@@ -8,6 +8,7 @@ import { clientScopeSchema } from "../entities/client-scope/schema.mjs";
 import { consentSchema } from "../entities/consent/schema.mjs";
 import { eventSchema } from "../entities/event/schema.mjs";
 import { identityProviderSchema } from "../entities/identity-provider/schema.mjs";
+import { identityProviderAccountSchema } from "../entities/identity-provider-account/schema.mjs";
 import { identityProviderRoleMappingSchema } from "../entities/identity-provider-role-mapping/schema.mjs";
 import { keySchema } from "../entities/key/schema.mjs";
 import { permissionSchema } from "../entities/permission/schema.mjs";
@@ -19,6 +20,7 @@ import { roleAttributeSchema } from "../entities/role-attribute/schema.mjs";
 import { rolePermissionSchema } from "../entities/role-permission/schema.mjs";
 import { scopeSchema } from "../entities/scope/schema.mjs";
 import { sessionSchema } from "../entities/session/schema.mjs";
+import { sessionTokenSchema } from "../entities/session-token/schema.mjs";
 import { trustAnchorSchema } from "../entities/trust-anchor/schema.mjs";
 import { userSchema } from "../entities/user/schema.mjs";
 import { userAttributeSchema } from "../entities/user-attribute/schema.mjs";
@@ -43,7 +45,11 @@ import { createURLCodec } from "@rapiq/codec-url";
 * precedence), but the allow-lists themselves stay explicit and are
 * never auto-derived from entity metadata.
 */ const schemaRegistry = new SchemaRegistry();
-const schemas = [
+/**
+* Every registered entity schema. Exported so the invariant guard can
+* enumerate them: `SchemaRegistry` keeps its map protected and exposes
+* no iterator (tada5hi/rapiq#904).
+*/ const schemas = [
 	clientSchema,
 	clientPermissionSchema,
 	clientRoleSchema,
@@ -51,6 +57,7 @@ const schemas = [
 	consentSchema,
 	eventSchema,
 	identityProviderSchema,
+	identityProviderAccountSchema,
 	identityProviderRoleMappingSchema,
 	keySchema,
 	permissionSchema,
@@ -62,6 +69,7 @@ const schemas = [
 	rolePermissionSchema,
 	scopeSchema,
 	sessionSchema,
+	sessionTokenSchema,
 	trustAnchorSchema,
 	userSchema,
 	userAttributeSchema,
@@ -99,20 +107,24 @@ for (const schema of schemas) schemaRegistry.add(schema);
 }
 /**
 * Append server-derived conditions (a route realm, an owner scope, ...)
-* onto a decoded query by AND-wrapping its filter tree. The wrap makes
-* the appended scope non-displaceable: unlike a filters merge (per-field
-* replace, flat-root-AND restriction), a client-sent condition on the
-* same field intersects with the scope instead of replacing it, and
-* compound client trees (`or(...)`) are preserved as-is. Same guarantee
-* class as a mandatory `andWhere` at the repository — expressed once in
-* the IR. Appended conditions do not pass through `decodeQuery`, so the
-* schema allow-lists do not constrain them (server-derived context).
+* onto a decoded query by AND-wrapping its filter tree. A client-sent
+* condition on the same field intersects with the scope instead of
+* replacing it, and compound client trees (`or(...)`) are preserved
+* as-is. Same guarantee class as a mandatory `andWhere` at the
+* repository — expressed once in the IR. Appended conditions do not
+* pass through `decodeQuery`, so the schema allow-lists do not
+* constrain them (server-derived context).
 *
 * Immutable: returns a new `Query` whose filters node is the
 * AND-wrapped successor (`IFilters.and`); every other parameter node is
 * carried over **by reference**, so the input query stays untouched and
 * nothing is copied. The node enumeration mirrors rapiq's
 * `QueryContext` — keep it in sync when the IR gains a parameter.
+*
+* Non-displaceability is structural since rapiq beta.19
+* (tada5hi/rapiq#890): filter composition is conjunctive throughout, so
+* no later composition step can drop a conjunct and the appended scope
+* needs no marker to survive.
 */ function appendQueryConditions(query, ...conditions) {
 	return new Query({
 		fields: query.fields,
@@ -123,6 +135,6 @@ for (const schema of schemas) schemaRegistry.add(schema);
 	});
 }
 //#endregion
-export { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry };
+export { appendQueryConditions, decodeQuery, queryCodec, schemaRegistry, schemas };
 
