@authup/server-core 1.0.0-beta.61 → 1.0.0-beta.62

package/dist/core/oauth2/federated-login/types.d.ts

@@ -0,0 +1,138 @@
+import type { OAuth2AuthorizationCodeRequest, OAuth2IdentityProvider, OpenIDIdentityProvider, User } from '@authup/core-kit';
+import type { OAuth2ErrorCode } from '@authup/specs';
+import type { Logger } from '@authup/server-kit';
+import type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';
+import type { IOAuth2Authenticator } from '../../identity/provider/authentication/protocols/index.ts';
+import type { IEventService, IRealmRepository } from '../../entities/index.ts';
+import type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';
+import type { IOAuth2AuthorizationCodeIssuer, IOAuth2AuthorizationCodeRequestVerifier } from '../authorization/index.ts';
+export type OAuth2FederatedLoginCompleteInput = {
+    /**
+     * The provider the callback belongs to, already resolved and
+     * protocol-checked by the caller.
+     */
+    provider: OAuth2IdentityProvider | OpenIDIdentityProvider;
+    /**
+     * The RP's original authorization request, as `authorize-out` stored
+     * it on the state blob. It is re-verified here rather than trusted.
+     */
+    codeRequest: OAuth2AuthorizationCodeRequest;
+    /**
+     * The provider's single-use authorization code.
+     */
+    code: string;
+    request?: {
+        ipAddress?: string | null;
+        userAgent?: string | null;
+    };
+};
+/**
+ * Why a completion was refused. Every value is a REFUSAL — a decision the
+ * person at the browser has to be told about on the hosted login page —
+ * never a server failure, which keeps throwing.
+ */
+export declare enum OAuth2FederatedLoginRefusal {
+    /**
+     * The stored code request no longer verifies (client deactivated or
+     * unknown, grant allowlist, scopes, redirect_uri mismatch). The hosted
+     * page re-runs the same verifier and renders the same refusal, so
+     * nothing is echoed and the bounce carries no marker.
+     */
+    CODE_REQUEST = "codeRequest",
+    /**
+     * The provider was disabled while the person was away at it.
+     */
+    PROVIDER_DISABLED = "providerDisabled",
+    /**
+     * The linked local user is inactive. The local login path refuses one
+     * too, and a federated login must not be the way around that.
+     */
+    USER_INACTIVE = "userInactive",
+    /**
+     * The client's access policy denied the identity (plan 052).
+     */
+    ACCESS_DENIED = "accessDenied"
+}
+export type OAuth2FederatedLoginRefusedResult = {
+    kind: 'refused';
+    refusal: OAuth2FederatedLoginRefusal;
+    /**
+     * The marker the hosted authorize page maps onto its own copy, when
+     * the refusal has one. Absent means "render the request again", which
+     * re-runs the verifier and states the reason itself.
+     */
+    error?: `${OAuth2ErrorCode}`;
+    /**
+     * The request to re-render. The verified copy when re-verification got
+     * that far, else the stored one.
+     */
+    codeRequest: OAuth2AuthorizationCodeRequest;
+};
+export type OAuth2FederatedLoginIssuedResult = {
+    kind: 'issued';
+    /**
+     * The verified redirect target of the RP. Its scheme passed
+     * `isSafeRedirectURLScheme`, so a caller may navigate it.
+     */
+    redirectUri: string;
+    /**
+     * The authorization code id the RP redeems at `/token`.
+     */
+    code: string;
+    state?: string;
+    /**
+     * The verified request, for a caller that has to re-render the hosted
+     * page alongside the redirect (the custom-scheme interstitial).
+     */
+    codeRequest: OAuth2AuthorizationCodeRequest;
+    client: {
+        id: string;
+        name: string;
+        displayName: string | null;
+    };
+};
+export type OAuth2FederatedLoginCompleteResult = OAuth2FederatedLoginRefusedResult | OAuth2FederatedLoginIssuedResult;
+/**
+ * Completes the RP's original authorization request after an external
+ * provider sent the browser back (issue #3446). It owns the refusal ladder
+ * — realm match, code-request re-verification, redirect-scheme gate,
+ * provider and user state, access policy — and mints the authup code.
+ *
+ * Deliberately transport-free: it decides WHAT the answer is, and returns
+ * it as a discriminated result. The adapter decides how that answer
+ * reaches the browser (a redirect, or the interstitial page a custom
+ * scheme needs), because only the adapter knows the difference.
+ */
+export interface IOAuth2FederatedLoginService {
+    complete(input: OAuth2FederatedLoginCompleteInput): Promise<OAuth2FederatedLoginCompleteResult>;
+}
+export type OAuth2FederatedLoginServiceOptions = {
+    /**
+     * The public base URL. Reaches the provider authenticator, which
+     * builds the callback URL the external token exchange must repeat.
+     */
+    baseURL: string;
+};
+/**
+ * Builds the authenticator that exchanges the provider's code. Injected
+ * rather than constructed inline so the refusal ladder can be exercised
+ * without an external provider; it defaults to the real preset/protocol
+ * factory.
+ */
+export type OAuth2FederatedLoginAuthenticatorFactory = (provider: OAuth2IdentityProvider | OpenIDIdentityProvider, options: {
+    baseURL: string;
+    clientId?: string;
+    logger?: Logger;
+}) => IOAuth2Authenticator<User>;
+export type OAuth2FederatedLoginServiceContext = {
+    options: OAuth2FederatedLoginServiceOptions;
+    accountManager: IIdentityProviderAccountManager;
+    realmRepository: IRealmRepository;
+    codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier;
+    codeIssuer: IOAuth2AuthorizationCodeIssuer;
+    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator;
+    eventService?: IEventService;
+    logger?: Logger;
+    authenticatorFactory?: OAuth2FederatedLoginAuthenticatorFactory;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/federated-login/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/federated-login/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,IAAI,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EACR,8BAA8B,EAC9B,uCAAuC,EAC1C,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,iCAAiC,GAAG;IAC5C;;;OAGG;IACH,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,CAAC;IAC1D;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;IAC5C;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF;;;;GAIG;AACH,oBAAY,2BAA2B;IACnC;;;;;OAKG;IACH,YAAY,gBAAgB;IAC5B;;OAEG;IACH,iBAAiB,qBAAqB;IACtC;;;OAGG;IACH,aAAa,iBAAiB;IAC9B;;OAEG;IACH,aAAa,iBAAiB;CACjC;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC5C,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,2BAA2B,CAAC;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,GAAG,eAAe,EAAE,CAAC;IAC7B;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC3C,IAAI,EAAE,QAAQ,CAAC;IACf;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,EAAE,8BAA8B,CAAC;IAC5C,MAAM,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAM,iCAAiC,GACjF,gCAAgC,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,4BAA4B;IACzC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,GAAI,OAAO,CAAC,kCAAkC,CAAC,CAAC;CACpG;AAED,MAAM,MAAM,kCAAkC,GAAG;IAC7C;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,wCAAwC,GAAG,CACnD,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,EACzD,OAAO,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,KACA,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAEhC,MAAM,MAAM,kCAAkC,GAAG;IAC7C,OAAO,EAAE,kCAAkC,CAAC;IAE5C,cAAc,EAAE,+BAA+B,CAAC;IAChD,eAAe,EAAE,gBAAgB,CAAC;IAClC,mBAAmB,EAAE,uCAAuC,CAAC;IAC7D,UAAU,EAAE,8BAA8B,CAAC;IAE3C,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IACrD,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,wCAAwC,CAAC;CACnE,CAAC"}

