@authup/server-core 1.0.0-beta.59 → 1.0.0-beta.61

package/dist/core/entities/client/schema.mjs

@@ -47,6 +47,16 @@ const schemaMapping = {
 }
 const clientSchema = defineSchema({
 	name: EntityType.CLIENT,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["displayName"],
+		["realmId"],
+		["active"],
+		["builtIn"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: {
 		default: [
 			"id",
@@ -73,20 +83,29 @@ const clientSchema = defineSchema({
 		allowed: ["secret"],
 		validateMany: createFieldsReadGate({ secret: secretReadGate })
 	},
-	filters: { allowed: [
-		"id",
-		"name",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"name",
+			"displayName",
+			"realmId",
+			"active",
+			"builtIn"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm", "accessPolicy"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/client/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","fields","default","allowed","validateMany","secret","filters","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n    and,\n    defineSchema,\n    eq,\n    ne,\n    or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/**\n * Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n *\n * Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n *\n * The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n    const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n    if (compiled.verdict === 'allow') {\n        return true;\n    }\n\n    const visible : ICondition[] = [\n        eq('secret', null),\n        eq('secretHashed', true),\n        eq('secretEncrypted', true),\n    ];\n\n    if (compiled.verdict === 'conditional') {\n        visible.push(compiled.condition);\n    }\n\n    if (\n        actor.identity &&\n        actor.identity.type === IdentityType.CLIENT &&\n        actor.identity.data.id\n    ) {\n        visible.push(eq('id', actor.identity.data.id));\n    }\n\n    return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'rootUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'grantTypes',\n            'scope',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n        validateMany: createFieldsReadGate({ secret: secretReadGate }),\n    },\n    filters: { allowed: ['id', 'name', 'realmId'] },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc3B,qBAAqB,EAAE4B,QAAQpB,eAAe,CAAA;CAChE;CACAqB,SAAS,EAAEH,SAAS;EAAC;EAAM;EAAQ;CAAU,EAAC;CAC9CI,WAAW;EAAEJ,SAAS,CAAC,SAAS,cAAe;EAAEK,UAAU9B,wBAAwBE,aAAAA;CAAe;CAClG6B,MAAM,EAAEN,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDO,YAAY,EAAEC,UAAU,GAAG;CAC3B/B;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","indexes","fields","default","allowed","validateMany","secret","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n    and,\n    defineSchema,\n    eq,\n    ne,\n    or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/**\n * Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n *\n * Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n *\n * The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n    const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n    if (compiled.verdict === 'allow') {\n        return true;\n    }\n\n    const visible : ICondition[] = [\n        eq('secret', null),\n        eq('secretHashed', true),\n        eq('secretEncrypted', true),\n    ];\n\n    if (compiled.verdict === 'conditional') {\n        visible.push(compiled.condition);\n    }\n\n    if (\n        actor.identity &&\n        actor.identity.type === IdentityType.CLIENT &&\n        actor.identity.data.id\n    ) {\n        visible.push(eq('id', actor.identity.data.id));\n    }\n\n    return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['realmId'],\n        ['active'],\n        ['builtIn'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'rootUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'grantTypes',\n            'scope',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n        validateMany: createFieldsReadGate({ secret: secretReadGate }),\n    },\n    filters: { allowed: ['id', 'name', 'displayName', 'realmId', 'active', 'builtIn'], indexed: true },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc5B,qBAAqB,EAAE6B,QAAQrB,eAAe,CAAA;CAChE;CACAsB,SAAS;EAAEH,SAAS;GAAC;GAAM;GAAQ;GAAe;GAAW;GAAU;EAAU;EAAEI,SAAS;CAAK;CACjGC,WAAW;EAAEL,SAAS,CAAC,SAAS,cAAe;EAAEM,UAAUhC,wBAAwBE,aAAAA;CAAe;CAClG+B,OAAO;EAAEP,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEI,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BjC;AACJ,CAAA"}

package/dist/core/entities/client-permission/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDAqBjC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-permission/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDA+BjC,CAAC"}

