@authup/server-core 1.0.0-beta.60 → 1.0.0-beta.62

package/dist/index.mjs

@@ -210,6 +210,8 @@ import { IdentityInjectionKey } from "./app/modules/identity/constants.mjs";
 import { IdentityProviderAttributeMappingRepository } from "./app/modules/identity/repositories/provider/mapper/attribute.mjs";
 import { IdentityProviderPermissionMappingRepository } from "./app/modules/identity/repositories/provider/mapper/permission.mjs";
 import { IdentityProviderRoleMappingRepository } from "./app/modules/identity/repositories/provider/mapper/role.mjs";
+import { CacheIdentityPrefix } from "./app/modules/identity/repositories/constants.mjs";
+import { IdentityProviderAccountLinkStore } from "./app/modules/identity/repositories/provider/link.mjs";
 import { ClientIdentityRepository } from "./app/modules/identity/repositories/client.mjs";
 import { UserIdentityRepository } from "./app/modules/identity/repositories/user.mjs";
 import { LDAPInjectionKey } from "./app/modules/ldap/constants.mjs";
@@ -234,4 +236,4 @@ import { defineCLIMigrationCommand } from "./cli/commands/migration.mjs";
 import { defineCLIStartCommand } from "./cli/commands/start.mjs";
 import "./cli/commands/index.mjs";
 import "reflect-metadata";
-export { AccountController, ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountController, IdentityProviderAccountEntity, IdentityProviderAccountRepositoryAdapter, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenController, SessionTokenEntity, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeRowLockable, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };
+export { AccountController, ActivateController, ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, CacheIdentityPrefix, CacheInjectionKey, CacheModule, CachePrefix, ClientController, ClientEntity, ClientIdentityRepository, ClientPermissionController, ClientPermissionEntity, ClientPermissionRepositoryAdapter, ClientPermissionRequestValidator, ClientPermissionSubscriber, ClientRepositoryAdapter, ClientRoleController, ClientRoleEntity, ClientRoleRepositoryAdapter, ClientRoleRequestValidator, ClientRoleSubscriber, ClientScopeController, ClientScopeEntity, ClientScopeRepositoryAdapter, ClientScopeRequestValidator, ClientScopeSubscriber, ClientSubscriber, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, ConsentController, ConsentEntity, ConsentEntitySubscriber, DataSourceOptionsBuilder, DatabaseConflictError, DatabaseInjectionKey, DatabaseModule, DatabaseQueryResultCache, DefaultProvisioningSource, EntitySubscriber, EventController, EventEntity, EventRepositoryAdapter, FileProvisioningSource, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPInjectionKey, HTTPModule, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityInjectionKey, IdentityModule, IdentityProviderAccountController, IdentityProviderAccountEntity, IdentityProviderAccountLinkStore, IdentityProviderAccountRepositoryAdapter, IdentityProviderAccountSubscriber, IdentityProviderAttributeEntity, IdentityProviderAttributeMappingEntity, IdentityProviderAttributeMappingRepository, IdentityProviderAttributeSubscriber, IdentityProviderController, IdentityProviderEntity, IdentityProviderPermissionMappingEntity, IdentityProviderPermissionMappingRepository, IdentityProviderRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingController, IdentityProviderRoleMappingEntity, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, IdentityProviderRoleSubscriber, IdentityProviderSubscriber, JwkController, KeyController, KeyEntity, KeyRepositoryAdapter, LDAPInjectionKey, LOCALE_COOKIE, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, LogoutController, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionDatabaseProvider, PermissionEntity, PermissionPolicyController, PermissionPolicyEntity, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PermissionSubscriber, PolicyAttributeEntity, PolicyAttributeSubscriber, PolicyAttributesValidator, PolicyController, PolicyEntity, PolicyRepository, PolicyRepositoryAdapter, PolicySubscriber, PolicyValidator, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmController, RealmEntity, RealmRepository, RealmRepositoryAdapter, RealmResolverMiddleware, RealmSubscriber, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeEntity, RoleAttributeRepositoryAdapter, RoleAttributeRequestValidator, RoleAttributeSubscriber, RoleController, RoleEntity, RolePermissionController, RolePermissionEntity, RolePermissionRepositoryAdapter, RolePermissionRequestValidator, RolePermissionSubscriber, RoleRepository, RoleRepositoryAdapter, RoleSubscriber, RuntimeModule, ScopeController, ScopeEntity, ScopeRepositoryAdapter, ScopeSubscriber, SessionController, SessionEntity, SessionRepository, SessionTokenController, SessionTokenEntity, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, TrustAnchorEntity, TrustAnchorRepositoryAdapter, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeEntity, UserAttributeRepositoryAdapter, UserAttributeRequestValidator, UserAttributeSubscriber, UserAuthenticatorController, UserAuthenticatorEntity, UserAuthenticatorRepositoryAdapter, UserController, UserEntity, UserIdentityRepository, UserInfoController, UserPermissionController, UserPermissionEntity, UserPermissionRepositoryAdapter, UserPermissionRequestValidator, UserPermissionSubscriber, UserRepository, UserRepositoryAdapter, UserRoleController, UserRoleEntity, UserRoleRepositoryAdapter, UserRoleRequestValidator, UserRoleSubscriber, UserSubscriber, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, buildEntityDestinations, createApplication, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, dateToISOStringTransformer, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, expandToOrigins, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getAppOrigins, getBodyRealmID, getDatabaseDriverErrorCode, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isDatabaseTypeRowLockable, isDatabaseTypeSupported, isDatabaseTypeSupportedForEnvironment, isForeignKeyConstraintDatabaseError, isUniqueConstraintDatabaseError, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };

package/dist/node_modules/@ebec/core/dist/index.mjs

@@ -0,0 +1,130 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region ../../node_modules/@ebec/core/dist/index.mjs
+/**
+* Vocabulary of well-known issue codes. Validators map their own failure
+* kinds onto these so consumer-side translation catalogs can ship one
+* localized message per code instead of falling back to a generic
+* "invalid value".
+*
+* Tracks the common ground between vuelidate, zod, joi, yup and
+* validator.js. The list lifts from vuelidate's catalog (snake_cased);
+* modern format codes (`PATTERN`, `UUID`, `DATE`, `JSON`, `BASE64`,
+* `STRONG_PASSWORD`, …) cover ground vuelidate predates. Every format
+* code names the format positively (`UUID`, `EMAIL`, `URL`, …) rather
+* than the failure mode (`NOT_UUID`, `INVALID_EMAIL`) so the registry
+* reads consistently.
+*
+* **This vocabulary is a default, not a requirement.** `IssueItem.code`
+* is widened to `IssueCode | (string & {})`, so a library with its own
+* vocabulary — `rapiq`'s `key_not_allowed`, an app's `email_taken` —
+* emits well-formed issues without touching this const at all. If you
+* want a typed const for your own codes, define one alongside this one:
+*
+* ```ts
+* import { IssueCode } from '@ebec/core';
+*
+* export const AppCode = {
+*     ...IssueCode,
+*     EMAIL_TAKEN: 'email_taken',
+* } as const;
+* ```
+*
+* Each entry's JSDoc documents the structured `data` producers should
+* attach when constructing the issue — templates can rely on those
+* placeholders being present (`{min}`, `{max}`, `{other}`, etc.).
+*/
+const IssueCode = {
+	/** Generic fallback when no more-specific code applies. `data`: — */
+	VALUE_INVALID: "value_invalid",
+	/** Every branch of a `oneOf` alternative failed. `data`: — */
+	ONE_OF_FAILED: "one_of_failed",
+	/** Value is missing, `undefined`, `null`, or empty per the validator's semantics. `data`: — */
+	REQUIRED: "required",
+	/** Value contains characters outside the alphabetical set. `data`: — */
+	ALPHA: "alpha",
+	/** Value contains characters outside the alphanumeric set. `data`: — */
+	ALPHA_NUM: "alpha_num",
+	/** Value is not a number. `data`: — */
+	NUMERIC: "numeric",
+	/** Value is not an integer. `data`: — */
+	INTEGER: "integer",
+	/** Value is not a decimal number. `data`: — */
+	DECIMAL: "decimal",
+	/** Value is shorter than the configured minimum. `data`: `{ min: number }` */
+	MIN_LENGTH: "min_length",
+	/** Value is longer than the configured maximum. `data`: `{ max: number }` */
+	MAX_LENGTH: "max_length",
+	/** Numeric value is below the configured minimum. `data`: `{ min: number }` */
+	MIN_VALUE: "min_value",
+	/** Numeric value is above the configured maximum. `data`: `{ max: number }` */
+	MAX_VALUE: "max_value",
+	/** Numeric value falls outside the configured `[min, max]` range. `data`: `{ min: number, max: number }` */
+	BETWEEN: "between",
+	/** Value is not a valid email address. `data`: — */
+	EMAIL: "email",
+	/** Value is not a valid URL. `data`: — */
+	URL: "url",
+	/** Value is not a valid IP address. `data`: — */
+	IP_ADDRESS: "ip_address",
+	/** Value is not a valid MAC address. `data`: — */
+	MAC_ADDRESS: "mac_address",
+	/** Value is not a valid UUID. `data`: — */
+	UUID: "uuid",
+	/** Value is not a valid date / cannot be parsed as a date. `data`: — */
+	DATE: "date",
+	/**
+	* Value does not match the expected regex pattern. `data`:
+	* `{ pattern: string }` — source of the regex without flags so
+	* catalogs can quote it in human-readable form.