package/dist/core/oauth2/federated-login/types.mjs

@@ -0,0 +1,31 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/federated-login/types.ts
+/**
+* Why a completion was refused. Every value is a REFUSAL — a decision the
+* person at the browser has to be told about on the hosted login page —
+* never a server failure, which keeps throwing.
+*/ var OAuth2FederatedLoginRefusal = /*#__PURE__*/ function(OAuth2FederatedLoginRefusal) {
+	/**
+	* The stored code request no longer verifies (client deactivated or
+	* unknown, grant allowlist, scopes, redirect_uri mismatch). The hosted
+	* page re-runs the same verifier and renders the same refusal, so
+	* nothing is echoed and the bounce carries no marker.
+	*/ OAuth2FederatedLoginRefusal["CODE_REQUEST"] = "codeRequest";
+	/**
+	* The provider was disabled while the person was away at it.
+	*/ OAuth2FederatedLoginRefusal["PROVIDER_DISABLED"] = "providerDisabled";
+	/**
+	* The linked local user is inactive. The local login path refuses one
+	* too, and a federated login must not be the way around that.
+	*/ OAuth2FederatedLoginRefusal["USER_INACTIVE"] = "userInactive";
+	/**
+	* The client's access policy denied the identity (plan 052).
+	*/ OAuth2FederatedLoginRefusal["ACCESS_DENIED"] = "accessDenied";
+	return OAuth2FederatedLoginRefusal;
+}({});
+//#endregion
+export { OAuth2FederatedLoginRefusal };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/oauth2/federated-login/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["OAuth2FederatedLoginRefusal"],"sources":["../../../../src/core/oauth2/federated-login/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    OAuth2AuthorizationCodeRequest,\n    OAuth2IdentityProvider,\n    OpenIDIdentityProvider, \n    User, \n} from '@authup/core-kit';\nimport type { OAuth2ErrorCode } from '@authup/specs';\nimport type { Logger } from '@authup/server-kit';\nimport type { IIdentityProviderAccountManager } from '../../identity/provider/account/types.ts';\nimport type { IOAuth2Authenticator } from '../../identity/provider/authentication/protocols/index.ts';\nimport type { IEventService, IRealmRepository } from '../../entities/index.ts';\nimport type { IOAuth2AccessPolicyEvaluator } from '../access-policy/index.ts';\nimport type {\n    IOAuth2AuthorizationCodeIssuer,\n    IOAuth2AuthorizationCodeRequestVerifier,\n} from '../authorization/index.ts';\n\nexport type OAuth2FederatedLoginCompleteInput = {\n    /**\n     * The provider the callback belongs to, already resolved and\n     * protocol-checked by the caller.\n     */\n    provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n    /**\n     * The RP's original authorization request, as `authorize-out` stored\n     * it on the state blob. It is re-verified here rather than trusted.\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n    /**\n     * The provider's single-use authorization code.\n     */\n    code: string,\n    request?: {\n        ipAddress?: string | null,\n        userAgent?: string | null,\n    },\n};\n\n/**\n * Why a completion was refused. Every value is a REFUSAL — a decision the\n * person at the browser has to be told about on the hosted login page —\n * never a server failure, which keeps throwing.\n */\nexport enum OAuth2FederatedLoginRefusal {\n    /**\n     * The stored code request no longer verifies (client deactivated or\n     * unknown, grant allowlist, scopes, redirect_uri mismatch). The hosted\n     * page re-runs the same verifier and renders the same refusal, so\n     * nothing is echoed and the bounce carries no marker.\n     */\n    CODE_REQUEST = 'codeRequest',\n    /**\n     * The provider was disabled while the person was away at it.\n     */\n    PROVIDER_DISABLED = 'providerDisabled',\n    /**\n     * The linked local user is inactive. The local login path refuses one\n     * too, and a federated login must not be the way around that.\n     */\n    USER_INACTIVE = 'userInactive',\n    /**\n     * The client's access policy denied the identity (plan 052).\n     */\n    ACCESS_DENIED = 'accessDenied',\n}\n\nexport type OAuth2FederatedLoginRefusedResult = {\n    kind: 'refused',\n    refusal: OAuth2FederatedLoginRefusal,\n    /**\n     * The marker the hosted authorize page maps onto its own copy, when\n     * the refusal has one. Absent means \"render the request again\", which\n     * re-runs the verifier and states the reason itself.\n     */\n    error?: `${OAuth2ErrorCode}`,\n    /**\n     * The request to re-render. The verified copy when re-verification got\n     * that far, else the stored one.\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n};\n\nexport type OAuth2FederatedLoginIssuedResult = {\n    kind: 'issued',\n    /**\n     * The verified redirect target of the RP. Its scheme passed\n     * `isSafeRedirectURLScheme`, so a caller may navigate it.\n     */\n    redirectUri: string,\n    /**\n     * The authorization code id the RP redeems at `/token`.\n     */\n    code: string,\n    state?: string,\n    /**\n     * The verified request, for a caller that has to re-render the hosted\n     * page alongside the redirect (the custom-scheme interstitial).\n     */\n    codeRequest: OAuth2AuthorizationCodeRequest,\n    client: {\n        id: string,\n        name: string,\n        displayName: string | null,\n    },\n};\n\nexport type OAuth2FederatedLoginCompleteResult =    OAuth2FederatedLoginRefusedResult |\n    OAuth2FederatedLoginIssuedResult;\n\n/**\n * Completes the RP's original authorization request after an external\n * provider sent the browser back (issue #3446). It owns the refusal ladder\n * — realm match, code-request re-verification, redirect-scheme gate,\n * provider and user state, access policy — and mints the authup code.\n *\n * Deliberately transport-free: it decides WHAT the answer is, and returns\n * it as a discriminated result. The adapter decides how that answer\n * reaches the browser (a redirect, or the interstitial page a custom\n * scheme needs), because only the adapter knows the difference.\n */\nexport interface IOAuth2FederatedLoginService {\n    complete(input: OAuth2FederatedLoginCompleteInput) : Promise<OAuth2FederatedLoginCompleteResult>;\n}\n\nexport type OAuth2FederatedLoginServiceOptions = {\n    /**\n     * The public base URL. Reaches the provider authenticator, which\n     * builds the callback URL the external token exchange must repeat.\n     */\n    baseURL: string,\n};\n\n/**\n * Builds the authenticator that exchanges the provider's code. Injected\n * rather than constructed inline so the refusal ladder can be exercised\n * without an external provider; it defaults to the real preset/protocol\n * factory.\n */\nexport type OAuth2FederatedLoginAuthenticatorFactory = (\n    provider: OAuth2IdentityProvider | OpenIDIdentityProvider,\n    options: {\n        baseURL: string, \n        clientId?: string, \n        logger?: Logger \n    },\n) => IOAuth2Authenticator<User>;\n\nexport type OAuth2FederatedLoginServiceContext = {\n    options: OAuth2FederatedLoginServiceOptions,\n\n    accountManager: IIdentityProviderAccountManager,\n    realmRepository: IRealmRepository,\n    codeRequestVerifier: IOAuth2AuthorizationCodeRequestVerifier,\n    codeIssuer: IOAuth2AuthorizationCodeIssuer,\n\n    accessPolicyEvaluator?: IOAuth2AccessPolicyEvaluator,\n    eventService?: IEventService,\n    logger?: Logger,\n    authenticatorFactory?: OAuth2FederatedLoginAuthenticatorFactory,\n};\n"],"mappings":";;;;;;;;GAkDA,IAAO,8BAAKA,uBAAAA,6BAAAA;;;;;;IAMP,4BAAA,kBAAA;;;IAIA,4BAAA,uBAAA;;;;IAKA,4BAAA,mBAAA;;;IAIA,4BAAA,mBAAA;CAnBOA,OAAAA;AAqBX,EAAA,CAAA,CAAA"}

package/dist/core/oauth2/index.d.ts

@@ -2,6 +2,7 @@ export * from './access-policy/index.ts';
 export * from './authorization/index.ts';
 export * from './client/index.ts';
 export * from './end-session/index.ts';
+export * from './federated-login/index.ts';
 export * from './grant-types/index.ts';
 export * from './mfa-login/index.ts';
 export * from './openid/index.ts';

package/dist/core/oauth2/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth2/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/core/oauth2/index.mjs

@@ -17,6 +17,9 @@ import "./authorization/index.mjs";
 import { OAuth2EndSessionService } from "./end-session/service.mjs";
 import { OAuth2EndSessionRequestValidator } from "./end-session/validator.mjs";
 import "./end-session/index.mjs";
+import { OAuth2FederatedLoginRefusal } from "./federated-login/types.mjs";
+import { OAuth2FederatedLoginService } from "./federated-login/module.mjs";
+import "./federated-login/index.mjs";
 import { buildOAuth2BearerTokenResponse } from "./response/bearer.mjs";
 import { OAuth2AuthorizeGrant } from "./grant-types/authorize.mjs";
 import { ClientCredentialsGrant } from "./grant-types/client-credentials.mjs";
@@ -40,4 +43,4 @@ import { OAuth2TokenRevoker } from "./token/revoker/module.mjs";
 import { OAuth2TokenSigner } from "./token/signer/module.mjs";
 import { OAuth2TokenVerifier } from "./token/verifier/module.mjs";
 import "./token/index.mjs";
-export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier, isSessionTokenRelationMissingError };
+export { ClientCredentialsGrant, IdentityGrantType, OAuth2AccessPolicyEvaluator, OAuth2AccessTokenIssuer, OAuth2Authorization, OAuth2AuthorizationCodeIssuer, OAuth2AuthorizationCodeRequestValidator, OAuth2AuthorizationCodeRequestVerifier, OAuth2AuthorizationCodeVerifier, OAuth2AuthorizationStateManager, OAuth2AuthorizeGrant, OAuth2ClientAuthenticator, OAuth2EndSessionRequestValidator, OAuth2EndSessionService, OAuth2FederatedLoginRefusal, OAuth2FederatedLoginService, OAuth2MfaLoginService, OAuth2MfaTokenIssuer, OAuth2OpenIDClaimsBuilder, OAuth2OpenIDTokenIssuer, OAuth2RefreshTokenGrant, OAuth2RefreshTokenIssuer, OAuth2ScopeAttributesResolver, OAuth2TokenRevoker, OAuth2TokenSigner, OAuth2TokenVerifier, PasswordGrantType, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, assertClientGrantAllowed, base64URLEncode, buildOAuth2BearerTokenResponse, buildOAuth2CodeChallenge, buildOAuth2TokenHash, deriveAmrAcr, generateOAuth2CodeVerifier, isSessionTokenRelationMissingError };