package/dist/core/entities/client-permission/schema.mjs

@@ -11,6 +11,16 @@ const schemaMapping = {
 };
 const clientPermissionSchema = defineSchema({
 	name: EntityType.CLIENT_PERMISSION,
+	indexes: [
+		["id"],
+		["clientId", "permissionId"],
+		["permissionId"],
+		["clientRealmId"],
+		["permissionRealmId"],
+		["policyId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"policyId",
@@ -22,16 +32,29 @@ const clientPermissionSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: ["clientId", "permissionId"] },
+	filters: {
+		allowed: [
+			"clientId",
+			"permissionId",
+			"id",
+			"clientRealmId",
+			"permissionRealmId",
+			"policyId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["client", "permission"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/client-permission/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","permission","PERMISSION","clientPermissionSchema","name","CLIENT_PERMISSION","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientPermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, permission: EntityType.PERMISSION };\n\nexport const clientPermissionSchema = defineSchema<ClientPermission>({\n    name: EntityType.CLIENT_PERMISSION,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'clientId',\n            'clientRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'permissionId'] },\n    relations: { allowed: ['client', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,YAAYL,WAAWM;AAAW;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,cAAe,EAAC;CACjDC,WAAW;EAAED,SAAS,CAAC,UAAU,YAAa;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CACjGc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","permission","PERMISSION","clientPermissionSchema","name","CLIENT_PERMISSION","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-permission/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientPermission } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, permission: EntityType.PERMISSION };\n\nexport const clientPermissionSchema = defineSchema<ClientPermission>({\n    name: EntityType.CLIENT_PERMISSION,\n    indexes: [\n        ['id'],\n        ['clientId', 'permissionId'],\n        ['permissionId'],\n        ['clientRealmId'],\n        ['permissionRealmId'],\n        ['policyId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'policyId',\n            'realmScope',\n            'permissionId',\n            'permissionRealmId',\n            'clientId',\n            'clientRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'permissionId', 'id', 'clientRealmId', 'permissionRealmId', 'policyId'], indexed: true },\n    relations: { allowed: ['client', 'permission'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,YAAYL,WAAWM;AAAW;AAErF,MAAaC,yBAAyBR,aAA+B;CACjES,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,YAAY,cAAe;EAC5B,CAAC,cAAe;EAChB,CAAC,eAAgB;EACjB,CAAC,mBAAoB;EACrB,CAAC,UAAW;EACZ,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAgB;GAAM;GAAiB;GAAqB;EAAW;EAAEC,SAAS;CAAK;CACxHC,WAAW;EAAEF,SAAS,CAAC,UAAU,YAAa;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CACjGgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/client-role/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,eAAO,MAAM,gBAAgB,+CAmB3B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-role/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,eAAO,MAAM,gBAAgB,+CA4B3B,CAAC"}

package/dist/core/entities/client-role/schema.mjs

@@ -11,6 +11,15 @@ const schemaMapping = {
 };
 const clientRoleSchema = defineSchema({
 	name: EntityType.CLIENT_ROLE,
+	indexes: [
+		["id"],
+		["roleId", "clientId"],
+		["clientId"],
+		["clientRealmId"],
+		["roleRealmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"clientId",
@@ -20,16 +29,28 @@ const clientRoleSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: ["clientId", "roleId"] },
+	filters: {
+		allowed: [
+			"clientId",
+			"roleId",
+			"id",
+			"clientRealmId",
+			"roleRealmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["client", "role"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/client-role/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","role","ROLE","clientRoleSchema","name","CLIENT_ROLE","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, role: EntityType.ROLE };\n\nexport const clientRoleSchema = defineSchema<ClientRole>({\n    name: EntityType.CLIENT_ROLE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'clientId',\n            'clientRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'roleId'] },\n    relations: { allowed: ['client', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,MAAML,WAAWM;AAAK;AAEzE,MAAaC,mBAAmBR,aAAyB;CACrDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAC,YAAY,QAAS,EAAC;CAC3CC,WAAW;EAAED,SAAS,CAAC,UAAU,MAAO;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC3Fc,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","role","ROLE","clientRoleSchema","name","CLIENT_ROLE","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-role/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientRole } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, role: EntityType.ROLE };\n\nexport const clientRoleSchema = defineSchema<ClientRole>({\n    name: EntityType.CLIENT_ROLE,\n    indexes: [\n        ['id'],\n        ['roleId', 'clientId'],\n        ['clientId'],\n        ['clientRealmId'],\n        ['roleRealmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'clientId',\n            'clientRealmId',\n            'roleId',\n            'roleRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'roleId', 'id', 'clientRealmId', 'roleRealmId'], indexed: true },\n    relations: { allowed: ['client', 'role'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,MAAML,WAAWM;AAAK;AAEzE,MAAaC,mBAAmBR,aAAyB;CACrDS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,UAAU,UAAW;EACtB,CAAC,UAAW;EACZ,CAAC,eAAgB;EACjB,CAAC,aAAc;EACf,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAU;GAAM;GAAiB;EAAc;EAAEC,SAAS;CAAK;CAChGC,WAAW;EAAEF,SAAS,CAAC,UAAU,MAAO;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC3FgB,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BlB;AACJ,CAAA"}