+	*/
+	PATTERN: "pattern",
+	/** Value is not valid JSON. `data`: — */
+	JSON: "json",
+	/** Value is not valid base64. `data`: — */
+	BASE64: "base64",
+	/**
+	* Value does not meet the configured strong-password rules. `data`:
+	* `{ minLength?: number, minLowercase?: number, minUppercase?: number,
+	* minNumbers?: number, minSymbols?: number }` — only the keys the
+	* producer chose to surface; missing keys mean "the default for that
+	* setting wasn't configured."
+	*/
+	STRONG_PASSWORD: "strong_password",
+	/**
+	* Value must equal another named field's value (sibling-field assertion,
+	* e.g. password-confirm). `data`: `{ other: string }` — the name of
+	* the field being compared against.
+	*/
+	SAME_AS: "same_as"
+};
+/**
+* Build an `IssueItem`. TS uses the supplied `code` to pick the right
+* `data` requirement at the call site — passing `MIN_LENGTH` without
+* `data: { min }` is a compile error; passing `STRONG_PASSWORD` with
+* `data: { pointsPerUnique: 5 }` is a compile error.
+*
+* `code` may be omitted (defaults to `IssueCode.VALUE_INVALID` — bare,
+* no data).
+*
+* ```ts
+* defineIssueItem({
+*     code: IssueCode.MIN_LENGTH,
+*     path: ['name'],
+*     message: 'Must be at least 3 characters',
+*     data: { min: 3 },
+* });
+* ```
+*/
+function defineIssueItem(data) {
+	return {
+		type: "item",
+		...data,
+		code: data.code || IssueCode.VALUE_INVALID
+	};
+}
+//#endregion
+export { IssueCode, defineIssueItem };
+
+//# sourceMappingURL=index.mjs.map

package/dist/node_modules/@ebec/core/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../node_modules/@ebec/core/dist/index.mjs"],"sourcesContent":["//#region src/helpers/object.ts\nfunction isObject(item) {\n\treturn !!item && typeof item === \"object\" && !Array.isArray(item);\n}\n//#endregion\n//#region src/helpers/error.ts\nfunction isError(input) {\n\tif (!isObject(input)) return false;\n\tif (input instanceof Error) return true;\n\treturn typeof input.message === \"string\" && (typeof input.name === \"string\" || typeof input.stack === \"string\");\n}\n//#endregion\n//#region src/helpers/instanceof.ts\n/**\n* Property name used to store the cross-realm class-marker chain on instances.\n*\n* The chain is a `symbol[]` of `Symbol.for(...)` markers — one per class in the\n* inheritance path. Stored as a non-enumerable, non-writable, non-configurable\n* property so it stays out of `Object.keys()` and plain `JSON.stringify()`\n* output. `BaseError.toJSON()` re-emits it under the same key as a string\n* list (see {@link serializeInstanceofChain}), so on objects rehydrated from\n* that JSON the property holds a `string[]` instead.\n*\n* A well-formed chain always begins with `BASE_ERROR_INSTANCE` — every real\n* ebec error is a `BaseError` first, and subclass markers are appended on\n* top of it. Hand-built cross-realm stand-ins that carry a subclass marker\n* without it can invert that hierarchy (e.g. matching `@ebec/http`'s\n* `isHTTPError` while failing `@ebec/core`'s `isBaseError`).\n*/\nconst INSTANCEOF_PROPERTY = \"@instanceof\";\n/**\n* Append a class-marker symbol to the receiver's `@instanceof` chain.\n*\n* Each error class declares a `Symbol.for(...)` marker for itself and calls\n* `markInstanceof(this, MY_MARKER)` from its constructor. Subclass instances\n* accumulate markers from every ancestor in the chain, so a parent-class\n* guard can fast-path-match a subclass instance.\n*\n* Idempotent — re-marking the same instance with the same symbol is a no-op.\n*/\nfunction markInstanceof(target, marker) {\n\tconst existing = target[INSTANCEOF_PROPERTY];\n\tif (Array.isArray(existing)) {\n\t\tif (!existing.includes(marker)) existing.push(marker);\n\t\treturn;\n\t}\n\tObject.defineProperty(target, INSTANCEOF_PROPERTY, {\n\t\tvalue: [marker],\n\t\twritable: false,\n\t\tenumerable: false,\n\t\tconfigurable: false\n\t});\n}\n/**\n* Check whether the input's `@instanceof` chain carries `marker`.\n*\n* Returns `false` for non-objects, objects without the chain, or chains\n* stored as a non-array value (defensive).\n*\n* `strict` controls which chain entries count as a match. By default\n* (`strict: true`) only the native `Symbol.for(...)` form matches, which is\n* what an in-process instance carries. Pass `strict: false` to also match\n* the marker's `description` string: symbols are dropped by\n* `JSON.stringify`, so an error rehydrated from the JSON emitted by\n* `BaseError.toJSON()` carries the marker's description string in its chain\n* instead of the symbol, and only the loose form still recognizes it.\n* {@link matchesInstanceof} is `hasInstanceof(input, marker, false)`.\n*/\nfunction hasInstanceof(input, marker, strict = true) {\n\tif (!isObject(input)) return false;\n\tconst chain = input[INSTANCEOF_PROPERTY];\n\tif (!Array.isArray(chain)) return false;\n\tif (chain.includes(marker)) return true;\n\tif (strict) return false;\n\treturn typeof marker.description === \"string\" && chain.includes(marker.description);\n}\n/**\n* Serialize the input's `@instanceof` class-marker chain to its string form.\n*\n* Symbols are dropped by `JSON.stringify`, so `BaseError.toJSON()` emits the\n* chain as the markers' description strings instead. For `Symbol.for(...)`\n* markers the description *is* the registry key, so the string form carries\n* the same identity information as the symbol form.\n*\n* String entries pass through unchanged (a rehydrated chain re-serializes\n* losslessly); anything else is dropped. Each value is emitted once — a\n* re-marked rehydrated chain can hold the same marker in both its string\n* and symbol form.\n*/\nfunction serializeInstanceofChain(input) {\n\tif (!isObject(input)) return [];\n\tconst chain = input[INSTANCEOF_PROPERTY];\n\tif (!Array.isArray(chain)) return [];\n\tconst output = [];\n\tfor (const entry of chain) {\n\t\tlet value;\n\t\tif (typeof entry === \"symbol\") {\n\t\t\tif (entry.description) value = entry.description;\n\t\t} else if (typeof entry === \"string\") value = entry;\n\t\tif (typeof value === \"string\" && !output.includes(value)) output.push(value);\n\t}\n\treturn output;\n}\n/**\n* Check whether the input's `@instanceof` chain carries `marker` — either as\n* the native registry symbol (an in-process instance) or as the symbol's\n* description string (an error rehydrated from the JSON emitted by\n* `BaseError.toJSON()`).\n*\n* Prefer this over the strict (default) form of {@link hasInstanceof} as the\n* fast path of duck-type guards. Guards have no shape-based fallback, so the\n* strict form is the only check one performs: it matches only the symbol\n* form, so a guard built on it returns `false` outright for a\n* JSON-rehydrated subclass error — there is no slower path to fall back to.\n* Equivalent to `hasInstanceof(input, marker, false)`.\n*/\nfunction matchesInstanceof(input, marker) {\n\treturn hasInstanceof(input, marker, false);\n}\n//#endregion\n//#region src/helpers/check.ts\nconst BASE_ERROR_INSTANCE$1 = Symbol.for(\"@ebec/core/BaseError\");\nfunction isBaseError(input) {\n\treturn matchesInstanceof(input, BASE_ERROR_INSTANCE$1);\n}\nfunction isBaseErrorGroup(input) {\n\tif (!isBaseError(input)) return false;\n\tconst { errors } = input;\n\treturn Array.isArray(errors) && errors.length > 0 && errors.every((e) => isError(e));\n}\n//#endregion\n//#region src/helpers/error-code.ts\nfunction isErrorWithCode(error, code) {\n\tif (!isBaseError(error)) return false;\n\tif (Array.isArray(code)) return code.includes(error.code);\n\treturn error.code === code;\n}\n//#endregion\n//#region src/helpers/interpolate.ts\n/**\n* Substitute `{name}` placeholders in `str` with values from `data`.\n*\n* Placeholders whose key is missing from `data` (or explicitly\n* `undefined`) are left in the string verbatim, so a partially-populated\n* `data` degrades to a readable template rather than to `\"undefined\"`.\n*\n* - `regex` must carry the `g` flag — `String.prototype.matchAll` throws\n*   without it.\n* - Substitution goes through `String.prototype.replace` with a string\n*   replacement, so `$&`, `` $` ``, `$'` and `$1` inside a *substituted\n*   value* are interpreted as replacement patterns rather than literals.\n*   Treat `data` values as trusted, or escape `$` before passing them.\n*/\nfunction interpolate(str, data, regex = /\\{(\\w+)\\}/g) {\n\treturn Array.from(str.matchAll(regex)).reduce((acc, match) => {\n\t\tconst key = match[1];\n\t\tif (key && typeof data[key] !== \"undefined\") return acc.replace(match[0], String(data[key]));\n\t\treturn acc;\n\t}, str);\n}\n//#endregion\n//#region src/helpers/sanitize-code.ts\n/**\n* Convert a PascalCase class name to CONSTANT_CASE error code.