package/dist/core/provisioning/entities/policy/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,SAAS,EAAiC,MAAM,SAAS,CAAC;AAInE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,qBAAa,2BAA4B,SAAQ,SAAS,CAAC,wBAAwB,CAAC;IACjE,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,wBAAwB,CAAC,EAChD,OAAO,CAAC,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,GACxD,OAAO,CAAC,wBAAwB,CAAC;IAuBpC,SAAS,CAAC,UAAU;CAmBvB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAKlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,qBAAa,2BAA4B,SAAQ,SAAS,CAAC,wBAAwB,CAAC;IACjE,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,wBAAwB,CAAC,EAChD,OAAO,CAAC,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,GACxD,OAAO,CAAC,wBAAwB,CAAC;IAuBpC,SAAS,CAAC,UAAU;CAmBvB"}

package/dist/core/provisioning/entities/policy/validator.mjs

@@ -4,9 +4,10 @@ import.meta.url;
 import { ProvisioningStrategyValidator } from "../../strategy/validator.mjs";
 import "../../strategy/index.mjs";
 import { createProvisioningEntitiesValidator } from "../utils.mjs";
+import { defineIssueItem } from "../../../../node_modules/@ebec/core/dist/index.mjs";
 import { PolicyValidator } from "@authup/core-kit";
 import { BuiltInPolicyType } from "@authup/access";
-import { Container, ValidupError, defineIssueItem } from "validup";
+import { Container, ValidupError } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
 //#region src/core/provisioning/entities/policy/validator.ts

package/dist/core/provisioning/entities/policy/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validator.mjs","names":["BuiltInPolicyType","PolicyValidator","createValidator","Container","ValidupError","defineIssueItem","z","ProvisioningStrategyValidator","createProvisioningEntitiesValidator","PolicyProvisioningValidator","run","input","options","output","attributes","type","COMPOSITE","children","length","path","message","initialize","strategyValidator","mount","optional","attributesValidator","record","string","any","array","check"],"sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType } from '@authup/access';\nimport { PolicyValidator } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport type { ContainerInput, ContainerRunOptions } from 'validup';\nimport { Container, ValidupError, defineIssueItem } from 'validup';\nimport { z } from 'zod';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { PolicyProvisioningEntity } from './types.ts';\n\nexport class PolicyProvisioningValidator extends Container<PolicyProvisioningEntity> {\n    override async run(\n        input?: ContainerInput<PolicyProvisioningEntity>,\n        options?: ContainerRunOptions<PolicyProvisioningEntity>,\n    ): Promise<PolicyProvisioningEntity> {\n        const output = await super.run(input, options);\n\n        // A composite policy with no children can never be satisfied and makes\n        // any permission bound to it permanently un-grantable (#3304). Reject\n        // it up front so provisioning fails at config load with a clear\n        // message, rather than silently provisioning a \"stale\" permission that\n        // only fails — with an opaque empty-issue error — once evaluated.\n        if (\n            output.attributes?.type === BuiltInPolicyType.COMPOSITE &&\n            (!output.children || output.children.length === 0)\n        ) {\n            throw new ValidupError([\n                defineIssueItem({\n                    path: ['children'],\n                    message: 'A composite policy must define at least one child policy.',\n                }),\n            ]);\n        }\n\n        return output;\n    }\n\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new PolicyValidator();\n        this.mount('attributes', attributesValidator);\n\n        this.mount('extraAttributes', { optional: true }, createValidator(\n            z.record(z.string(), z.any()),\n        ));\n\n        this.mount('children', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(this)),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,IAAaS,8BAAb,cAAiDN,UAAAA;CAC7C,MAAeO,IACXC,OACAC,SACiC;EACjC,MAAMC,SAAS,MAAM,MAAMH,IAAIC,OAAOC,OAAAA;EAOtC,IACIC,OAAOC,YAAYC,SAASf,kBAAkBgB,cAC7C,CAACH,OAAOI,YAAYJ,OAAOI,SAASC,WAAW,IAEhD,MAAM,IAAId,aAAa,CACnBC,gBAAgB;GACZc,MAAM,CAAC,UAAW;GAClBC,SAAS;EACb,CAAA,CACH,CAAA;EAGL,OAAOP;CACX;CAEUQ,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIf,8BAAAA;EAC9B,KAAKgB,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIxB,gBAAAA;EAChC,KAAKsB,MAAM,cAAcE,mBAAAA;EAEzB,KAAKF,MAAM,mBAAmB,EAAEC,UAAU,KAAK,GAAGtB,gBAC9CI,EAAEoB,OAAOpB,EAAEqB,OAAM,GAAIrB,EAAEsB,IAAG,CAAA,CAAA,CAAA;EAG9B,KAAKL,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGtB,gBACvCI,EACKuB,MAAMvB,EAAEsB,IAAG,CAAA,CAAA,CACXE,MAAMtB,oCAAoC,IAAI,CAAA,CAAA,CAAA;CAE3D;AACJ"}
+{"version":3,"file":"validator.mjs","names":["BuiltInPolicyType","PolicyValidator","createValidator","Container","ValidupError","defineIssueItem","z","ProvisioningStrategyValidator","createProvisioningEntitiesValidator","PolicyProvisioningValidator","run","input","options","output","attributes","type","COMPOSITE","children","length","path","message","initialize","strategyValidator","mount","optional","attributesValidator","record","string","any","array","check"],"sources":["../../../../../src/core/provisioning/entities/policy/validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType } from '@authup/access';\nimport { PolicyValidator } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport type { ContainerInput, ContainerRunOptions } from 'validup';\nimport { Container, ValidupError } from 'validup';\nimport { defineIssueItem } from '@ebec/core';\nimport { z } from 'zod';\nimport { ProvisioningStrategyValidator } from '../../strategy/index.ts';\nimport { createProvisioningEntitiesValidator } from '../utils.ts';\nimport type { PolicyProvisioningEntity } from './types.ts';\n\nexport class PolicyProvisioningValidator extends Container<PolicyProvisioningEntity> {\n    override async run(\n        input?: ContainerInput<PolicyProvisioningEntity>,\n        options?: ContainerRunOptions<PolicyProvisioningEntity>,\n    ): Promise<PolicyProvisioningEntity> {\n        const output = await super.run(input, options);\n\n        // A composite policy with no children can never be satisfied and makes\n        // any permission bound to it permanently un-grantable (#3304). Reject\n        // it up front so provisioning fails at config load with a clear\n        // message, rather than silently provisioning a \"stale\" permission that\n        // only fails — with an opaque empty-issue error — once evaluated.\n        if (\n            output.attributes?.type === BuiltInPolicyType.COMPOSITE &&\n            (!output.children || output.children.length === 0)\n        ) {\n            throw new ValidupError([\n                defineIssueItem({\n                    path: ['children'],\n                    message: 'A composite policy must define at least one child policy.',\n                }),\n            ]);\n        }\n\n        return output;\n    }\n\n    protected initialize() {\n        super.initialize();\n\n        const strategyValidator = new ProvisioningStrategyValidator();\n        this.mount('strategy', { optional: true }, strategyValidator);\n\n        const attributesValidator = new PolicyValidator();\n        this.mount('attributes', attributesValidator);\n\n        this.mount('extraAttributes', { optional: true }, createValidator(\n            z.record(z.string(), z.any()),\n        ));\n\n        this.mount('children', { optional: true }, createValidator(\n            z\n                .array(z.any())\n                .check(createProvisioningEntitiesValidator(this)),\n        ));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,IAAaS,8BAAb,cAAiDN,UAAAA;CAC7C,MAAeO,IACXC,OACAC,SACiC;EACjC,MAAMC,SAAS,MAAM,MAAMH,IAAIC,OAAOC,OAAAA;EAOtC,IACIC,OAAOC,YAAYC,SAASf,kBAAkBgB,cAC7C,CAACH,OAAOI,YAAYJ,OAAOI,SAASC,WAAW,IAEhD,MAAM,IAAId,aAAa,CACnBC,gBAAgB;GACZc,MAAM,CAAC,UAAW;GAClBC,SAAS;EACb,CAAA,CACH,CAAA;EAGL,OAAOP;CACX;CAEUQ,aAAa;EACnB,MAAMA,WAAAA;EAEN,MAAMC,oBAAoB,IAAIf,8BAAAA;EAC9B,KAAKgB,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGF,iBAAAA;EAE3C,MAAMG,sBAAsB,IAAIxB,gBAAAA;EAChC,KAAKsB,MAAM,cAAcE,mBAAAA;EAEzB,KAAKF,MAAM,mBAAmB,EAAEC,UAAU,KAAK,GAAGtB,gBAC9CI,EAAEoB,OAAOpB,EAAEqB,OAAM,GAAIrB,EAAEsB,IAAG,CAAA,CAAA,CAAA;EAG9B,KAAKL,MAAM,YAAY,EAAEC,UAAU,KAAK,GAAGtB,gBACvCI,EACKuB,MAAMvB,EAAEsB,IAAG,CAAA,CAAA,CACXE,MAAMtB,oCAAoC,IAAI,CAAA,CAAA,CAAA;CAE3D;AACJ"}