package/dist/core/entities/client-scope/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDAmB5B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client-scope/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,eAAO,MAAM,iBAAiB,gDA2B5B,CAAC"}

package/dist/core/entities/client-scope/schema.mjs

@@ -11,6 +11,14 @@ const schemaMapping = {
 };
 const clientScopeSchema = defineSchema({
 	name: EntityType.CLIENT_SCOPE,
+	indexes: [
+		["id"],
+		["clientId", "scopeId"],
+		["scopeId"],
+		["default"],
+		["clientRealmId"],
+		["scopeRealmId"]
+	],
 	fields: { default: [
 		"id",
 		"default",
@@ -21,11 +29,17 @@ const clientScopeSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"clientId",
-		"scopeId",
-		"default"
-	] },
+	filters: {
+		allowed: [
+			"clientId",
+			"scopeId",
+			"default",
+			"id",
+			"clientRealmId",
+			"scopeRealmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["client", "scope"],
 		validate: createRelationsReadGate(schemaMapping)

package/dist/core/entities/client-scope/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default'] },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;CAAU,EAAC;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","indexes","fields","default","filters","allowed","indexed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    indexes: [\n        ['id'],\n        ['clientId', 'scopeId'],\n        ['scopeId'],\n        ['default'],\n        ['clientRealmId'],\n        ['scopeRealmId'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default', 'id', 'clientRealmId', 'scopeRealmId'], indexed: true },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,YAAY,SAAU;EACvB,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,eAAgB;EACjB,CAAC,cAAe;CACnB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAW;GAAW;GAAM;GAAiB;EAAe;EAAEC,SAAS;CAAK;CAC7GC,WAAW;EAAEF,SAAS,CAAC,UAAU,OAAQ;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC5FgB,YAAY,EAAEC,UAAU,GAAG;CAC3BjB;AACJ,CAAA"}

package/dist/core/entities/consent/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CA2BxB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CAsCxB,CAAC"}