\n* e.g. \"NotFoundError\" -> \"NOT_FOUND_ERROR\"\n*/\nfunction sanitizeErrorCode(input) {\n\treturn input.replace(/([a-z])([A-Z])/g, \"$1_$2\").replace(/([A-Z]+)([A-Z][a-z])/g, \"$1_$2\").toUpperCase();\n}\n//#endregion\n//#region src/helpers/serialize.ts\nfunction toSerializable(input) {\n\tif (isObject(input) && typeof input.toJSON === \"function\") return input.toJSON();\n\tif (isError(input)) return { message: input.message };\n\treturn input;\n}\n//#endregion\n//#region src/options/module.ts\nfunction isErrorOptions(input) {\n\tif (!isObject(input)) return false;\n\tif (typeof input.message !== \"undefined\" && typeof input.message !== \"string\") return false;\n\tif (typeof input.stack !== \"undefined\" && typeof input.stack !== \"string\") return false;\n\treturn typeof input.code === \"undefined\" || typeof input.code === \"string\";\n}\nfunction extractErrorOptions(input = {}) {\n\tif (typeof input === \"string\") return { message: input };\n\treturn input;\n}\n//#endregion\n//#region src/module.ts\nconst BASE_ERROR_INSTANCE = Symbol.for(\"@ebec/core/BaseError\");\nvar BaseError = class extends Error {\n\t/**\n\t* A unique identifier for the error.\n\t*/\n\tcode;\n\t/**\n\t* Represents the underlying cause or source of the error.\n\t*/\n\tcause;\n\t/**\n\t* A collection of errors for batch/group error scenarios.\n\t*/\n\terrors;\n\t/**\n\t* Structured validation failures, as an issue tree.\n\t* Always an array — empty when the error carries none.\n\t*/\n\tissues;\n\tconstructor(input = {}) {\n\t\tconst options = extractErrorOptions(input);\n\t\tlet message = options.message || \"An error occurred\";\n\t\tif (options.messageData) message = interpolate(message, options.messageData);\n\t\tsuper(message);\n\t\tif (options.cause !== void 0) this.cause = options.cause;\n\t\tif (typeof this.name === \"undefined\" || this.name === \"Error\") Object.defineProperty(this, \"name\", {\n\t\t\tconfigurable: true,\n\t\t\tenumerable: false,\n\t\t\tvalue: this.constructor.name,\n\t\t\twritable: true\n\t\t});\n\t\tif (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);\n\t\tif (options.stack) this.stack = options.stack;\n\t\tthis.code = options.code || sanitizeErrorCode(this.constructor.name);\n\t\tif (options.errors !== void 0) this.errors = [...options.errors];\n\t\tthis.issues = Array.isArray(options.issues) ? [...options.issues] : [];\n\t\tmarkInstanceof(this, BASE_ERROR_INSTANCE);\n\t}\n\t/**\n\t* The class-marker chain rides along as a string list so the ancestor\n\t* information survives a JSON round-trip (symbols don't serialize) —\n\t* duck-type guards match rehydrated subclass errors through it via\n\t* `matchesInstanceof`.\n\t*/\n\ttoJSON() {\n\t\treturn {\n\t\t\tname: this.name,\n\t\t\tmessage: this.message,\n\t\t\tcode: this.code,\n\t\t\t...this.cause !== void 0 && { cause: toSerializable(this.cause) },\n\t\t\t...this.errors !== void 0 && { errors: this.errors.map((e) => toSerializable(e)) },\n\t\t\t...this.issues.length > 0 && { issues: [...this.issues] },\n\t\t\t[INSTANCEOF_PROPERTY]: serializeInstanceofChain(this)\n\t\t};\n\t}\n};\n//#endregion\n//#region src/catalog.ts\nfunction defineErrorCatalog(definitions) {\n\tconst catalog = {};\n\tfor (const key of Object.keys(definitions)) {\n\t\tconst entry = definitions[key];\n\t\tcatalog[key] = ((messageData, overrides = {}) => new BaseError({\n\t\t\t...entry,\n\t\t\t...overrides,\n\t\t\tcode: overrides.code ?? entry.code ?? key,\n\t\t\tmessage: overrides.message ?? entry.message,\n\t\t\tmessageData: overrides.messageData ?? messageData\n\t\t}));\n\t}\n\treturn catalog;\n}\n//#endregion\n//#region src/issue/check.ts\nfunction isObject$1(input) {\n\treturn !!input && typeof input === \"object\" && !Array.isArray(input);\n}\nfunction isIssuePath(input) {\n\tif (!Array.isArray(input)) return false;\n\treturn input.every((el) => typeof el === \"string\" || typeof el === \"number\" || typeof el === \"symbol\");\n}\nfunction isBaseIssue(input) {\n\tif (!isObject$1(input)) return false;\n\tif (typeof input.message !== \"string\") return false;\n\tif (!isIssuePath(input.path)) return false;\n\treturn typeof input.meta === \"undefined\" || isObject$1(input.meta);\n}\n/**\n* Structural check for a leaf node.\n*\n* Deliberately duck-typed rather than `instanceof`-based: issues cross\n* package and realm boundaries, so a tree assembled from two libraries —\n* or from two copies of this package — must still validate.\n*/\nfunction isIssueItem(input) {\n\tif (!isBaseIssue(input)) return false;\n\tif (input.type !== \"item\") return false;\n\treturn typeof input.code === \"string\";\n}\n/**\n* Structural check for a node with children. Recurses, so a group only\n* passes when every descendant is itself well-formed.\n*/\nfunction isIssueGroup(input) {\n\tif (!isBaseIssue(input)) return false;\n\tif (input.type !== \"group\") return false;\n\treturn Array.isArray(input.issues) && input.issues.every((issue) => isIssueItem(issue) || isIssueGroup(issue));\n}\n/**\n* Structural check for any node of the tree.\n*/\nfunction isIssue(input) {\n\treturn isIssueGroup(input) || isIssueItem(input);\n}\n//#endregion\n//#region src/issue/constants.ts\n/**\n* Vocabulary of well-known issue codes. Validators map their own failure\n* kinds onto these so consumer-side translation catalogs can ship one\n* localized message per code instead of falling back to a generic\n* \"invalid value\".\n*\n* Tracks the common ground between vuelidate, zod, joi, yup and\n* validator.js. The list lifts from vuelidate's catalog (snake_cased);\n* modern format codes (`PATTERN`, `UUID`, `DATE`, `JSON`, `BASE64`,\n* `STRONG_PASSWORD`, …) cover ground vuelidate predates. Every format\n* code names the format positively (`UUID`, `EMAIL`, `URL`, …) rather\n* than the failure mode (`NOT_UUID`, `INVALID_EMAIL`) so the registry\n* reads consistently.\n*\n* **This vocabulary is a default, not a requirement.** `IssueItem.code`\n* is widened to `IssueCode | (string & {})`, so a library with its own\n* vocabulary — `rapiq`'s `key_not_allowed`, an app's `email_taken` —\n* emits well-formed issues without touching this const at all. If you\n* want a typed const for your own codes, define one alongside this one:\n*\n* ```ts\n* import { IssueCode } from '@ebec/core';\n*\n* export const AppCode = {\n*     ...IssueCode,\n*     EMAIL_TAKEN: 'email_taken',\n* } as const;\n* ```\n*\n* Each entry's JSDoc documents the structured `data` producers should\n* attach when constructing the issue — templates can rely on those\n* placeholders being present (`{min}`, `{max}`, `{other}`, etc.).\n*/\nconst IssueCode = {\n\t/** Generic fallback when no more-specific code applies. `data`: — */\n\tVALUE_INVALID: \"value_invalid\",\n\t/** Every branch of a `oneOf` alternative failed. `data`: — */\n\tONE_OF_FAILED: \"one_of_failed\",\n\t/** Value is missing, `undefined`, `null`, or empty per the validator's semantics. `data`: — */\n\tREQUIRED: \"required\",\n\t/** Value contains characters outside the alphabetical set. `data`: — */\n\tALPHA: \"alpha\",\n\t/** Value contains characters outside the alphanumeric set. `data`: — */\n\tALPHA_NUM: \"alpha_num\",\n\t/** Value is not a number. `data`: — */\n\tNUMERIC: \"numeric\",\n\t/** Value is not an integer. `data`: — */\n\tINTEGER: \"integer\",\n\t/** Value is not a decimal number. `data`: — */\n\tDECIMAL: \"decimal\",\n\t/** Value is shorter than the configured minimum. `data`: `{ min: number }` */\n\tMIN_LENGTH: \"min_length\",\n\t/** Value is longer than the configured maximum. `data`: `{ max: number }` */\n\tMAX_LENGTH: \"max_length\",\n\t/** Numeric value is below the configured minimum. `data`: `{ min: number }` */\n\tMIN_VALUE: \"min_value\",\n\t/** Numeric value is above the configured maximum. `data`: `{ max: number }` */\n\tMAX_VALUE: \"max_value\",\n\t/** Numeric value falls outside the configured `[min, max]` range. `data`: `{ min: number, max: number }` */\n\tBETWEEN: \"between\",\n\t/** Value is not a valid email address. `data`: — */\n\tEMAIL: \"email\",\n\t/** Value is not a valid URL. `data`: — */\n\tURL: \"url\",\n\t/** Value is not a valid IP address. `data`: — */\n\tIP_ADDRESS: \"ip_address\",\n\t/** Value is not a valid MAC address. `data`: — */\n\tMAC_ADDRESS: \"mac_address\",\n\t/** Value is not a valid UUID. `data`: — */\n\tUUID: \"uuid\",\n\t/** Value is not a valid date / cannot be parsed as a date. `data`: — */\n\tDATE: \"date\",\n\t/**\n\t* Value does not match the expected regex pattern. `data`:\n\t* `{ pattern: string }` — source of the regex without flags so\n\t* catalogs can quote it in human-readable form.