package/dist/core/provisioning/entities/realm/wildcard-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wildcard-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAS,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAiC,MAAM,SAAS,CAAC;AAInE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IACtF,SAAS,CAAC,UAAU;IA8BL,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,uBAAuB,CAAC,EAC/C,OAAO,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,GACvD,OAAO,CAAC,uBAAuB,CAAC;CAsBtC"}
+{"version":3,"file":"wildcard-validator.d.ts","sourceRoot":"","sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAKlD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IACtF,SAAS,CAAC,UAAU;IA8BL,GAAG,CACd,KAAK,CAAC,EAAE,cAAc,CAAC,uBAAuB,CAAC,EAC/C,OAAO,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,GACvD,OAAO,CAAC,uBAAuB,CAAC;CAsBtC"}

package/dist/core/provisioning/entities/realm/wildcard-validator.mjs

@@ -2,9 +2,10 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import "../../constants.mjs";
+import { defineIssueItem } from "../../../../node_modules/@ebec/core/dist/index.mjs";
 import { RealmProvisioningRelationsValidator } from "./relations-validator.mjs";
 import { CLIENT_RESERVED_NAMES } from "@authup/core-kit";
-import { Container, ValidupError, defineIssueItem } from "validup";
+import { Container, ValidupError } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
 //#region src/core/provisioning/entities/realm/wildcard-validator.ts

package/dist/core/provisioning/entities/realm/wildcard-validator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"wildcard-validator.mjs","names":["CLIENT_RESERVED_NAMES","createValidator","Container","ValidupError","defineIssueItem","z","REALM_WILDCARD_NAME","RealmProvisioningRelationsValidator","RealmWildcardProvisioningValidator","initialize","mount","looseObject","name","literal","check","ctx","keys","Object","value","length","issues","push","code","input","message","optional","any","relationsValidator","run","options","output","clients","relations","forEach","client","index","attributes","includes","path","received"],"sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_RESERVED_NAMES } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport type { ContainerInput, ContainerRunOptions, Issue } from 'validup';\nimport { Container, ValidupError, defineIssueItem } from 'validup';\nimport { z } from 'zod';\nimport { REALM_WILDCARD_NAME } from '../../constants.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\nimport type { RealmProvisioningEntity } from './types.ts';\n\n/**\n * Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard\n * entry is a selector over realms, not a realm declaration, so it is\n * relations-only: `attributes` may carry nothing but the literal wildcard\n * name, and a realm-level `strategy` is rejected (`absent` would mean\n * \"delete every realm\"). Child strategies stay fully supported.\n *\n * Reserved client names (system / console clients) are rejected: a\n * template stamping one into every realm would fight the system client\n * MERGE on every boot.\n */\nexport class RealmWildcardProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount('attributes', createValidator(\n            z.looseObject({ name: z.literal(REALM_WILDCARD_NAME) }).check((ctx) => {\n                const keys = Object.keys(ctx.value);\n                if (keys.length > 1) {\n                    ctx.issues.push({\n                        code: 'custom',\n                        input: ctx.value,\n                        message: 'A wildcard realm entry is relations-only and can not declare realm attributes.',\n                    });\n                }\n            }),\n        ));\n\n        this.mount('strategy', { optional: true }, createValidator(\n            z.any().check((ctx) => {\n                ctx.issues.push({\n                    code: 'custom',\n                    input: ctx.value,\n                    message: 'A wildcard realm entry can not declare a realm-level strategy.',\n                });\n            }),\n        ));\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n\n    override async run(\n        input?: ContainerInput<RealmProvisioningEntity>,\n        options?: ContainerRunOptions<RealmProvisioningEntity>,\n    ): Promise<RealmProvisioningEntity> {\n        const output = await super.run(input, options);\n\n        const issues : Issue[] = [];\n        const clients = output.relations?.clients ?? [];\n        clients.forEach((client, index) => {\n            const name = client.attributes?.name;\n            if (name && (CLIENT_RESERVED_NAMES as string[]).includes(name)) {\n                issues.push(defineIssueItem({\n                    path: ['relations', 'clients', index, 'attributes', 'name'],\n                    message: `The client name \"${name}\" is reserved for system clients and can not be declared in a wildcard realm entry.`,\n                    received: name,\n                }));\n            }\n        });\n\n        if (issues.length > 0) {\n            throw new ValidupError(issues);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;GA2BA,IAAaQ,qCAAb,cAAwDN,UAAAA;CAC1CO,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MAAM,cAAcT,gBACrBI,EAAEM,YAAY,EAAEC,MAAMP,EAAEQ,QAAAA,GAAQP,EAAqB,CAAA,CAAA,CAAGQ,OAAOC,QAAAA;GAE3D,IADaE,OAAOD,KAAKD,IAAIG,KACzBF,CAAAA,CAAKG,SAAS,GACdJ,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EAER,CAAA,CAAA,CAAA;EAGJ,KAAKd,MAAM,YAAY,EAAEe,UAAU,KAAK,GAAGxB,gBACvCI,EAAEqB,IAAG,CAAA,CAAGZ,OAAOC,QAAAA;GACXA,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EACJ,CAAA,CAAA,CAAA;EAGJ,MAAMG,qBAAqB,IAAIpB,oCAAAA;EAC/B,KAAKG,MAAM,aAAa,EAAEe,UAAU,KAAK,GAAGE,kBAAAA;CAChD;CAEA,MAAeC,IACXL,OACAM,SACgC;EAChC,MAAMC,SAAS,MAAM,MAAMF,IAAIL,OAAOM,OAAAA;EAEtC,MAAMT,SAAmB,CAAA;EAEzBW,CADgBD,OAAOE,WAAWD,WAAW,CAAA,EAAA,CACrCE,SAASC,QAAQC,UAAAA;GACrB,MAAMvB,OAAOsB,OAAOE,YAAYxB;GAChC,IAAIA,QAAQ,sBAAoCyB,SAASzB,IAAAA,GACrDQ,OAAOC,KAAKjB,gBAAgB;IACxBkC,MAAM;KAAC;KAAa;KAAWH;KAAO;KAAc;IAAO;IAC3DX,SAAS,oBAAoBZ,KAAK;IAClC2B,UAAU3B;GACd,CAAA,CAAA;EAER,CAAA;EAEA,IAAIQ,OAAOD,SAAS,GAChB,MAAM,IAAIhB,aAAaiB,MAAAA;EAG3B,OAAOU;CACX;AACJ"}
+{"version":3,"file":"wildcard-validator.mjs","names":["CLIENT_RESERVED_NAMES","createValidator","Container","ValidupError","defineIssueItem","z","REALM_WILDCARD_NAME","RealmProvisioningRelationsValidator","RealmWildcardProvisioningValidator","initialize","mount","looseObject","name","literal","check","ctx","keys","Object","value","length","issues","push","code","input","message","optional","any","relationsValidator","run","options","output","clients","relations","forEach","client","index","attributes","includes","path","received"],"sources":["../../../../../src/core/provisioning/entities/realm/wildcard-validator.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_RESERVED_NAMES } from '@authup/core-kit';\nimport { createValidator } from '@validup/zod';\nimport type { ContainerInput, ContainerRunOptions } from 'validup';\nimport type { Issue } from '@ebec/core';\nimport { Container, ValidupError } from 'validup';\nimport { defineIssueItem } from '@ebec/core';\nimport { z } from 'zod';\nimport { REALM_WILDCARD_NAME } from '../../constants.ts';\nimport { RealmProvisioningRelationsValidator } from './relations-validator.ts';\nimport type { RealmProvisioningEntity } from './types.ts';\n\n/**\n * Validates a WILDCARD realm entry (attributes.name === '*'). A wildcard\n * entry is a selector over realms, not a realm declaration, so it is\n * relations-only: `attributes` may carry nothing but the literal wildcard\n * name, and a realm-level `strategy` is rejected (`absent` would mean\n * \"delete every realm\"). Child strategies stay fully supported.\n *\n * Reserved client names (system / console clients) are rejected: a\n * template stamping one into every realm would fight the system client\n * MERGE on every boot.\n */\nexport class RealmWildcardProvisioningValidator extends Container<RealmProvisioningEntity> {\n    protected initialize() {\n        super.initialize();\n\n        this.mount('attributes', createValidator(\n            z.looseObject({ name: z.literal(REALM_WILDCARD_NAME) }).check((ctx) => {\n                const keys = Object.keys(ctx.value);\n                if (keys.length > 1) {\n                    ctx.issues.push({\n                        code: 'custom',\n                        input: ctx.value,\n                        message: 'A wildcard realm entry is relations-only and can not declare realm attributes.',\n                    });\n                }\n            }),\n        ));\n\n        this.mount('strategy', { optional: true }, createValidator(\n            z.any().check((ctx) => {\n                ctx.issues.push({\n                    code: 'custom',\n                    input: ctx.value,\n                    message: 'A wildcard realm entry can not declare a realm-level strategy.',\n                });\n            }),\n        ));\n\n        const relationsValidator = new RealmProvisioningRelationsValidator();\n        this.mount('relations', { optional: true }, relationsValidator);\n    }\n\n    override async run(\n        input?: ContainerInput<RealmProvisioningEntity>,\n        options?: ContainerRunOptions<RealmProvisioningEntity>,\n    ): Promise<RealmProvisioningEntity> {\n        const output = await super.run(input, options);\n\n        const issues : Issue[] = [];\n        const clients = output.relations?.clients ?? [];\n        clients.forEach((client, index) => {\n            const name = client.attributes?.name;\n            if (name && (CLIENT_RESERVED_NAMES as string[]).includes(name)) {\n                issues.push(defineIssueItem({\n                    path: ['relations', 'clients', index, 'attributes', 'name'],\n                    message: `The client name \"${name}\" is reserved for system clients and can not be declared in a wildcard realm entry.`,\n                    received: name,\n                }));\n            }\n        });\n\n        if (issues.length > 0) {\n            throw new ValidupError(issues);\n        }\n\n        return output;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;GA6BA,IAAaQ,qCAAb,cAAwDN,UAAAA;CAC1CO,aAAa;EACnB,MAAMA,WAAAA;EAEN,KAAKC,MAAM,cAAcT,gBACrBI,EAAEM,YAAY,EAAEC,MAAMP,EAAEQ,QAAAA,GAAQP,EAAqB,CAAA,CAAA,CAAGQ,OAAOC,QAAAA;GAE3D,IADaE,OAAOD,KAAKD,IAAIG,KACzBF,CAAAA,CAAKG,SAAS,GACdJ,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EAER,CAAA,CAAA,CAAA;EAGJ,KAAKd,MAAM,YAAY,EAAEe,UAAU,KAAK,GAAGxB,gBACvCI,EAAEqB,IAAG,CAAA,CAAGZ,OAAOC,QAAAA;GACXA,IAAIK,OAAOC,KAAK;IACZC,MAAM;IACNC,OAAOR,IAAIG;IACXM,SAAS;GACb,CAAA;EACJ,CAAA,CAAA,CAAA;EAGJ,MAAMG,qBAAqB,IAAIpB,oCAAAA;EAC/B,KAAKG,MAAM,aAAa,EAAEe,UAAU,KAAK,GAAGE,kBAAAA;CAChD;CAEA,MAAeC,IACXL,OACAM,SACgC;EAChC,MAAMC,SAAS,MAAM,MAAMF,IAAIL,OAAOM,OAAAA;EAEtC,MAAMT,SAAmB,CAAA;EAEzBW,CADgBD,OAAOE,WAAWD,WAAW,CAAA,EAAA,CACrCE,SAASC,QAAQC,UAAAA;GACrB,MAAMvB,OAAOsB,OAAOE,YAAYxB;GAChC,IAAIA,QAAQ,sBAAoCyB,SAASzB,IAAAA,GACrDQ,OAAOC,KAAKjB,gBAAgB;IACxBkC,MAAM;KAAC;KAAa;KAAWH;KAAO;KAAc;IAAO;IAC3DX,SAAS,oBAAoBZ,KAAK;IAClC2B,UAAU3B;GACd,CAAA,CAAA;EAER,CAAA;EAEA,IAAIQ,OAAOD,SAAS,GAChB,MAAM,IAAIhB,aAAaiB,MAAAA;EAG3B,OAAOU;CACX;AACJ"}