package/dist/core/entities/consent/schema.mjs

@@ -9,6 +9,22 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const consentSchema = defineSchema({
 	name: EntityType.CONSENT,
+	indexes: [
+		["id"],
+		[
+			"clientId",
+			"sub",
+			"subKind",
+			"scope"
+		],
+		["sub"],
+		["subKind"],
+		["scope"],
+		["realmId"],
+		["userId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"clientId",
@@ -21,16 +37,22 @@ const consentSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [...CONSENT_FILTER_KEYS] },
+	filters: {
+		allowed: [...CONSENT_FILTER_KEYS, "userId"],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"createdAt",
-		"updatedAt",
-		"scope"
-	] },
+	sorts: {
+		allowed: [
+			"createdAt",
+			"updatedAt",
+			"scope"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/consent/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n    name: EntityType.CONSENT,\n    fields: {\n        // `default` (not just `allowed`) so the adapter adds an explicit\n        // per-column SELECT: it populates expressionMap.selects, which\n        // applyRealmScopeSelect dedupes against. Without it the default\n        // \"select all\" is implicit (empty selects) and the force-select\n        // re-adds consent.sub — a duplicate `consent_sub` alias that\n        // mysql rejects under the client join (see helpers.ts).\n        default: [\n            'id',\n            'clientId',\n            'realmId',\n            'userId',\n            'sub',\n            'subKind',\n            'scope',\n            'expiresAt',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: [...CONSENT_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'scope'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAIX,GAAAA,mBAAoB,EAAC;CAC7CY,WAAW;EAAED,SAAS,CAAC,OAAQ;EAAEE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAa;EAAa;CAAQ,EAAC;CACrDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n    name: EntityType.CONSENT,\n    indexes: [\n        ['id'],\n        ['clientId', 'sub', 'subKind', 'scope'],\n        ['sub'],\n        ['subKind'],\n        ['scope'],\n        ['realmId'],\n        ['userId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        // `default` (not just `allowed`) so the adapter adds an explicit\n        // per-column SELECT: it populates expressionMap.selects, which\n        // applyRealmScopeSelect dedupes against. Without it the default\n        // \"select all\" is implicit (empty selects) and the force-select\n        // re-adds consent.sub — a duplicate `consent_sub` alias that\n        // mysql rejects under the client join (see helpers.ts).\n        default: [\n            'id',\n            'clientId',\n            'realmId',\n            'userId',\n            'sub',\n            'subKind',\n            'scope',\n            'expiresAt',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: [...CONSENT_FILTER_KEYS, 'userId'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['createdAt', 'updatedAt', 'scope'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,SAAS;EACL,CAAC,IAAK;EACN;GAAC;GAAY;GAAO;GAAW;EAAQ;EACvC,CAAC,KAAM;EACP,CAAC,SAAU;EACX,CAAC,OAAQ;EACT,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS,CAAIZ,GAAAA,qBAAqB,QAAS;EAAEa,SAAS;CAAK;CACtEC,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CAClFc,OAAO;EAAEJ,SAAS;GAAC;GAAa;GAAa;EAAQ;EAAEC,SAAS;CAAK;CACrEI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/event/entity-event-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAwCF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqD9D"}
+{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA4CF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAsD9D"}

package/dist/core/entities/event/entity-event-handler.mjs

@@ -16,6 +16,7 @@ const ENTITY_REALM_KEY_MAP = {
 	[EntityType.CLIENT_ROLE]: "clientRealmId",
 	[EntityType.CLIENT_SCOPE]: "clientRealmId",
 	[EntityType.CONSENT]: "realmId",
+	[EntityType.SESSION_TOKEN]: "sessionId",
 	[EntityType.EVENT]: "realmId",
 	[EntityType.IDENTITY_PROVIDER]: "realmId",
 	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: "userRealmId",
@@ -76,6 +77,7 @@ const ENTITY_REALM_KEY_MAP = {
 				actorType: requestContext?.actorType ?? null,
 				actorId: requestContext?.actorId ?? null,
 				actorName: requestContext?.actorName ?? null,
+				sessionId: requestContext?.sessionId ?? null,
 				requestPath: requestContext?.requestPath ?? null,
 				requestMethod: requestContext?.requestMethod ?? null,
 				requestIpAddress: requestContext?.requestIpAddress ?? null,