\n\t*/\n\tPATTERN: \"pattern\",\n\t/** Value is not valid JSON. `data`: — */\n\tJSON: \"json\",\n\t/** Value is not valid base64. `data`: — */\n\tBASE64: \"base64\",\n\t/**\n\t* Value does not meet the configured strong-password rules. `data`:\n\t* `{ minLength?: number, minLowercase?: number, minUppercase?: number,\n\t* minNumbers?: number, minSymbols?: number }` — only the keys the\n\t* producer chose to surface; missing keys mean \"the default for that\n\t* setting wasn't configured.\"\n\t*/\n\tSTRONG_PASSWORD: \"strong_password\",\n\t/**\n\t* Value must equal another named field's value (sibling-field assertion,\n\t* e.g. password-confirm). `data`: `{ other: string }` — the name of\n\t* the field being compared against.\n\t*/\n\tSAME_AS: \"same_as\"\n};\n//#endregion\n//#region src/issue/define.ts\n/**\n* Build an `IssueItem`. TS uses the supplied `code` to pick the right\n* `data` requirement at the call site — passing `MIN_LENGTH` without\n* `data: { min }` is a compile error; passing `STRONG_PASSWORD` with\n* `data: { pointsPerUnique: 5 }` is a compile error.\n*\n* `code` may be omitted (defaults to `IssueCode.VALUE_INVALID` — bare,\n* no data).\n*\n* ```ts\n* defineIssueItem({\n*     code: IssueCode.MIN_LENGTH,\n*     path: ['name'],\n*     message: 'Must be at least 3 characters',\n*     data: { min: 3 },\n* });\n* ```\n*/\nfunction defineIssueItem(data) {\n\treturn {\n\t\ttype: \"item\",\n\t\t...data,\n\t\tcode: data.code || IssueCode.VALUE_INVALID\n\t};\n}\n/**\n* Build an {@link IssueGroup} — a node that carries child issues.\n*\n* The children's `path` values are used as given; this factory does not\n* rewrite them. When the children came from validating a *sub*-structure,\n* rebase them with {@link prefixIssuePath} first so the tree keeps its\n* absolute-path invariant.\n*/\nfunction defineIssueGroup(data) {\n\treturn {\n\t\ttype: \"group\",\n\t\t...data\n\t};\n}\n//#endregion\n//#region src/issue/flatten.ts\n/**\n* Collect every leaf of the tree, in pre-order, discarding grouping.\n*\n* This is the workhorse for consumers that render per-field errors: since\n* every node carries an absolute `path` (see `IssueBase.path`), the result\n* can be indexed by field directly, with no tree walk to reassemble\n* prefixes.\n*\n* Returned items are the **same object references** held by the tree, not\n* copies — cheap to call, but do not mutate what you get back.\n*/\nfunction flattenIssueItems(issues) {\n\tconst output = [];\n\tfor (const issue of issues) if (isIssueItem(issue)) output.push(issue);\n\telse output.push(...flattenIssueItems(issue.issues));\n\treturn output;\n}\n/**\n* Collect every group of the tree, in pre-order, including nested groups.\n*\n* A group is emitted before its own descendants are visited, so the result\n* reads outermost-first. As with {@link flattenIssueItems}, entries are\n* live references into the tree.\n*/\nfunction flattenIssueGroups(issues) {\n\tconst output = [];\n\tfor (const issue of issues) if (isIssueGroup(issue)) {\n\t\toutput.push(issue);\n\t\toutput.push(...flattenIssueGroups(issue.issues));\n\t}\n\treturn output;\n}\n//#endregion\n//#region src/issue/format.ts\n/**\n* Render an issue's user-facing message.\n*\n* Resolution order:\n* 1. If `templates[code]` exists, return `interpolate(template, issue.data)`.\n* 2. Else return `issue.message` (the default English rendering set at\n*    construction time).\n* 3. Else return `fallback`.\n*\n* The eager `message` written at construction time is what makes step 2\n* useful: a consumer with no catalog at all still gets something readable,\n* and a consumer with a partial catalog falls back per-code rather than\n* all-or-nothing.\n*/\nfunction formatIssue(issue, templates, fallback = \"\") {\n\tif (templates && issue.code) {\n\t\tconst template = templates[issue.code];\n\t\tif (typeof template === \"string\") return interpolate(template, issue.data || {});\n\t}\n\tif (typeof issue.message === \"string\" && issue.message.length > 0) return issue.message;\n\treturn fallback;\n}\n//#endregion\n//#region src/issue/prefix.ts\n/**\n* Rebase an issue onto a parent path, recursing into groups so every\n* descendant is rebased too.\n*\n* This is the step that maintains the absolute-path invariant (see\n* `IssueBase.path`). Whenever a producer validates a *sub*-structure and\n* merges the resulting issues into a larger tree, the children arrive with\n* paths relative to that sub-structure and have to be rewritten. Doing it\n* only at the top level is the tempting bug: a child that already wrapped\n* its own failures in an {@link IssueGroup} would surface inner leaves\n* missing the parent segment, and every consumer relying on\n* {@link flattenIssueItems} for per-field lookup would silently mis-index\n* exactly the nested cases.\n*\n* ```ts\n* // validating `address` produced issues at ['street']\n* const rebased = issues.map((issue) => prefixIssuePath(issue, ['address']));\n* // → paths are now ['address', 'street'], at every depth\n* ```\n*\n* **Returns copies.** The input is never mutated: each visited node is\n* shallow-copied and a group's `issues` array is rebuilt from the rebased\n* children, so the whole spine is fresh. `data` and `meta` are carried over\n* by reference — cheap, but it means a caller that mutates `meta` on the\n* result also mutates it on the original. Copying happens unconditionally,\n* including for an empty `prefix`.\n*/\nfunction prefixIssuePath(issue, prefix) {\n\tconst prefixed = {\n\t\t...issue,\n\t\tpath: [...prefix, ...issue.path || []]\n\t};\n\tif (prefixed.type === \"group\") prefixed.issues = prefixed.issues.map((nested) => prefixIssuePath(nested, prefix));\n\treturn prefixed;\n}\n//#endregion\nexport { BASE_ERROR_INSTANCE, BaseError, INSTANCEOF_PROPERTY, IssueCode, defineErrorCatalog, defineIssueGroup, defineIssueItem, extractErrorOptions, flattenIssueGroups, flattenIssueItems, formatIssue, hasInstanceof, interpolate, isBaseError, isBaseErrorGroup, isError, isErrorOptions, isErrorWithCode, isIssue, isIssueGroup, isIssueItem, isObject, markInstanceof, matchesInstanceof, prefixIssuePath, sanitizeErrorCode, serializeInstanceofChain, toSerializable };\n\n//# sourceMappingURL=index.mjs.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmVA,MAAM,YAAY;;CAEjB,eAAe;;CAEf,eAAe;;CAEf,UAAU;;CAEV,OAAO;;CAEP,WAAW;;CAEX,SAAS;;CAET,SAAS;;CAET,SAAS;;CAET,YAAY;;CAEZ,YAAY;;CAEZ,WAAW;;CAEX,WAAW;;CAEX,SAAS;;CAET,OAAO;;CAEP,KAAK;;CAEL,YAAY;;CAEZ,aAAa;;CAEb,MAAM;;CAEN,MAAM;;;;;;CAMN,SAAS;;CAET,MAAM;;CAEN,QAAQ;;;;;;;;CAQR,iBAAiB;;;;;;CAMjB,SAAS;AACV;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,gBAAgB,MAAM;CAC9B,OAAO;EACN,MAAM;EACN,GAAG;EACH,MAAM,KAAK,QAAQ,UAAU;CAC9B;AACD"}

package/dist/swagger.json

@@ -428,6 +428,19 @@
                             }
                         ]
                     },
+                    "caseSensitive": {
+                        "anyOf": [
+                            {
+                                "type": "array",
+                                "items": {
+                                    "type": "string"
+                                }
+                            },
+                            {
+                                "type": "null"
+                            }
+                        ]
+                    },
                     "allowed": {
                         "anyOf": [
                             {
@@ -444,6 +457,7 @@
                 },
                 "required": [
                     "indexed",
+                    "caseSensitive",
                     "allowed"
                 ],
                 "type": "object",
@@ -3696,6 +3710,34 @@
                 ],
                 "type": "object"
             },
+            "EntityRecordResponseIdentityProviderAccount": {
+                "properties": {
+                    "meta": {
+                        "$ref": "#/components/schemas/EntityRecordMeta"
+                    },
+                    "data": {
+                        "$ref": "#/components/schemas/IdentityProviderAccount"
+                    }
+                },
+                "required": [
+                    "meta",
+                    "data"
+                ],
+                "type": "object",
+                "description": "The wire shape of every entity-record response: the record under\n`data`, response-scoped extras under `meta` (mirroring\n`EntityCollectionResponse`)."