package/dist/core/security/policy/evaluator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from 'validup';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (ctx.withConditions && lowerable && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAmB;CACjD;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CACEjB,GAAAA,IAAIiB,QAAQ,CAAA,CACnB;GACL,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIhC,IAAIiD,kBAAkBd,aAAaF,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}
+{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from '@ebec/core';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (ctx.withConditions && lowerable && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAmB;CACjD;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CACEjB,GAAAA,IAAIiB,QAAQ,CAAA,CACnB;GACL,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIhC,IAAIiD,kBAAkBd,aAAaF,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}

package/dist/node_modules/@ebec/core/dist/index.mjs

@@ -0,0 +1,130 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region ../../node_modules/@ebec/core/dist/index.mjs
+/**
+* Vocabulary of well-known issue codes. Validators map their own failure
+* kinds onto these so consumer-side translation catalogs can ship one
+* localized message per code instead of falling back to a generic
+* "invalid value".
+*
+* Tracks the common ground between vuelidate, zod, joi, yup and
+* validator.js. The list lifts from vuelidate's catalog (snake_cased);
+* modern format codes (`PATTERN`, `UUID`, `DATE`, `JSON`, `BASE64`,
+* `STRONG_PASSWORD`, …) cover ground vuelidate predates. Every format
+* code names the format positively (`UUID`, `EMAIL`, `URL`, …) rather
+* than the failure mode (`NOT_UUID`, `INVALID_EMAIL`) so the registry
+* reads consistently.
+*
+* **This vocabulary is a default, not a requirement.** `IssueItem.code`
+* is widened to `IssueCode | (string & {})`, so a library with its own
+* vocabulary — `rapiq`'s `key_not_allowed`, an app's `email_taken` —
+* emits well-formed issues without touching this const at all. If you
+* want a typed const for your own codes, define one alongside this one:
+*
+* ```ts
+* import { IssueCode } from '@ebec/core';
+*
+* export const AppCode = {
+*     ...IssueCode,
+*     EMAIL_TAKEN: 'email_taken',
+* } as const;
+* ```
+*
+* Each entry's JSDoc documents the structured `data` producers should
+* attach when constructing the issue — templates can rely on those
+* placeholders being present (`{min}`, `{max}`, `{other}`, etc.).
+*/
+const IssueCode = {
+	/** Generic fallback when no more-specific code applies. `data`: — */
+	VALUE_INVALID: "value_invalid",
+	/** Every branch of a `oneOf` alternative failed. `data`: — */
+	ONE_OF_FAILED: "one_of_failed",
+	/** Value is missing, `undefined`, `null`, or empty per the validator's semantics. `data`: — */
+	REQUIRED: "required",
+	/** Value contains characters outside the alphabetical set. `data`: — */
+	ALPHA: "alpha",
+	/** Value contains characters outside the alphanumeric set. `data`: — */
+	ALPHA_NUM: "alpha_num",
+	/** Value is not a number. `data`: — */
+	NUMERIC: "numeric",
+	/** Value is not an integer. `data`: — */
+	INTEGER: "integer",
+	/** Value is not a decimal number. `data`: — */
+	DECIMAL: "decimal",
+	/** Value is shorter than the configured minimum. `data`: `{ min: number }` */
+	MIN_LENGTH: "min_length",
+	/** Value is longer than the configured maximum. `data`: `{ max: number }` */
+	MAX_LENGTH: "max_length",
+	/** Numeric value is below the configured minimum. `data`: `{ min: number }` */
+	MIN_VALUE: "min_value",
+	/** Numeric value is above the configured maximum. `data`: `{ max: number }` */
+	MAX_VALUE: "max_value",
+	/** Numeric value falls outside the configured `[min, max]` range. `data`: `{ min: number, max: number }` */
+	BETWEEN: "between",
+	/** Value is not a valid email address. `data`: — */
+	EMAIL: "email",
+	/** Value is not a valid URL. `data`: — */
+	URL: "url",
+	/** Value is not a valid IP address. `data`: — */
+	IP_ADDRESS: "ip_address",
+	/** Value is not a valid MAC address. `data`: — */
+	MAC_ADDRESS: "mac_address",
+	/** Value is not a valid UUID. `data`: — */
+	UUID: "uuid",
+	/** Value is not a valid date / cannot be parsed as a date. `data`: — */
+	DATE: "date",
+	/**
+	* Value does not match the expected regex pattern. `data`:
+	* `{ pattern: string }` — source of the regex without flags so
+	* catalogs can quote it in human-readable form.
+	*/
+	PATTERN: "pattern",
+	/** Value is not valid JSON. `data`: — */
+	JSON: "json",
+	/** Value is not valid base64. `data`: — */
+	BASE64: "base64",
+	/**
+	* Value does not meet the configured strong-password rules. `data`:
+	* `{ minLength?: number, minLowercase?: number, minUppercase?: number,
+	* minNumbers?: number, minSymbols?: number }` — only the keys the
+	* producer chose to surface; missing keys mean "the default for that
+	* setting wasn't configured."
+	*/
+	STRONG_PASSWORD: "strong_password",
+	/**
+	* Value must equal another named field's value (sibling-field assertion,
+	* e.g. password-confirm). `data`: `{ other: string }` — the name of
+	* the field being compared against.
+	*/
+	SAME_AS: "same_as"
+};
+/**
+* Build an `IssueItem`. TS uses the supplied `code` to pick the right
+* `data` requirement at the call site — passing `MIN_LENGTH` without
+* `data: { min }` is a compile error; passing `STRONG_PASSWORD` with
+* `data: { pointsPerUnique: 5 }` is a compile error.
+*
+* `code` may be omitted (defaults to `IssueCode.VALUE_INVALID` — bare,
+* no data).
+*
+* ```ts
+* defineIssueItem({
+*     code: IssueCode.MIN_LENGTH,
+*     path: ['name'],
+*     message: 'Must be at least 3 characters',
+*     data: { min: 3 },
+* });
+* ```
+*/
+function defineIssueItem(data) {
+	return {
+		type: "item",
+		...data,
+		code: data.code || IssueCode.VALUE_INVALID
+	};
+}
+//#endregion
+export { IssueCode, defineIssueItem };
+
+//# sourceMappingURL=index.mjs.map