package/dist/core/entities/event/entity-event-handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EACrBf,WAAWgB,QAAQ;EACnBhB,WAAWiB,oBAAoB;EAC/BjB,WAAWkB,4BAA4B;EACvClB,WAAWmB,8BAA8B;EACzCnB,WAAWoB,sCAAsC;EACjDpB,WAAWqB,uCAAuC;EAClDrB,WAAWsB,iCAAiC;EAC5CtB,WAAWuB,MAAM;EACjBvB,WAAWwB,SAAS;EACpBxB,WAAWyB,mBAAmB;EAC9BzB,WAAW0B,aAAa;EACxB1B,WAAW2B,oBAAoB;EAC/B3B,WAAW4B,QAAQ;EACnB5B,WAAW6B,OAAO;EAClB7B,WAAW8B,iBAAiB;EAC5B9B,WAAW+B,kBAAkB;EAC7B/B,WAAWgC,QAAQ;EACnBhC,WAAWiC,UAAU;EACrBjC,WAAWkC,eAAe;EAC1BlC,WAAWmC,OAAO;EAClBnC,WAAWoC,iBAAiB;EAC5BpC,WAAWqC,qBAAqB;EAChCrC,WAAWsC,kBAAkB;EAC7BtC,WAAWuC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO1C,sBAAsBsC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAAS/C,UAAUO,WAAWJ,SAASwC,IAAIE,QAAQK,IAAI,KAAK/C,SAASwC,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOrD,gBAAgBuC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO7D,WAAW8D;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,aAAa3B,gBAAgB2B,eAAe;IAC5CC,eAAe5B,gBAAgB4B,iBAAiB;IAChDC,kBAAkB7B,gBAAgB6B,oBAAoB;IACtDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDrB;IACAsB,eAAe,KAAK9B,QAAQ8B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASnB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAC/C,SAAS+C,IAAAA,GACV;CAGJ,MAAMuB,MAAMhE,qBAAqBqC,SAA4B;CAC7D,IAAI,CAAC5C,eAAegD,MAAMuB,GAAAA,GACtB;CAGJ,OAAO,OAAOvB,KAAKuB,SAAS,WAAWvB,KAAKuB,OAAO;AACvD"}
+{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","SESSION_TOKEN","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    // Unreachable in practice: auth_session_tokens has no entity subscriber,\n    // so no domain event is ever published for it. Present for exhaustiveness,\n    // and the key is the one it would resolve through if that changed.\n    [EntityType.SESSION_TOKEN]: 'sessionId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                sessionId: requestContext?.sessionId ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EAIrBf,WAAWgB,gBAAgB;EAC3BhB,WAAWiB,QAAQ;EACnBjB,WAAWkB,oBAAoB;EAC/BlB,WAAWmB,4BAA4B;EACvCnB,WAAWoB,8BAA8B;EACzCpB,WAAWqB,sCAAsC;EACjDrB,WAAWsB,uCAAuC;EAClDtB,WAAWuB,iCAAiC;EAC5CvB,WAAWwB,MAAM;EACjBxB,WAAWyB,SAAS;EACpBzB,WAAW0B,mBAAmB;EAC9B1B,WAAW2B,aAAa;EACxB3B,WAAW4B,oBAAoB;EAC/B5B,WAAW6B,QAAQ;EACnB7B,WAAW8B,OAAO;EAClB9B,WAAW+B,iBAAiB;EAC5B/B,WAAWgC,kBAAkB;EAC7BhC,WAAWiC,QAAQ;EACnBjC,WAAWkC,UAAU;EACrBlC,WAAWmC,eAAe;EAC1BnC,WAAWoC,OAAO;EAClBpC,WAAWqC,iBAAiB;EAC5BrC,WAAWsC,qBAAqB;EAChCtC,WAAWuC,kBAAkB;EAC7BvC,WAAWwC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO3C,sBAAsBuC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAAShD,UAAUO,WAAWJ,SAASyC,IAAIE,QAAQK,IAAI,KAAKhD,SAASyC,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOtD,gBAAgBwC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO9D,WAAW+D;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,WAAW3B,gBAAgB2B,aAAa;IACxCC,aAAa5B,gBAAgB4B,eAAe;IAC5CC,eAAe7B,gBAAgB6B,iBAAiB;IAChDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDC,kBAAkB/B,gBAAgB+B,oBAAoB;IACtDtB;IACAuB,eAAe,KAAK/B,QAAQ+B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASpB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAChD,SAASgD,IAAAA,GACV;CAGJ,MAAMwB,MAAMlE,qBAAqBsC,SAA4B;CAC7D,IAAI,CAAC7C,eAAeiD,MAAMwB,GAAAA,GACtB;CAGJ,OAAO,OAAOxB,KAAKwB,SAAS,WAAWxB,KAAKwB,OAAO;AACvD"}

package/dist/core/entities/event/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/sanitize.ts"],"names":[],"mappings":"AAqGA,wBAAgB,iBAAiB,CAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA6B5B"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/sanitize.ts"],"names":[],"mappings":"AAwGA,wBAAgB,iBAAiB,CAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA6B5B"}