 //# sourceMappingURL=module.mjs.map

package/dist/core/query/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition, \n    IQuery, \n    ObjectLiteral, \n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\nconst schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. The wrap makes\n * the appended scope non-displaceable: unlike a filters merge (per-field\n * replace, flat-root-AND restriction), a client-sent condition on the\n * same field intersects with the scope instead of replacing it, and\n * compound client trees (`or(...)`) are preserved as-is. Same guarantee\n * class as a mandatory `andWhere` at the repository — expressed once in\n * the IR. Appended conditions do not pass through `decodeQuery`, so the\n * schema allow-lists do not constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDA,MAAa4B,iBAAiB,IAAI1B,eAAAA;AAElC,MAAM2B,UAA0B;CAC5BzB;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAahC,eAAe4B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAajC,SAAS+B,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAIxC,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;GAmBA,SAAgByC,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI3C,MAAM;EACb4C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}
+{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderAccountSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","sessionTokenSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition,\n    IQuery,\n    ObjectLiteral,\n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderAccountSchema } from '../entities/identity-provider-account/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { sessionTokenSchema } from '../entities/session-token/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\n/**\n * Every registered entity schema. Exported so the invariant guard can\n * enumerate them: `SchemaRegistry` keeps its map protected and exposes\n * no iterator (tada5hi/rapiq#904).\n */\nexport const schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderAccountSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    sessionTokenSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. A client-sent\n * condition on the same field intersects with the scope instead of\n * replacing it, and compound client trees (`or(...)`) are preserved\n * as-is. Same guarantee class as a mandatory `andWhere` at the\n * repository — expressed once in the IR. Appended conditions do not\n * pass through `decodeQuery`, so the schema allow-lists do not\n * constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n *\n * Non-displaceability is structural since rapiq beta.19\n * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so\n * no later composition step can drop a conjunct and the appended scope\n * needs no marker to survive.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,MAAa8B,iBAAiB,IAAI5B,eAAAA;;;;;GAOlC,MAAa6B,UAA0B;CACnC3B;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAalC,eAAe8B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAanC,SAASiC,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAI1C,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;;;;;GAuBA,SAAgB2C,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI7C,MAAM;EACb8C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}