package/dist/node_modules/@ebec/core/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../node_modules/@ebec/core/dist/index.mjs"],"sourcesContent":["//#region src/helpers/object.ts\nfunction isObject(item) {\n\treturn !!item && typeof item === \"object\" && !Array.isArray(item);\n}\n//#endregion\n//#region src/helpers/error.ts\nfunction isError(input) {\n\tif (!isObject(input)) return false;\n\tif (input instanceof Error) return true;\n\treturn typeof input.message === \"string\" && (typeof input.name === \"string\" || typeof input.stack === \"string\");\n}\n//#endregion\n//#region src/helpers/instanceof.ts\n/**\n* Property name used to store the cross-realm class-marker chain on instances.\n*\n* The chain is a `symbol[]` of `Symbol.for(...)` markers — one per class in the\n* inheritance path. Stored as a non-enumerable, non-writable, non-configurable\n* property so it stays out of `Object.keys()` and plain `JSON.stringify()`\n* output. `BaseError.toJSON()` re-emits it under the same key as a string\n* list (see {@link serializeInstanceofChain}), so on objects rehydrated from\n* that JSON the property holds a `string[]` instead.\n*\n* A well-formed chain always begins with `BASE_ERROR_INSTANCE` — every real\n* ebec error is a `BaseError` first, and subclass markers are appended on\n* top of it. Hand-built cross-realm stand-ins that carry a subclass marker\n* without it can invert that hierarchy (e.g. matching `@ebec/http`'s\n* `isHTTPError` while failing `@ebec/core`'s `isBaseError`).\n*/\nconst INSTANCEOF_PROPERTY = \"@instanceof\";\n/**\n* Append a class-marker symbol to the receiver's `@instanceof` chain.\n*\n* Each error class declares a `Symbol.for(...)` marker for itself and calls\n* `markInstanceof(this, MY_MARKER)` from its constructor. Subclass instances\n* accumulate markers from every ancestor in the chain, so a parent-class\n* guard can fast-path-match a subclass instance.\n*\n* Idempotent — re-marking the same instance with the same symbol is a no-op.\n*/\nfunction markInstanceof(target, marker) {\n\tconst existing = target[INSTANCEOF_PROPERTY];\n\tif (Array.isArray(existing)) {\n\t\tif (!existing.includes(marker)) existing.push(marker);\n\t\treturn;\n\t}\n\tObject.defineProperty(target, INSTANCEOF_PROPERTY, {\n\t\tvalue: [marker],\n\t\twritable: false,\n\t\tenumerable: false,\n\t\tconfigurable: false\n\t});\n}\n/**\n* Check whether the input's `@instanceof` chain carries `marker`.\n*\n* Returns `false` for non-objects, objects without the chain, or chains\n* stored as a non-array value (defensive).\n*\n* `strict` controls which chain entries count as a match. By default\n* (`strict: true`) only the native `Symbol.for(...)` form matches, which is\n* what an in-process instance carries. Pass `strict: false` to also match\n* the marker's `description` string: symbols are dropped by\n* `JSON.stringify`, so an error rehydrated from the JSON emitted by\n* `BaseError.toJSON()` carries the marker's description string in its chain\n* instead of the symbol, and only the loose form still recognizes it.\n* {@link matchesInstanceof} is `hasInstanceof(input, marker, false)`.\n*/\nfunction hasInstanceof(input, marker, strict = true) {\n\tif (!isObject(input)) return false;\n\tconst chain = input[INSTANCEOF_PROPERTY];\n\tif (!Array.isArray(chain)) return false;\n\tif (chain.includes(marker)) return true;\n\tif (strict) return false;\n\treturn typeof marker.description === \"string\" && chain.includes(marker.description);\n}\n/**\n* Serialize the input's `@instanceof` class-marker chain to its string form.\n*\n* Symbols are dropped by `JSON.stringify`, so `BaseError.toJSON()` emits the\n* chain as the markers' description strings instead. For `Symbol.for(...)`\n* markers the description *is* the registry key, so the string form carries\n* the same identity information as the symbol form.\n*\n* String entries pass through unchanged (a rehydrated chain re-serializes\n* losslessly); anything else is dropped. Each value is emitted once — a\n* re-marked rehydrated chain can hold the same marker in both its string\n* and symbol form.\n*/\nfunction serializeInstanceofChain(input) {\n\tif (!isObject(input)) return [];\n\tconst chain = input[INSTANCEOF_PROPERTY];\n\tif (!Array.isArray(chain)) return [];\n\tconst output = [];\n\tfor (const entry of chain) {\n\t\tlet value;\n\t\tif (typeof entry === \"symbol\") {\n\t\t\tif (entry.description) value = entry.description;\n\t\t} else if (typeof entry === \"string\") value = entry;\n\t\tif (typeof value === \"string\" && !output.includes(value)) output.push(value);\n\t}\n\treturn output;\n}\n/**\n* Check whether the input's `@instanceof` chain carries `marker` — either as\n* the native registry symbol (an in-process instance) or as the symbol's\n* description string (an error rehydrated from the JSON emitted by\n* `BaseError.toJSON()`).\n*\n* Prefer this over the strict (default) form of {@link hasInstanceof} as the\n* fast path of duck-type guards. Guards have no shape-based fallback, so the\n* strict form is the only check one performs: it matches only the symbol\n* form, so a guard built on it returns `false` outright for a\n* JSON-rehydrated subclass error — there is no slower path to fall back to.\n* Equivalent to `hasInstanceof(input, marker, false)`.\n*/\nfunction matchesInstanceof(input, marker) {\n\treturn hasInstanceof(input, marker, false);\n}\n//#endregion\n//#region src/helpers/check.ts\nconst BASE_ERROR_INSTANCE$1 = Symbol.for(\"@ebec/core/BaseError\");\nfunction isBaseError(input) {\n\treturn matchesInstanceof(input, BASE_ERROR_INSTANCE$1);\n}\nfunction isBaseErrorGroup(input) {\n\tif (!isBaseError(input)) return false;\n\tconst { errors } = input;\n\treturn Array.isArray(errors) && errors.length > 0 && errors.every((e) => isError(e));\n}\n//#endregion\n//#region src/helpers/error-code.ts\nfunction isErrorWithCode(error, code) {\n\tif (!isBaseError(error)) return false;\n\tif (Array.isArray(code)) return code.includes(error.code);\n\treturn error.code === code;\n}\n//#endregion\n//#region src/helpers/interpolate.ts\n/**\n* Substitute `{name}` placeholders in `str` with values from `data`.\n*\n* Placeholders whose key is missing from `data` (or explicitly\n* `undefined`) are left in the string verbatim, so a partially-populated\n* `data` degrades to a readable template rather than to `\"undefined\"`.\n*\n* - `regex` must carry the `g` flag — `String.prototype.matchAll` throws\n*   without it.\n* - Substitution goes through `String.prototype.replace` with a string\n*   replacement, so `$&`, `` $` ``, `$'` and `$1` inside a *substituted\n*   value* are interpreted as replacement patterns rather than literals.\n*   Treat `data` values as trusted, or escape `$` before passing them.\n*/\nfunction interpolate(str, data, regex = /\\{(\\w+)\\}/g) {\n\treturn Array.from(str.matchAll(regex)).reduce((acc, match) => {\n\t\tconst key = match[1];\n\t\tif (key && typeof data[key] !== \"undefined\") return acc.replace(match[0], String(data[key]));\n\t\treturn acc;\n\t}, str);\n}\n//#endregion\n//#region src/helpers/sanitize-code.ts\n/**\n* Convert a PascalCase class name to CONSTANT_CASE error code.\n* e.g. \"NotFoundError\" -> \"NOT_FOUND_ERROR\"\n*/\nfunction sanitizeErrorCode(input) {\n\treturn input.replace(/([a-z])([A-Z])/g, \"$1_$2\").replace(/([A-Z]+)([A-Z][a-z])/g, \"$1_$2\").toUpperCase();\n}\n//#endregion\n//#region src/helpers/serialize.ts\nfunction toSerializable(input) {\n\tif (isObject(input) && typeof input.toJSON === \"function\") return input.toJSON();\n\tif (isError(input)) return { message: input.message };\n\treturn input;\n}\n//#endregion\n//#region src/options/module.ts\nfunction isErrorOptions(input) {\n\tif (!isObject(input)) return false;\n\tif (typeof input.message !