+            },
+            "IdentityProviderLinkConfirmPayload": {
+                "properties": {
+                    "handle": {
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "handle"
+                ],
+                "type": "object",
+                "description": "Body of `POST /identity-providers/:id/link-confirm` (issue #3439): the\none-time handle the callback returned on the account console URL. The\naccount row is written for the AUTHENTICATED caller, so the handle names\na pending link rather than authorizing one on its own."
+            },
             "EntityCollectionResponseIdentityProviderAccount": {
                 "properties": {
                     "meta": {
@@ -3734,22 +3776,6 @@
                 ],
                 "type": "object"
             },
-            "EntityRecordResponseIdentityProviderAccount": {
-                "properties": {
-                    "meta": {
-                        "$ref": "#/components/schemas/EntityRecordMeta"
-                    },
-                    "data": {
-                        "$ref": "#/components/schemas/IdentityProviderAccount"
-                    }
-                },
-                "required": [
-                    "meta",
-                    "data"
-                ],
-                "type": "object",
-                "description": "The wire shape of every entity-record response: the record under\n`data`, response-scoped extras under `meta` (mirroring\n`EntityCollectionResponse`)."
-            },
             "IdentityProviderRoleMapping": {
                 "properties": {
                     "name": {
@@ -9655,7 +9681,14 @@
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "$ref": "#/components/schemas/Response"
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "$ref": "#/components/schemas/Response"
+                                        }
+                                    ]
                                 }
                             }
                         }
@@ -9688,7 +9721,14 @@
                         "content": {
                             "application/json": {
                                 "schema": {
-                                    "$ref": "#/components/schemas/Response"
+                                    "anyOf": [
+                                        {
+                                            "type": "string"
+                                        },
+                                        {
+                                            "$ref": "#/components/schemas/Response"
+                                        }
+                                    ]
                                 }
                             }
                         }
@@ -9712,6 +9752,94 @@
                 ]
             }
         },
+        "/identity-providers/{id}/link-confirm": {
+            "post": {
+                "operationId": "ConfirmLink",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/EntityRecordResponseIdentityProviderAccount"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "The bearer-authenticated half of the link (issue #3439): the account\nrow is written here, for the AUTHENTICATED user, never in the callback.",
+                "tags": [],
+                "parameters": [
+                    {
+                        "allowEmptyValue": false,
+                        "deprecated": false,
+                        "description": "",
+                        "in": "path",
+                        "name": "id",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "examples": {}
+                    }
+                ],
+                "requestBody": {
+                    "description": "",
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/IdentityProviderLinkConfirmPayload"
+                            }
+                        }
+                    }
+                }
+            }
+        },
+        "/realms/{realmId}/identity-providers/{id}/link-confirm": {
+            "post": {
+                "operationId": "ConfirmLink_2",
+                "responses": {
+                    "200": {
+                        "description": "Ok",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/EntityRecordResponseIdentityProviderAccount"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "The bearer-authenticated half of the link (issue #3439): the account\nrow is written here, for the AUTHENTICATED user, never in the callback.",
+                "tags": [],
+                "parameters": [
+                    {
+                        "allowEmptyValue": false,
+                        "deprecated": false,
+                        "description": "",
+                        "in": "path",
+                        "name": "id",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "examples": {}
+                    }
+                ],
+                "requestBody": {
+                    "description": "",
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/IdentityProviderLinkConfirmPayload"
+                            }
+                        }
+                    }
+                }
+            }
+        },
         "/identity-provider-accounts": {
             "get": {
                 "operationId": "GetMany_10",

package/dist/utils/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,WAAW,EAKd,MAAM,gBAAgB,CAAC;AAQxB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAgGzD;AA0ED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BvE"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,WAAW,EAKd,MAAM,gBAAgB,CAAC;AAQxB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CA8FzD;AA0ED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BvE"}

package/dist/utils/error.mjs

@@ -5,9 +5,9 @@ import { hasOwnProperty, isObject } from "@authup/kit";
 import { AuthupError, ErrorCode, codeFromHttpStatus, isAuthupError, normalizeError } from "@authup/errors";
 import { CodecError, ParseError } from "@rapiq/core";
 import { buildErrorMessageForAttributes, isValidupError, stringifyPath } from "validup";
-import { EntityRelationLookupError } from "typeorm-extension";
-import { isClientError } from "hapic";
 import { isHTTPError } from "@ebec/http";
+import { isClientError } from "hapic";
+import { EntityRelationLookupError } from "typeorm-extension";
 //#region src/utils/error.ts
 /**
 * Normalize an unknown error to an AuthupError. Recognised shapes:
@@ -32,13 +32,12 @@ import { isHTTPError } from "@ebec/http";
 	});
 	if (isValidupError(input)) {
 		const paths = input.issues.map((issue) => stringifyPath(issue.path));
-		const error = new AuthupError({
+		return new AuthupError({
 			code: ErrorCode.BAD_REQUEST,
 			stack: input.stack,
-			message: input.message || buildErrorMessageForAttributes(paths)
+			message: input.message || buildErrorMessageForAttributes(paths),
+			issues: input.issues
 		});
-		error.issues.push(...input.issues);
-		return error;
 	}
 	if (input instanceof ParseError || input instanceof CodecError) return new AuthupError({
 		code: ErrorCode.BAD_REQUEST,