package/dist/core/entities/event/sanitize.mjs

@@ -11,10 +11,13 @@ import { isObject } from "@authup/kit";
 * objects and arrays are dropped outright, so a nested structure can never
 * smuggle a secret past the boundary (this subsumes a denylist: password,
 * client_secret, code, code_verifier, *token* etc. are simply never listed).
-* sessionId / jti / revokedSessionId are opaque correlation ids, not PII.
+* jti is an opaque correlation id, not PII (a session id is not listed here:
+* it rides the dedicated `sessionId` column, never the data bag).
 * name / use / status / enabled / force describe key & trust-anchor lifecycle
 * operations (issue #3269) — canonical identifiers and enum/flag metadata,
 * never material. kind is the MFA authenticator kind (totp/email/...).
+* providerId / providerName identify the identity provider on account link &
+* unlink events (plan 091): metadata only, never external tokens.
 *
 * The single structured exception is `diff` (entity-CRUD bridge): it survives
 * only as a one-level object of `{ next, previous }` scalar pairs, keys
@@ -30,15 +33,15 @@ import { isObject } from "@authup/kit";
 	"reason",
 	"clientName",
 	"realmName",
-	"sessionId",
 	"jti",
-	"revokedSessionId",
 	"name",
 	"use",
 	"status",
 	"enabled",
 	"force",
-	"kind"
+	"kind",
+	"providerId",
+	"providerName"
 ];
 const DATA_VALUE_MAX_LENGTH = 512;
 function isDiffScalar(value) {

package/dist/core/entities/event/sanitize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * sessionId / jti / revokedSessionId are opaque correlation ids, not PII.\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grantType',\n    'scope',\n    'responseType',\n    'prompt',\n    'error',\n    'errorCode',\n    'reason',\n    'clientName',\n    'realmName',\n    'sessionId',\n    'jti',\n    'revokedSessionId',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}
+{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * jti is an opaque correlation id, not PII (a session id is not listed here:\n * it rides the dedicated `sessionId` column, never the data bag).\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n * providerId / providerName identify the identity provider on account link &\n * unlink events (plan 091): metadata only, never external tokens.\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grantType',\n    'scope',\n    'responseType',\n    'prompt',\n    'error',\n    'errorCode',\n    'reason',\n    'clientName',\n    'realmName',\n    'jti',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n    'providerId',\n    'providerName',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GA8BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}

package/dist/core/entities/event/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,eAAO,MAAM,WAAW,0CA4CtB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,eAAO,MAAM,WAAW,0CAgEtB,CAAC"}

package/dist/core/entities/event/schema.mjs

@@ -6,6 +6,27 @@ import { defineSchema } from "@rapiq/core";
 //#region src/core/entities/event/schema.ts
 const eventSchema = defineSchema({
 	name: EntityType.EVENT,
+	indexes: [
+		["id"],
+		["name", "scope"],
+		["scope"],
+		["refType", "refId"],
+		["refId"],
+		["clientId"],
+		["sessionId"],
+		["actorType"],
+		["actorId"],
+		[
+			"actorName",
+			"requestIpAddress",
+			"createdAt"
+		],
+		["requestIpAddress"],
+		["realmId"],
+		["expiring"],
+		["realmId", "createdAt"],
+		["createdAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"scope",
@@ -13,6 +34,7 @@ const eventSchema = defineSchema({
 		"refType",
 		"refId",
 		"clientId",
+		"sessionId",
 		"actorType",
 		"actorId",
 		"actorName",
@@ -26,23 +48,30 @@ const eventSchema = defineSchema({
 		"expiresAt",
 		"createdAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"scope",
-		"name",
-		"refType",
-		"refId",
-		"clientId",
-		"actorType",
-		"actorId",
-		"actorName",
-		"requestIpAddress",
-		"realmId",
-		"expiring",
-		"createdAt"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"scope",
+			"name",
+			"refType",
+			"refId",
+			"clientId",
+			"sessionId",
+			"actorType",
+			"actorId",
+			"actorName",
+			"requestIpAddress",
+			"realmId",
+			"expiring",
+			"createdAt"
+		],
+		indexed: true
+	},
 	relations: { allowed: [] },
-	sort: { allowed: ["createdAt"] },
+	sorts: {
+		allowed: ["createdAt"],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 }
 });
 //#endregion