== \"undefined\" && typeof input.message !== \"string\") return false;\n\tif (typeof input.stack !== \"undefined\" && typeof input.stack !== \"string\") return false;\n\treturn typeof input.code === \"undefined\" || typeof input.code === \"string\";\n}\nfunction extractErrorOptions(input = {}) {\n\tif (typeof input === \"string\") return { message: input };\n\treturn input;\n}\n//#endregion\n//#region src/module.ts\nconst BASE_ERROR_INSTANCE = Symbol.for(\"@ebec/core/BaseError\");\nvar BaseError = class extends Error {\n\t/**\n\t* A unique identifier for the error.\n\t*/\n\tcode;\n\t/**\n\t* Represents the underlying cause or source of the error.\n\t*/\n\tcause;\n\t/**\n\t* A collection of errors for batch/group error scenarios.\n\t*/\n\terrors;\n\t/**\n\t* Structured validation failures, as an issue tree.\n\t* Always an array — empty when the error carries none.\n\t*/\n\tissues;\n\tconstructor(input = {}) {\n\t\tconst options = extractErrorOptions(input);\n\t\tlet message = options.message || \"An error occurred\";\n\t\tif (options.messageData) message = interpolate(message, options.messageData);\n\t\tsuper(message);\n\t\tif (options.cause !== void 0) this.cause = options.cause;\n\t\tif (typeof this.name === \"undefined\" || this.name === \"Error\") Object.defineProperty(this, \"name\", {\n\t\t\tconfigurable: true,\n\t\t\tenumerable: false,\n\t\t\tvalue: this.constructor.name,\n\t\t\twritable: true\n\t\t});\n\t\tif (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);\n\t\tif (options.stack) this.stack = options.stack;\n\t\tthis.code = options.code || sanitizeErrorCode(this.constructor.name);\n\t\tif (options.errors !== void 0) this.errors = [...options.errors];\n\t\tthis.issues = Array.isArray(options.issues) ? [...options.issues] : [];\n\t\tmarkInstanceof(this, BASE_ERROR_INSTANCE);\n\t}\n\t/**\n\t* The class-marker chain rides along as a string list so the ancestor\n\t* information survives a JSON round-trip (symbols don't serialize) —\n\t* duck-type guards match rehydrated subclass errors through it via\n\t* `matchesInstanceof`.\n\t*/\n\ttoJSON() {\n\t\treturn {\n\t\t\tname: this.name,\n\t\t\tmessage: this.message,\n\t\t\tcode: this.code,\n\t\t\t...this.cause !== void 0 && { cause: toSerializable(this.cause) },\n\t\t\t...this.errors !== void 0 && { errors: this.errors.map((e) => toSerializable(e)) },\n\t\t\t...this.issues.length > 0 && { issues: [...this.issues] },\n\t\t\t[INSTANCEOF_PROPERTY]: serializeInstanceofChain(this)\n\t\t};\n\t}\n};\n//#endregion\n//#region src/catalog.ts\nfunction defineErrorCatalog(definitions) {\n\tconst catalog = {};\n\tfor (const key of Object.keys(definitions)) {\n\t\tconst entry = definitions[key];\n\t\tcatalog[key] = ((messageData, overrides = {}) => new BaseError({\n\t\t\t...entry,\n\t\t\t...overrides,\n\t\t\tcode: overrides.code ?? entry.code ?? key,\n\t\t\tmessage: overrides.message ?? entry.message,\n\t\t\tmessageData: overrides.messageData ?? messageData\n\t\t}));\n\t}\n\treturn catalog;\n}\n//#endregion\n//#region src/issue/check.ts\nfunction isObject$1(input) {\n\treturn !!input && typeof input === \"object\" && !Array.isArray(input);\n}\nfunction isIssuePath(input) {\n\tif (!Array.isArray(input)) return false;\n\treturn input.every((el) => typeof el === \"string\" || typeof el === \"number\" || typeof el === \"symbol\");\n}\nfunction isBaseIssue(input) {\n\tif (!isObject$1(input)) return false;\n\tif (typeof input.message !== \"string\") return false;\n\tif (!isIssuePath(input.path)) return false;\n\treturn typeof input.meta === \"undefined\" || isObject$1(input.meta);\n}\n/**\n* Structural check for a leaf node.\n*\n* Deliberately duck-typed rather than `instanceof`-based: issues cross\n* package and realm boundaries, so a tree assembled from two libraries —\n* or from two copies of this package — must still validate.\n*/\nfunction isIssueItem(input) {\n\tif (!isBaseIssue(input)) return false;\n\tif (input.type !== \"item\") return false;\n\treturn typeof input.code === \"string\";\n}\n/**\n* Structural check for a node with children. Recurses, so a group only\n* passes when every descendant is itself well-formed.\n*/\nfunction isIssueGroup(input) {\n\tif (!isBaseIssue(input)) return false;\n\tif (input.type !== \"group\") return false;\n\treturn Array.isArray(input.issues) && input.issues.every((issue) => isIssueItem(issue) || isIssueGroup(issue));\n}\n/**\n* Structural check for any node of the tree.\n*/\nfunction isIssue(input) {\n\treturn isIssueGroup(input) || isIssueItem(input);\n}\n//#endregion\n//#region src/issue/constants.ts\n/**\n* Vocabulary of well-known issue codes. Validators map their own failure\n* kinds onto these so consumer-side translation catalogs can ship one\n* localized message per code instead of falling back to a generic\n* \"invalid value\".\n*\n* Tracks the common ground between vuelidate, zod, joi, yup and\n* validator.js. The list lifts from vuelidate's catalog (snake_cased);\n* modern format codes (`PATTERN`, `UUID`, `DATE`, `JSON`, `BASE64`,\n* `STRONG_PASSWORD`, …) cover ground vuelidate predates. Every format\n* code names the format positively (`UUID`, `EMAIL`, `URL`, …) rather\n* than the failure mode (`NOT_UUID`, `INVALID_EMAIL`) so the registry\n* reads consistently.\n*\n* **This vocabulary is a default, not a requirement.** `IssueItem.code`\n* is widened to `IssueCode | (string & {})`, so a library with its own\n* vocabulary — `rapiq`'s `key_not_allowed`, an app's `email_taken` —\n* emits well-formed issues without touching this const at all. If you\n* want a typed const for your own codes, define one alongside this one:\n*\n* ```ts\n* import { IssueCode } from '@ebec/core';\n*\n* export const AppCode = {\n*     ...IssueCode,\n*     EMAIL_TAKEN: 'email_taken',\n* } as const;\n* ```\n*\n* Each entry's JSDoc documents the structured `data` producers should\n* attach when constructing the issue — templates can rely on those\n* placeholders being present (`{min}`, `{max}`, `{other}`, etc.).\n*/\nconst IssueCode = {\n\t/** Generic fallback when no more-specific code applies. `data`: — */\n\tVALUE_INVALID: \"value_invalid\",\n\t/** Every branch of a `oneOf` alternative failed. `data`: — */\n\tONE_OF_FAILED: \"one_of_failed\",\n\t/** Value is missing, `undefined`, `null`, or empty per the validator's semantics. `data`: — */\n\tREQUIRED: \"required\",\n\t/** Value contains characters outside the alphabetical set. `data`: — */\n\tALPHA: \"alpha\",\n\t/** Value contains characters outside the alphanumeric set. `data`: — */\n\tALPHA_NUM: \"alpha_num\",\n\t/** Value is not a number. `data`: — */\n\tNUMERIC: \"numeric\",\n\t/** Value is not an integer. `data`: — */\n\tINTEGER: \"integer\",\n\t/** Value is not a decimal number. `data`: — */\n\tDECIMAL: \"decimal\",\n\t/** Value is shorter than the configured minimum. `data`: `{ min: number }` */\n\tMIN_LENGTH: \"min_length\",\n\t/** Value is longer than the configured maximum. `data`: `{ max: number }` */\n\tMAX_LENGTH: \"max_length\",\n\t/** Numeric value is below the configured minimum. `data`: `{ min: number }` */\n\tMIN_VALUE: \"min_value\",\n\t/** Numeric value is above the configured maximum. `data`: `{ max: number }` */\n\tMAX_VALUE: \"max_value\",\n\t/** Numeric value falls outside the configured `[min, max]` range. `data`: `{ min: number, max: number }` */\n\tBETWEEN: \"between\",\n\t/** Value is not a valid email address. `data`: — */\n\tEMAIL: \"email\",\n\t/** Value is not a valid URL. `data`: — */\n\tURL: \"url\",\n\t/** Value is not a valid IP address. `data`: — */\n\tIP_ADDRESS: \"ip_address\",\n\t/** Value is not a valid MAC address. `data`: — */\n\tMAC_ADDRESS: \"mac_address\",\n\t/** Value is not a valid UUID. `data`: — */\n\tUUID: \"uuid\",\n\t/** Value is not a valid date / cannot be parsed as a date. `data`: — */\n\tDATE: \"date\",\n\t/**\n\t* Value does not match the expected regex pattern. `data`:\n\t* `{ pattern: string }` — source of the regex without flags so\n\t* catalogs can quote it in human-readable form.