package/dist/utils/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["AuthupError","ErrorCode","codeFromHttpStatus","isAuthupError","normalizeError","isHTTPError","isClientError","CodecError","ParseError","EntityRelationLookupError","buildErrorMessageForAttributes","isValidupError","stringifyPath","hasOwnProperty","isObject","sanitizeError","input","code","ENTITY_RELATION_INVALID","message","stack","paths","issues","map","issue","path","error","BAD_REQUEST","push","UPSTREAM_ERROR","status","undefined","ENTITY_CONFLICT","STORAGE_INSUFFICIENT","INTERNAL_ERROR","DESCRIBE_BODY_MAX_LENGTH","DESCRIBE_CAUSE_MAX_DEPTH","DESCRIBE_CAUSE_KEYS","describeBody","value","JSON","stringify","String","Object","prototype","toString","call","length","substring","describeCauseLink","name","parts","details","key","join","describeCauseChain","links","seen","Set","current","cause","has","add","describeError","headline","lines","response","body","data","causes"],"sources":["../../src/utils/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AuthupError,\n    ErrorCode,\n    codeFromHttpStatus,\n    isAuthupError,\n    normalizeError,\n} from '@authup/errors';\nimport { isHTTPError } from '@ebec/http';\nimport { isClientError } from 'hapic';\nimport { CodecError, ParseError } from '@rapiq/core';\nimport { EntityRelationLookupError } from 'typeorm-extension';\nimport { buildErrorMessageForAttributes, isValidupError, stringifyPath } from 'validup';\nimport { hasOwnProperty, isObject } from '@authup/kit';\n\n/**\n * Normalize an unknown error to an AuthupError. Recognised shapes:\n *\n * 1. AuthupError instance              → returned as-is\n * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError\n * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues\n * 4. rapiq ParseError / CodecError     → BAD_REQUEST AuthupError (client wire query)\n * 5. hapic ClientError                 → UPSTREAM_ERROR AuthupError (outbound call)\n * 6. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code\n * 7. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT\n * 8. anything else                     → INTERNAL_ERROR AuthupError\n *\n * The HTTP-status concern is handled separately by `httpStatusFromCode` in\n * the adapter — this function only assigns a semantic `code`.\n */\nexport function sanitizeError(input: unknown): AuthupError {\n    if (isAuthupError(input)) {\n        return input;\n    }\n\n    if (input instanceof EntityRelationLookupError) {\n        return new AuthupError({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isValidupError(input)) {\n        const paths = input.issues.map((issue) => stringifyPath(issue.path));\n        const error = new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            stack: input.stack,\n            message: input.message || buildErrorMessageForAttributes(paths),\n        });\n\n        error.issues.push(...input.issues);\n        return error;\n    }\n\n    if (input instanceof ParseError || input instanceof CodecError) {\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    /**\n     * An outbound call failed. This branch MUST precede the `isHTTPError`\n     * one below: a hapic `HttpResponseError` extends `BaseError` and carries\n     * the upstream `status`, so the duck guard matches it and would mirror\n     * that status onto our own response. An upstream 400 would then read as\n     * \"your request was malformed\" when the caller's request was fine.\n     *\n     * The message is deliberately dropped rather than forwarded: hapic\n     * embeds the outbound method and URL in it (`400 Bad Request (POST\n     * https://idp.example.com/token)`), which must not reach the caller.\n     * `describeError` is what carries the detail, into the log only.\n     */\n    if (isClientError(input)) {\n        return new AuthupError({\n            code: ErrorCode.UPSTREAM_ERROR,\n            message: 'A request to an upstream service failed.',\n            stack: input.stack,\n        });\n    }\n\n    if (isHTTPError(input)) {\n        return new AuthupError({\n            code: codeFromHttpStatus(input.status),\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isObject(input)) {\n        const code = hasOwnProperty(input, 'code') &&\n        typeof input.code === 'string' ?\n            input.code :\n            undefined;\n\n        /**\n         * @see https://dev.mysql.com/doc/mysql-errors/8.0/en/server-error-reference.html\n         */\n        switch (code) {\n            case '23505':\n            case 'ER_DUP_ENTRY':\n            case 'SQLITE_CONSTRAINT_UNIQUE': {\n                return new AuthupError({\n                    code: ErrorCode.ENTITY_CONFLICT,\n                    message: 'An entry with some unique attributes already exists.',\n                    stack: input.stack as string | undefined,\n                });\n            }\n            case 'ER_DISK_FULL':\n                return new AuthupError({\n                    code: ErrorCode.STORAGE_INSUFFICIENT,\n                    message: 'No database operation possible, due to the lack of free disk space.',\n                    stack: input.stack as string | undefined,\n                });\n        }\n\n        return new AuthupError({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: input.message as string | undefined,\n            stack: input.stack as string | undefined,\n        });\n    }\n\n    return new AuthupError({ code: ErrorCode.INTERNAL_ERROR });\n}\n\nconst DESCRIBE_BODY_MAX_LENGTH = 1024;\nconst DESCRIBE_CAUSE_MAX_DEPTH = 5;\n\n// Fields node attaches to a syscall error. Without them a transport failure\n// reads as a bare \"connect ECONNREFUSED\" with no way back to the reason.\nconst DESCRIBE_CAUSE_KEYS = ['code', 'errno', 'syscall', 'address', 'port'] as const;\n\nfunction describeBody(input: unknown): string | undefined {\n    let value: string;\n\n    if (typeof input === 'string') {\n        value = input;\n    } else {\n        try {\n            value = JSON.stringify(input) ?? String(input);\n        } catch {\n            // A body that cannot be serialized (circular, a stream) is\n            // still worth naming by shape.\n            value = Object.prototype.toString.call(input);\n        }\n    }\n\n    if (value.length === 0) {\n        return undefined;\n    }\n\n    if (value.length > DESCRIBE_BODY_MAX_LENGTH) {\n        return `${value.substring(0, DESCRIBE_BODY_MAX_LENGTH)}… (truncated)`;\n    }\n\n    return value;\n}\n\nfunction describeCauseLink(input: object): string {\n    const error = input as Error;\n    const name = typeof error.name === 'string' ? error.name : 'Error';\n    const parts: string[] = [`${name}: ${error.message}`];\n\n    const details: string[] = [];\n    for (const key of DESCRIBE_CAUSE_KEYS) {\n        const value = (input as Record<string, unknown>)[key];\n        if (typeof value === 'string' || typeof value === 'number') {\n            details.push(`${key}=${value}`);\n        }\n    }\n\n    if (details.length > 0) {\n        parts.push(`(${details.join(' ')})`);\n    }\n\n    return parts.join(' ');\n}\n\nfunction describeCauseChain(input: unknown): string | undefined {\n    const links: string[] = [];\n    const seen = new Set<unknown>();\n\n    let current: unknown = isObject(input) ? (input as { cause?: unknown }).cause : undefined;\n\n    while (isObject(current) && !seen.has(current) && links.length < DESCRIBE_CAUSE_MAX_DEPTH) {\n        seen.add(current);\n        links.push(describeCauseLink(current));\n        current = (current as { cause?: unknown }).cause;\n    }\n\n    if (links.length === 0) {\n        return undefined;\n    }\n\n    return links.join(' <- ');\n}\n\n/**\n * Render an error for the LOG. It is the counterpart of `@authup/errors`'\n * `serializeError`, which renders one for the response.\n *\n * The detail an outbound failure carries never survives `sanitizeError`\n * (by design: upstream internals must not reach the caller), and\n * `Error.cause` is non-enumerable, so a plain serialization drops it too.\n * Both were therefore already gone by the time anything was written,\n * which left a refused connection and an upstream `invalid_request`\n * indistinguishable in the log.\n *\n * Everything not present is omitted, so an ordinary error still renders\n * as its bare message.\n */\nexport function describeError(input: unknown, headline?: string): string {\n    const error = normalizeError(input);\n\n    const lines: string[] = [];\n    if (headline) {\n        lines.push(headline);\n    }\n    lines.push(error.message);\n\n    // hapic attaches the decoded body to the response through a getter, so\n    // it is non-enumerable and only reachable by an explicit read.