package/dist/index.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { AuthenticationInjectionKey } from "./app/modules/authentication/constants.mjs";
 import { dateToISOStringTransformer } from "./adapters/database/helpers/date.mjs";
-import { isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment } from "./adapters/database/helpers/is-supported.mjs";
+import { isDatabaseTypeRowLockable, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment } from "./adapters/database/helpers/is-supported.mjs";
 import { RealmEntity } from "./adapters/database/domains/realm/entity.mjs";
 import { RealmRepository } from "./adapters/database/domains/realm/repository.mjs";
 import { EntitySubscriber, buildEntityDestinations } from "./adapters/database/subscriber/module.mjs";
@@ -94,7 +94,7 @@ import { AuthenticationModule } from "./app/modules/authentication/module.mjs";
 import { DatabaseQueryResultCache } from "./adapters/database/cache/module.mjs";
 import { DataSourceOptionsBuilder } from "./adapters/database/data-source/options/module.mjs";
 import { DatabaseConflictError } from "./adapters/database/errors/conflict.mjs";
-import { getDatabaseDriverErrorCode, isUniqueConstraintDatabaseError } from "./adapters/database/errors/driver.mjs";
+import { getDatabaseDriverErrorCode, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError } from "./adapters/database/errors/driver.mjs";
 import "./adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "./app/modules/database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "./app/modules/database/repositories/client/repository.mjs";
@@ -103,6 +103,7 @@ import { ClientRoleRepositoryAdapter } from "./app/modules/database/repositories
 import { ClientScopeRepositoryAdapter } from "./app/modules/database/repositories/client-scope/repository.mjs";
 import { EventRepositoryAdapter } from "./app/modules/database/repositories/event/repository.mjs";
 import { IdentityProviderRepositoryAdapter } from "./app/modules/database/repositories/identity-provider/repository.mjs";
+import { IdentityProviderAccountRepositoryAdapter } from "./app/modules/database/repositories/identity-provider-account/repository.mjs";
 import { KeyRepositoryAdapter } from "./app/modules/database/repositories/key/repository.mjs";
 import { PermissionRepositoryAdapter } from "./app/modules/database/repositories/permission/repository.mjs";
 import { PermissionPolicyRepositoryAdapter } from "./app/modules/database/repositories/permission-policy/repository.mjs";
@@ -131,6 +132,7 @@ import { ForceLoggedInMiddleware } from "./adapters/http/middleware/built-in/log
 import { ForceUserLoggedInMiddleware } from "./adapters/http/middleware/built-in/loggedin/user.mjs";
 import { RealmResolverMiddleware } from "./adapters/http/middleware/built-in/realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./adapters/http/middleware/built-in/realm-resolver/factory.mjs";
+import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./adapters/http/middleware/built-in/theme.mjs";
 import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./adapters/http/middleware/built-in/assets.mjs";
 import { registerBasicMiddleware } from "./adapters/http/middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./adapters/http/middleware/built-in/cors.mjs";
@@ -162,10 +164,12 @@ import { ClientScopeRequestValidator } from "./adapters/http/controllers/entitie
 import { ConsentController } from "./adapters/http/controllers/entities/consent/module.mjs";
 import { EventController } from "./adapters/http/controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "./adapters/http/controllers/entities/identity-provider/module.mjs";
+import { IdentityProviderAccountController } from "./adapters/http/controllers/entities/identity-provider-account/module.mjs";
 import { IdentityProviderRoleMappingController } from "./adapters/http/controllers/entities/identity-provide-role/module.mjs";
 import { KeyController } from "./adapters/http/controllers/entities/key/module.mjs";
 import { PermissionController } from "./adapters/http/controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./adapters/http/controllers/entities/permission-policy/module.mjs";
+import { AccountController } from "./adapters/http/controllers/workflows/account/module.mjs";
 import { ActivateController } from "./adapters/http/controllers/workflows/activate/module.mjs";
 import { AuthenticatorChallengeController } from "./adapters/http/controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./adapters/http/controllers/workflows/authorize/module.mjs";
@@ -190,6 +194,7 @@ import { PolicyAttributesValidator } from "./adapters/http/controllers/entities/
 import { PolicyValidator } from "./adapters/http/controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./adapters/http/controllers/entities/scope/module.mjs";
 import { SessionController } from "./adapters/http/controllers/entities/session/module.mjs";
+import { SessionTokenController } from "./adapters/http/controllers/entities/session-token/module.mjs";
 import { TrustAnchorController } from "./adapters/http/controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "./adapters/http/controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./adapters/http/controllers/entities/user-attribute/module.mjs";
@@ -202,7 +207,6 @@ import { UserRoleRequestValidator } from "./adapters/http/controllers/entities/u
 import "./adapters/http/index.mjs";
 import { OAuth2InjectionToken } from "./app/modules/oauth2/constants.mjs";
 import { IdentityInjectionKey } from "./app/modules/identity/constants.mjs";
-import { IdentityProviderAccountRepository } from "./app/modules/identity/repositories/provider/account/module.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./app/modules/identity/repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./app/modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./app/modules/identity/repositories/provider/mapper/role.mjs";
@@ -212,6 +216,8 @@ import { LDAPInjectionKey } from "./app/modules/ldap/constants.mjs";
 import { LdapModule } from "./app/modules/ldap/module.mjs";
 import { IdentityModule } from "./app/modules/identity/module.mjs";
 import { OAuth2Module } from "./app/modules/oauth2/module.mjs";
+import { ProvisioningInjectionKey } from "./app/modules/provisioning/constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./app/modules/provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./app/modules/mail/constants.mjs";
 import { MailModule } from "./app/modules/mail/module.mjs";
 import { HTTPModule } from "./app/modules/http/module.mjs";
@@ -228,4 +234,4 @@ import { defineCLIMigrationCommand } from "./cli/commands/migration.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountEntity, IdentityProviderAccountRepository, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenEntity, StatusController, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { AccountController, ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountController, IdentityProviderAccountEntity, IdentityProviderAccountRepositoryAdapter, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenController, SessionTokenEntity, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeRowLockable, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };

package/dist/path.d.ts

@@ -2,6 +2,4 @@ export declare const CODE_PATH: string;
 export declare const PACKAGE_PATH: string;
 export declare const SRC_PATH: string;
 export declare const DIST_PATH: string;
-export declare const UI_DIST_PATH: string;
-export declare const UI_SOURCE_PATH: string;
 //# sourceMappingURL=path.d.ts.map

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,QAA+C,CAAC;AACtE,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,QAAQ,QAAiC,CAAC;AACvD,eAAO,MAAM,SAAS,QAAkC,CAAC;AAEzD,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,cAAc,QAAgC,CAAC"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,QAA+C,CAAC;AACtE,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,QAAQ,QAAiC,CAAC;AACvD,eAAO,MAAM,SAAS,QAAkC,CAAC"}

package/dist/path.mjs

@@ -8,9 +8,7 @@ const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_PATH = path.join(CODE_PATH, "..");
 const SRC_PATH = path.join(PACKAGE_PATH, "src");
 const DIST_PATH = path.join(PACKAGE_PATH, "dist");
-const UI_DIST_PATH = path.join(DIST_PATH, "ui");
-const UI_SOURCE_PATH = path.join(PACKAGE_PATH, "ui");
 //#endregion
-export { CODE_PATH, DIST_PATH, PACKAGE_PATH, SRC_PATH, UI_DIST_PATH, UI_SOURCE_PATH };
+export { CODE_PATH, DIST_PATH, PACKAGE_PATH, SRC_PATH };
 
 //# sourceMappingURL=path.mjs.map

package/dist/path.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"path.mjs","names":["path","fileURLToPath","CODE_PATH","dirname","url","PACKAGE_PATH","join","SRC_PATH","DIST_PATH","UI_DIST_PATH","UI_SOURCE_PATH"],"sources":["../src/path.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\nexport const SRC_PATH = path.join(PACKAGE_PATH, 'src');\nexport const DIST_PATH = path.join(PACKAGE_PATH, 'dist');\n\nexport const UI_DIST_PATH = path.join(DIST_PATH, 'ui');\nexport const UI_SOURCE_PATH = path.join(PACKAGE_PATH, 'ui');\n"],"mappings":";;;;;;AAUA,MAAaE,YAAYF,KAAKG,QAAQF,cAAc,YAAYG,GAAG,CAAA;AACnE,MAAaC,eAAeL,KAAKM,KAAKJ,WAAW,IAAA;AACjD,MAAaK,WAAWP,KAAKM,KAAKD,cAAc,KAAA;AAChD,MAAaG,YAAYR,KAAKM,KAAKD,cAAc,MAAA;AAEjD,MAAaI,eAAeT,KAAKM,KAAKE,WAAW,IAAA;AACjD,MAAaE,iBAAiBV,KAAKM,KAAKD,cAAc,IAAA"}
+{"version":3,"file":"path.mjs","names":["path","fileURLToPath","CODE_PATH","dirname","url","PACKAGE_PATH","join","SRC_PATH","DIST_PATH"],"sources":["../src/path.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\nexport const SRC_PATH = path.join(PACKAGE_PATH, 'src');\nexport const DIST_PATH = path.join(PACKAGE_PATH, 'dist');\n"],"mappings":";;;;;;AAUA,MAAaE,YAAYF,KAAKG,QAAQF,cAAc,YAAYG,GAAG,CAAA;AACnE,MAAaC,eAAeL,KAAKM,KAAKJ,WAAW,IAAA;AACjD,MAAaK,WAAWP,KAAKM,KAAKD,cAAc,KAAA;AAChD,MAAaG,YAAYR,KAAKM,KAAKD,cAAc,MAAA"}