\n\t*/\n\tPATTERN: \"pattern\",\n\t/** Value is not valid JSON. `data`: — */\n\tJSON: \"json\",\n\t/** Value is not valid base64. `data`: — */\n\tBASE64: \"base64\",\n\t/**\n\t* Value does not meet the configured strong-password rules. `data`:\n\t* `{ minLength?: number, minLowercase?: number, minUppercase?: number,\n\t* minNumbers?: number, minSymbols?: number }` — only the keys the\n\t* producer chose to surface; missing keys mean \"the default for that\n\t* setting wasn't configured.\"\n\t*/\n\tSTRONG_PASSWORD: \"strong_password\",\n\t/**\n\t* Value must equal another named field's value (sibling-field assertion,\n\t* e.g. password-confirm). `data`: `{ other: string }` — the name of\n\t* the field being compared against.\n\t*/\n\tSAME_AS: \"same_as\"\n};\n//#endregion\n//#region src/issue/define.ts\n/**\n* Build an `IssueItem`. TS uses the supplied `code` to pick the right\n* `data` requirement at the call site — passing `MIN_LENGTH` without\n* `data: { min }` is a compile error; passing `STRONG_PASSWORD` with\n* `data: { pointsPerUnique: 5 }` is a compile error.\n*\n* `code` may be omitted (defaults to `IssueCode.VALUE_INVALID` — bare,\n* no data).\n*\n* ```ts\n* defineIssueItem({\n*     code: IssueCode.MIN_LENGTH,\n*     path: ['name'],\n*     message: 'Must be at least 3 characters',\n*     data: { min: 3 },\n* });\n* ```\n*/\nfunction defineIssueItem(data) {\n\treturn {\n\t\ttype: \"item\",\n\t\t...data,\n\t\tcode: data.code || IssueCode.VALUE_INVALID\n\t};\n}\n/**\n* Build an {@link IssueGroup} — a node that carries child issues.\n*\n* The children's `path` values are used as given; this factory does not\n* rewrite them. When the children came from validating a *sub*-structure,\n* rebase them with {@link prefixIssuePath} first so the tree keeps its\n* absolute-path invariant.\n*/\nfunction defineIssueGroup(data) {\n\treturn {\n\t\ttype: \"group\",\n\t\t...data\n\t};\n}\n//#endregion\n//#region src/issue/flatten.ts\n/**\n* Collect every leaf of the tree, in pre-order, discarding grouping.\n*\n* This is the workhorse for consumers that render per-field errors: since\n* every node carries an absolute `path` (see `IssueBase.path`), the result\n* can be indexed by field directly, with no tree walk to reassemble\n* prefixes.\n*\n* Returned items are the **same object references** held by the tree, not\n* copies — cheap to call, but do not mutate what you get back.\n*/\nfunction flattenIssueItems(issues) {\n\tconst output = [];\n\tfor (const issue of issues) if (isIssueItem(issue)) output.push(issue);\n\telse output.push(...flattenIssueItems(issue.issues));\n\treturn output;\n}\n/**\n* Collect every group of the tree, in pre-order, including nested groups.\n*\n* A group is emitted before its own descendants are visited, so the result\n* reads outermost-first. As with {@link flattenIssueItems}, entries are\n* live references into the tree.\n*/\nfunction flattenIssueGroups(issues) {\n\tconst output = [];\n\tfor (const issue of issues) if (isIssueGroup(issue)) {\n\t\toutput.push(issue);\n\t\toutput.push(...flattenIssueGroups(issue.issues));\n\t}\n\treturn output;\n}\n//#endregion\n//#region src/issue/format.ts\n/**\n* Render an issue's user-facing message.\n*\n* Resolution order:\n* 1. If `templates[code]` exists, return `interpolate(template, issue.data)`.\n* 2. Else return `issue.message` (the default English rendering set at\n*    construction time).\n* 3. Else return `fallback`.\n*\n* The eager `message` written at construction time is what makes step 2\n* useful: a consumer with no catalog at all still gets something readable,\n* and a consumer with a partial catalog falls back per-code rather than\n* all-or-nothing.\n*/\nfunction formatIssue(issue, templates, fallback = \"\") {\n\tif (templates && issue.code) {\n\t\tconst template = templates[issue.code];\n\t\tif (typeof template === \"string\") return interpolate(template, issue.data || {});\n\t}\n\tif (typeof issue.message === \"string\" && issue.message.length > 0) return issue.message;\n\treturn fallback;\n}\n//#endregion\n//#region src/issue/prefix.ts\n/**\n* Rebase an issue onto a parent path, recursing into groups so every\n* descendant is rebased too.\n*\n* This is the step that maintains the absolute-path invariant (see\n* `IssueBase.path`). Whenever a producer validates a *sub*-structure and\n* merges the resulting issues into a larger tree, the children arrive with\n* paths relative to that sub-structure and have to be rewritten. Doing it\n* only at the top level is the tempting bug: a child that already wrapped\n* its own failures in an {@link IssueGroup} would surface inner leaves\n* missing the parent segment, and every consumer relying on\n* {@link flattenIssueItems} for per-field lookup would silently mis-index\n* exactly the nested cases.\n*\n* ```ts\n* // validating `address` produced issues at ['street']\n* const rebased = issues.map((issue) => prefixIssuePath(issue, ['address']));\n* // → paths are now ['address', 'street'], at every depth\n* ```\n*\n* **Returns copies.** The input is never mutated: each visited node is\n* shallow-copied and a group's `issues` array is rebuilt from the rebased\n* children, so the whole spine is fresh. `data` and `meta` are carried over\n* by reference — cheap, but it means a caller that mutates `meta` on the\n* result also mutates it on the original. Copying happens unconditionally,\n* including for an empty `prefix`.\n*/\nfunction prefixIssuePath(issue, prefix) {\n\tconst prefixed = {\n\t\t...issue,\n\t\tpath: [...prefix, ...issue.path || []]\n\t};\n\tif (prefixed.type === \"group\") prefixed.issues = prefixed.issues.map((nested) => prefixIssuePath(nested, prefix));\n\treturn prefixed;\n}\n//#endregion\nexport { BASE_ERROR_INSTANCE, BaseError, INSTANCEOF_PROPERTY, IssueCode, defineErrorCatalog, defineIssueGroup, defineIssueItem, extractErrorOptions, flattenIssueGroups, flattenIssueItems, formatIssue, hasInstanceof, interpolate, isBaseError, isBaseErrorGroup, isError, isErrorOptions, isErrorWithCode, isIssue, isIssueGroup, isIssueItem, isObject, markInstanceof, matchesInstanceof, prefixIssuePath, sanitizeErrorCode, serializeInstanceofChain, toSerializable };\n\n//# sourceMappingURL=index.mjs.map"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmVA,MAAM,YAAY;;CAEjB,eAAe;;CAEf,eAAe;;CAEf,UAAU;;CAEV,OAAO;;CAEP,WAAW;;CAEX,SAAS;;CAET,SAAS;;CAET,SAAS;;CAET,YAAY;;CAEZ,YAAY;;CAEZ,WAAW;;CAEX,WAAW;;CAEX,SAAS;;CAET,OAAO;;CAEP,KAAK;;CAEL,YAAY;;CAEZ,aAAa;;CAEb,MAAM;;CAEN,MAAM;;;;;;CAMN,SAAS;;CAET,MAAM;;CAEN,QAAQ;;;;;;;;CAQR,iBAAiB;;;;;;CAMjB,SAAS;AACV;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,gBAAgB,MAAM;CAC9B,OAAO;EACN,MAAM;EACN,GAAG;EACH,MAAM,KAAK,QAAQ,UAAU;CAC9B;AACD"}