\n    if (isClientError(error) && error.response) {\n        lines.push(`  upstream status: ${error.response.status}`);\n\n        const body = describeBody(error.response.data);\n        if (body) {\n            lines.push(`  upstream body:   ${body}`);\n        }\n    }\n\n    const causes = describeCauseChain(error);\n    if (causes) {\n        lines.push(`  cause:           ${causes}`);\n    }\n\n    if (error.stack) {\n        lines.push(`  stack:           ${error.stack}`);\n    }\n\n    return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAoCA,SAAgBe,cAAcC,OAAc;CACxC,IAAIb,cAAca,KAAAA,GACd,OAAOA;CAGX,IAAIA,iBAAiBP,2BACjB,OAAO,IAAIT,YAAY;EACnBiB,MAAMhB,UAAUiB;EAChBC,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIT,eAAeK,KAAAA,GAAQ;EACvB,MAAMK,QAAQL,MAAMM,OAAOC,KAAKC,UAAUZ,cAAcY,MAAMC,IAAI,CAAA;EAClE,MAAMC,QAAQ,IAAI1B,YAAY;GAC1BiB,MAAMhB,UAAU0B;GAChBP,OAAOJ,MAAMI;GACbD,SAASH,MAAMG,WAAWT,+BAA+BW,KAAAA;EAC7D,CAAA;EAEAK,MAAMJ,OAAOM,KAAI,GAAIZ,MAAMM,MAAM;EACjC,OAAOI;CACX;CAEA,IAAIV,iBAAiBR,cAAcQ,iBAAiBT,YAChD,OAAO,IAAIP,YAAY;EACnBiB,MAAMhB,UAAU0B;EAChBR,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;;;;;;;;;;;;IAeJ,IAAId,cAAcU,KAAAA,GACd,OAAO,IAAIhB,YAAY;EACnBiB,MAAMhB,UAAU4B;EAChBV,SAAS;EACTC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIf,YAAYW,KAAAA,GACZ,OAAO,IAAIhB,YAAY;EACnBiB,MAAMf,mBAAmBc,MAAMc,MAAM;EACrCX,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIN,SAASE,KAAAA,GAAQ;;;KASjB,QARaH,eAAeG,OAAO,MAAA,KACnC,OAAOA,MAAMC,SAAS,WAClBD,MAAMC,OACNc,KAAAA,GAKJ;GACI,KAAK;GACL,KAAK;GACL,KAAK,4BACD,OAAO,IAAI/B,YAAY;IACnBiB,MAAMhB,UAAU+B;IAChBb,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;GAEJ,KAAK,gBACD,OAAO,IAAIpB,YAAY;IACnBiB,MAAMhB,UAAUgC;IAChBd,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;EACR;EAEA,OAAO,IAAIpB,YAAY;GACnBiB,MAAMhB,UAAUiC;GAChBf,SAASH,MAAMG;GACfC,OAAOJ,MAAMI;EACjB,CAAA;CACJ;CAEA,OAAO,IAAIpB,YAAY,EAAEiB,MAAMhB,UAAUiC,eAAe,CAAA;AAC5D;AAEA,MAAMC,2BAA2B;AACjC,MAAMC,2BAA2B;AAIjC,MAAMC,sBAAsB;CAAC;CAAQ;CAAS;CAAW;CAAW;AAAO;AAE3E,SAASC,aAAatB,OAAc;CAChC,IAAIuB;CAEJ,IAAI,OAAOvB,UAAU,UACjBuB,QAAQvB;MAER,IAAI;EACAuB,QAAQC,KAAKC,UAAUzB,KAAAA,KAAU0B,OAAO1B,KAAAA;CAC5C,QAAQ;EAGJuB,QAAQI,OAAOC,UAAUC,SAASC,KAAK9B,KAAAA;CAC3C;CAGJ,IAAIuB,MAAMQ,WAAW,GACjB;CAGJ,IAAIR,MAAMQ,SAASZ,0BACf,OAAO,GAAGI,MAAMS,UAAU,GAAGb,wBAAAA,EAA0B;CAG3D,OAAOI;AACX;AAEA,SAASU,kBAAkBjC,OAAa;CACpC,MAAMU,QAAQV;CAEd,MAAMmC,QAAkB,CAAC,GADZ,OAAOzB,MAAMwB,SAAS,WAAWxB,MAAMwB,OAAO,QAC1B,IAAIxB,MAAMP,SAAU;CAErD,MAAMiC,UAAoB,CAAA;CAC1B,KAAK,MAAMC,OAAOhB,qBAAqB;EACnC,MAAME,QAAQ,MAAmCc;EACjD,IAAI,OAAOd,UAAU,YAAY,OAAOA,UAAU,UAC9Ca,QAAQxB,KAAK,GAAGyB,IAAI,GAAGd,OAAO;CAEtC;CAEA,IAAIa,QAAQL,SAAS,GACjBI,MAAMvB,KAAK,IAAIwB,QAAQE,KAAK,GAAA,EAAK,EAAE;CAGvC,OAAOH,MAAMG,KAAK,GAAA;AACtB;AAEA,SAASC,mBAAmBvC,OAAc;CACtC,MAAMwC,QAAkB,CAAA;CACxB,MAAMC,uBAAO,IAAIC,IAAAA;CAEjB,IAAIC,UAAmB7C,SAASE,KAAAA,IAAS,MAA+B4C,QAAQ7B,KAAAA;CAEhF,OAAOjB,SAAS6C,OAAAA,KAAY,CAACF,KAAKI,IAAIF,OAAAA,KAAYH,MAAMT,SAASX,0BAA0B;EACvFqB,KAAKK,IAAIH,OAAAA;EACTH,MAAM5B,KAAKqB,kBAAkBU,OAAAA,CAAAA;EAC7BA,UAAU,QAAiCC;CAC/C;CAEA,IAAIJ,MAAMT,WAAW,GACjB;CAGJ,OAAOS,MAAMF,KAAK,MAAA;AACtB;;;;;;;;;;;;;;GAgBA,SAAgBS,cAAc/C,OAAgBgD,UAAiB;CAC3D,MAAMtC,QAAQtB,eAAeY,KAAAA;CAE7B,MAAMiD,QAAkB,CAAA;CACxB,IAAID,UACAC,MAAMrC,KAAKoC,QAAAA;CAEfC,MAAMrC,KAAKF,MAAMP,OAAO;CAIxB,IAAIb,cAAcoB,KAAAA,KAAUA,MAAMwC,UAAU;EACxCD,MAAMrC,KAAK,sBAAsBF,MAAMwC,SAASpC,QAAQ;EAExD,MAAMqC,OAAO7B,aAAaZ,MAAMwC,SAASE,IAAI;EAC7C,IAAID,MACAF,MAAMrC,KAAK,sBAAsBuC,MAAM;CAE/C;CAEA,MAAME,SAASd,mBAAmB7B,KAAAA;CAClC,IAAI2C,QACAJ,MAAMrC,KAAK,sBAAsByC,QAAQ;CAG7C,IAAI3C,MAAMN,OACN6C,MAAMrC,KAAK,sBAAsBF,MAAMN,OAAO;CAGlD,OAAO6C,MAAMX,KAAK,IAAA;AACtB"}
+{"version":3,"file":"error.mjs","names":["AuthupError","ErrorCode","codeFromHttpStatus","isAuthupError","normalizeError","isHTTPError","isClientError","CodecError","ParseError","EntityRelationLookupError","buildErrorMessageForAttributes","isValidupError","stringifyPath","hasOwnProperty","isObject","sanitizeError","input","code","ENTITY_RELATION_INVALID","message","stack","paths","issues","map","issue","path","BAD_REQUEST","UPSTREAM_ERROR","status","undefined","ENTITY_CONFLICT","STORAGE_INSUFFICIENT","INTERNAL_ERROR","DESCRIBE_BODY_MAX_LENGTH","DESCRIBE_CAUSE_MAX_DEPTH","DESCRIBE_CAUSE_KEYS","describeBody","value","JSON","stringify","String","Object","prototype","toString","call","length","substring","describeCauseLink","error","name","parts","details","key","push","join","describeCauseChain","links","seen","Set","current","cause","has","add","describeError","headline","lines","response","body","data","causes"],"sources":["../../src/utils/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AuthupError,\n    ErrorCode,\n    codeFromHttpStatus,\n    isAuthupError,\n    normalizeError,\n} from '@authup/errors';\nimport { isHTTPError } from '@ebec/http';\nimport { isClientError } from 'hapic';\nimport { CodecError, ParseError } from '@rapiq/core';\nimport { EntityRelationLookupError } from 'typeorm-extension';\nimport { buildErrorMessageForAttributes, isValidupError, stringifyPath } from 'validup';\nimport { hasOwnProperty, isObject } from '@authup/kit';\n\n/**\n * Normalize an unknown error to an AuthupError. Recognised shapes:\n *\n * 1. AuthupError instance              → returned as-is\n * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError\n * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues\n * 4. rapiq ParseError / CodecError     → BAD_REQUEST AuthupError (client wire query)\n * 5. hapic ClientError                 → UPSTREAM_ERROR AuthupError (outbound call)\n * 6. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code\n * 7. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT\n * 8. anything else                     → INTERNAL_ERROR AuthupError\n *\n * The HTTP-status concern is handled separately by `httpStatusFromCode` in\n * the adapter — this function only assigns a semantic `code`.\n */\nexport function sanitizeError(input: unknown): AuthupError {\n    if (isAuthupError(input)) {\n        return input;\n    }\n\n    if (input instanceof EntityRelationLookupError) {\n        return new AuthupError({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isValidupError(input)) {\n        const paths = input.issues.map((issue) => stringifyPath(issue.path));\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            stack: input.stack,\n            message: input.message || buildErrorMessageForAttributes(paths),\n            issues: input.issues,\n        });\n    }\n\n    if (input instanceof ParseError || input instanceof CodecError) {\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    /**\n     * An outbound call failed. This branch MUST precede the `isHTTPError`\n     * one below: a hapic `HttpResponseError` extends `BaseError` and carries\n     * the upstream `status`, so the duck guard matches it and would mirror\n     * that status onto our own response. An upstream 400 would then read as\n     * \"your request was malformed\" when the caller's request was fine.\n     *\n     * The message is deliberately dropped rather than forwarded: hapic\n     * embeds the outbound method and URL in it (`400 Bad Request (POST\n     * https://idp.example.com/token)`), which must not reach the caller.\n     * `describeError` is what carries the detail, into the log only.\n     */\n    if (isClientError(input)) {\n        return new AuthupError({\n            code: ErrorCode.UPSTREAM_ERROR,\n            message: 'A request to an upstream service failed.',\n            stack: input.stack,\n        });\n    }\n\n    if (isHTTPError(input)) {\n        return new AuthupError({\n            code: codeFromHttpStatus(input.status),\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isObject(input)) {\n        const code = hasOwnProperty(input, 'code') &&\n        typeof input.code === 'string' ?\n            input.code :\n            undefined;\n\n        /**\n         * @see https://dev.mysql.com/doc/mysql-errors/8.0/en/server-error-reference.html\n         */\n        switch (code) {\n            case '23505':\n            case 'ER_DUP_ENTRY':\n            case 'SQLITE_CONSTRAINT_UNIQUE': {\n                return new AuthupError({\n                    code: ErrorCode.ENTITY_CONFLICT,\n                    message: 'An entry with some unique attributes already exists.',\n                    stack: input.stack as string | undefined,\n                });\n            }\n            case 'ER_DISK_FULL':\n                return new AuthupError({\n                    code: ErrorCode.STORAGE_INSUFFICIENT,\n                    message: 'No database operation possible, due to the lack of free disk space.',\n                    stack: input.stack as string | undefined,\n                });\n        }\n\n        return new AuthupError({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: input.message as string | undefined,\n            stack: input.stack as string | undefined,\n        });\n    }\n\n    return new AuthupError({ code: ErrorCode.INTERNAL_ERROR });\n}\n\nconst DESCRIBE_BODY_MAX_LENGTH = 1024;\nconst DESCRIBE_CAUSE_MAX_DEPTH = 5;\n\n// Fields node attaches to a syscall error. Without them a transport failure\n// reads as a bare \"connect ECONNREFUSED\" with no way back to the reason.\nconst DESCRIBE_CAUSE_KEYS = ['code', 'errno', 'syscall', 'address', 'port'] as const;\n\nfunction describeBody(input: unknown): string | undefined {\n    let value: string;\n\n    if (typeof input === 'string') {\n        value = input;\n    } else {\n        try {\n            value = JSON.stringify(input) ?? String(input);\n        } catch {\n            // A body that cannot be serialized (circular, a stream) is\n            // still worth naming by shape.\n            value = Object.prototype.toString.call(input);\n        }\n    }\n\n    if (value.length === 0) {\n        return undefined;\n    }\n\n    if (value.length > DESCRIBE_BODY_MAX_LENGTH) {\n        return `${value.substring(0, DESCRIBE_BODY_MAX_LENGTH)}… (truncated)`;\n    }\n\n    return value;\n}\n\nfunction describeCauseLink(input: object): string {\n    const error = input as Error;\n    const name = typeof error.name === 'string' ? error.name : 'Error';\n    const parts: string[] = [`${name}: ${error.message}`];\n\n    const details: string[] = [];\n    for (const key of DESCRIBE_CAUSE_KEYS) {\n        const value = (input as Record<string, unknown>)[key];\n        if (typeof value === 'string' || typeof value === 'number') {\n            details.push(`${key}=${value}`);\n        }\n    }\n\n    if (details.length > 0) {\n        parts.push(`(${details.join(' ')})`);\n    }\n\n    return parts.join(' ');\n}\n\nfunction describeCauseChain(input: unknown): string | undefined {\n    const links: string[] = [];\n    const seen = new Set<unknown>();\n\n    let current: unknown = isObject(input) ? (input as { cause?: unknown }).cause : undefined;\n\n    while (isObject(current) && !seen.has(current) && links.length < DESCRIBE_CAUSE_MAX_DEPTH) {\n        seen.add(current);\n        links.push(describeCauseLink(current));\n        current = (current as { cause?: unknown }).cause;\n    }\n\n    if (links.length === 0) {\n        return undefined;\n    }\n\n    return links.join(' <- ');\n}\n\n/**\n * Render an error for the LOG. It is the counterpart of `@authup/errors`'\n * `serializeError`, which renders one for the response.\n *\n * The detail an outbound failure carries never survives `sanitizeError`\n * (by design: upstream internals must not reach the caller), and\n * `Error.cause` is non-enumerable, so a plain serialization drops it too.\n * Both were therefore already gone by the time anything was written,\n * which left a refused connection and an upstream `invalid_request`\n * indistinguishable in the log.\n *\n * Everything not present is omitted, so an ordinary error still renders\n * as its bare message.\n */\nexport function describeError(input: unknown, headline?: string): string {\n    const error = normalizeError(input);\n\n    const lines: string[] = [];\n    if (headline) {\n        lines.push(headline);\n    }\n    lines.push(error.message);\n\n    // hapic attaches the decoded body to the response through a getter, so\n    // it is non-enumerable and only reachable by an explicit read.\n    if (isClientError(error) && error.response) {\n        lines.push(`  upstream status: ${error.response.status}`);\n\n        const body = describeBody(error.response.data);\n        if (body) {\n            lines.push(`  upstream body:   ${body}`);\n        }\n    }\n\n    const causes = describeCauseChain(error);\n    if (causes) {\n        lines.push(`  cause:           ${causes}`);\n    }\n\n    if (error.stack) {\n        lines.push(`  stack:           ${error.stack}`);\n    }\n\n    return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAoCA,SAAgBe,cAAcC,OAAc;CACxC,IAAIb,cAAca,KAAAA,GACd,OAAOA;CAGX,IAAIA,iBAAiBP,2BACjB,OAAO,IAAIT,YAAY;EACnBiB,MAAMhB,UAAUiB;EAChBC,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIT,eAAeK,KAAAA,GAAQ;EACvB,MAAMK,QAAQL,MAAMM,OAAOC,KAAKC,UAAUZ,cAAcY,MAAMC,IAAI,CAAA;EAClE,OAAO,IAAIzB,YAAY;GACnBiB,MAAMhB,UAAUyB;GAChBN,OAAOJ,MAAMI;GACbD,SAASH,MAAMG,WAAWT,+BAA+BW,KAAAA;GACzDC,QAAQN,MAAMM;EAClB,CAAA;CACJ;CAEA,IAAIN,iBAAiBR,cAAcQ,iBAAiBT,YAChD,OAAO,IAAIP,YAAY;EACnBiB,MAAMhB,UAAUyB;EAChBP,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;;;;;;;;;;;;IAeJ,IAAId,cAAcU,KAAAA,GACd,OAAO,IAAIhB,YAAY;EACnBiB,MAAMhB,UAAU0B;EAChBR,SAAS;EACTC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIf,YAAYW,KAAAA,GACZ,OAAO,IAAIhB,YAAY;EACnBiB,MAAMf,mBAAmBc,MAAMY,MAAM;EACrCT,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIN,SAASE,KAAAA,GAAQ;;;KASjB,QARaH,eAAeG,OAAO,MAAA,KACnC,OAAOA,MAAMC,SAAS,WAClBD,MAAMC,OACNY,KAAAA,GAKJ;GACI,KAAK;GACL,KAAK;GACL,KAAK,4BACD,OAAO,IAAI7B,YAAY;IACnBiB,MAAMhB,UAAU6B;IAChBX,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;GAEJ,KAAK,gBACD,OAAO,IAAIpB,YAAY;IACnBiB,MAAMhB,UAAU8B;IAChBZ,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;EACR;EAEA,OAAO,IAAIpB,YAAY;GACnBiB,MAAMhB,UAAU+B;GAChBb,SAASH,MAAMG;GACfC,OAAOJ,MAAMI;EACjB,CAAA;CACJ;CAEA,OAAO,IAAIpB,YAAY,EAAEiB,MAAMhB,UAAU+B,eAAe,CAAA;AAC5D;AAEA,MAAMC,2BAA2B;AACjC,MAAMC,2BAA2B;AAIjC,MAAMC,sBAAsB;CAAC;CAAQ;CAAS;CAAW;CAAW;AAAO;AAE3E,SAASC,aAAapB,OAAc;CAChC,IAAIqB;CAEJ,IAAI,OAAOrB,UAAU,UACjBqB,QAAQrB;MAER,IAAI;EACAqB,QAAQC,KAAKC,UAAUvB,KAAAA,KAAUwB,OAAOxB,KAAAA;CAC5C,QAAQ;EAGJqB,QAAQI,OAAOC,UAAUC,SAASC,KAAK5B,KAAAA;CAC3C;CAGJ,IAAIqB,MAAMQ,WAAW,GACjB;CAGJ,IAAIR,MAAMQ,SAASZ,0BACf,OAAO,GAAGI,MAAMS,UAAU,GAAGb,wBAAAA,EAA0B;CAG3D,OAAOI;AACX;AAEA,SAASU,kBAAkB/B,OAAa;CACpC,MAAMgC,QAAQhC;CAEd,MAAMkC,QAAkB,CAAC,GADZ,OAAOF,MAAMC,SAAS,WAAWD,MAAMC,OAAO,QAC1B,IAAID,MAAM7B,SAAU;CAErD,MAAMgC,UAAoB,CAAA;CAC1B,KAAK,MAAMC,OAAOjB,qBAAqB;EACnC,MAAME,QAAQ,MAAmCe;EACjD,IAAI,OAAOf,UAAU,YAAY,OAAOA,UAAU,UAC9Cc,QAAQE,KAAK,GAAGD,IAAI,GAAGf,OAAO;CAEtC;CAEA,IAAIc,QAAQN,SAAS,GACjBK,MAAMG,KAAK,IAAIF,QAAQG,KAAK,GAAA,EAAK,EAAE;CAGvC,OAAOJ,MAAMI,KAAK,GAAA;AACtB;AAEA,SAASC,mBAAmBvC,OAAc;CACtC,MAAMwC,QAAkB,CAAA;CACxB,MAAMC,uBAAO,IAAIC,IAAAA;CAEjB,IAAIC,UAAmB7C,SAASE,KAAAA,IAAS,MAA+B4C,QAAQ/B,KAAAA;CAEhF,OAAOf,SAAS6C,OAAAA,KAAY,CAACF,KAAKI,IAAIF,OAAAA,KAAYH,MAAMX,SAASX,0BAA0B;EACvFuB,KAAKK,IAAIH,OAAAA;EACTH,MAAMH,KAAKN,kBAAkBY,OAAAA,CAAAA;EAC7BA,UAAU,QAAiCC;CAC/C;CAEA,IAAIJ,MAAMX,WAAW,GACjB;CAGJ,OAAOW,MAAMF,KAAK,MAAA;AACtB;;;;;;;;;;;;;;GAgBA,SAAgBS,cAAc/C,OAAgBgD,UAAiB;CAC3D,MAAMhB,QAAQ5C,eAAeY,KAAAA;CAE7B,MAAMiD,QAAkB,CAAA;CACxB,IAAID,UACAC,MAAMZ,KAAKW,QAAAA;CAEfC,MAAMZ,KAAKL,MAAM7B,OAAO;CAIxB,IAAIb,cAAc0C,KAAAA,KAAUA,MAAMkB,UAAU;EACxCD,MAAMZ,KAAK,sBAAsBL,MAAMkB,SAAStC,QAAQ;EAExD,MAAMuC,OAAO/B,aAAaY,MAAMkB,SAASE,IAAI;EAC7C,IAAID,MACAF,MAAMZ,KAAK,sBAAsBc,MAAM;CAE/C;CAEA,MAAME,SAASd,mBAAmBP,KAAAA;CAClC,IAAIqB,QACAJ,MAAMZ,KAAK,sBAAsBgB,QAAQ;CAG7C,IAAIrB,MAAM5B,OACN6C,MAAMZ,KAAK,sBAAsBL,MAAM5B,OAAO;CAGlD,OAAO6C,MAAMX,KAAK,IAAA;AACtB"}