@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/app/modules/oauth2/repositories/consent/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","redactFieldConditions","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn) — NEVER the full ClientEntity (redirectUri + post-logout\n        // patterns = the trusted-origin set, grantTypes, baseUrl/rootUrl,\n        // secret-storage flags, accessPolicyId). `client` is deliberately\n        // absent from relations.allowed so a raw ?include=client cannot force\n        // the full-column join; the self-service Applications tab still gets\n        // the display name from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAef,WAAWa,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EASvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAM3B,sBAAsBU,OAAOc,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCrC,kBAAkB;GACdsC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYzB,aAAayD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}
+{"version":3,"file":"repository.mjs","names":["IdentityType","buildRedisKeyPath","applyQuery","redactFieldConditions","CachePrefix","ConsentEntity","isUniqueConstraintDatabaseError","applyRealmScopeSelect","ConsentRepositoryAdapter","repository","dataSource","getRepository","findMany","query","options","qb","createQueryBuilder","pagination","leftJoin","addSelect","owner","andWhere","ownerSub","sub","ownerSubKind","subKind","realmId","entities","total","getManyAndCount","data","meta","findOneById","id","findOneBy","findAllBySubjectClient","clientId","where","cache","prefix","CONSENT_COVERING","key","getMany","insertMissing","input","existing","existingTokens","Set","map","row","scope","missing","scopes","filter","token","has","userId","USER","entity","create","expiresAt","save","e","remove"],"sources":["../../../../../../src/app/modules/oauth2/repositories/consent/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport { IdentityType  } from '@authup/core-kit';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport { buildRedisKeyPath } from '@authup/server-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { CachePrefix, ConsentEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isUniqueConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport type {\n    ConsentFindManyOptions,\n    ConsentOwner,\n    IConsentRepository,\n} from '../../../../../core/index.ts';\nimport { applyRealmScopeSelect } from '../../../database/repositories/helpers.ts';\n\nexport class ConsentRepositoryAdapter implements IConsentRepository {\n    protected repository: Repository<ConsentEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(ConsentEntity);\n    }\n\n    async findMany(\n        query: IQuery,\n        options: ConsentFindManyOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Consent>> {\n        const qb = this.repository.createQueryBuilder('consent');\n\n        const { pagination } = applyQuery(qb, query);\n\n        applyRealmScopeSelect(qb, 'consent', ['sub', 'subKind']);\n\n        // Always expose only a client SUMMARY (id / name / displayName /\n        // builtIn / baseUrl), NEVER the full ClientEntity: redirectUri +\n        // post-logout patterns are the trusted-origin set, and grantTypes,\n        // backchannelLogoutUri, the secret-storage flags and accessPolicyId\n        // are admin-only configuration. `client` is deliberately absent from\n        // relations.allowed so a raw ?include=client cannot force the\n        // full-column join; the self-service Applications page still gets\n        // the display name and the home link from this fixed projection.\n        qb.leftJoin('consent.client', 'client')\n            .addSelect([\n                'client.id',\n                'client.name',\n                'client.displayName',\n                'client.builtIn',\n                'client.baseUrl',\n            ]);\n\n        if (options.owner) {\n            // mandatory constraint — not overridable by a rapiq filter\n            qb.andWhere('consent.sub = :ownerSub AND consent.subKind = :ownerSubKind', {\n                ownerSub: options.owner.sub,\n                ownerSubKind: options.owner.subKind,\n            });\n        }\n\n        if (options.realmId) {\n            // nested `/realms/:realmId/consents` mount — mandatory constraint,\n            // not overridable by a rapiq filter\n            qb.andWhere('consent.realmId = :realmId', { realmId: options.realmId });\n        }\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneById(id: string): Promise<Consent | null> {\n        return this.repository.findOneBy({ id });\n    }\n\n    async findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]> {\n        const qb = this.repository.createQueryBuilder('consent');\n        qb.where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n            clientId,\n            sub: owner.sub,\n            subKind: owner.subKind,\n        });\n        qb.cache(\n            buildRedisKeyPath({\n                prefix: CachePrefix.CONSENT_COVERING,\n                key: `${clientId}:${owner.subKind}:${owner.sub}`,\n            }),\n            60_000,\n        );\n\n        return qb.getMany();\n    }\n\n    async insertMissing(input: {\n        clientId: string,\n        realmId: string,\n        owner: ConsentOwner,\n        scopes: string[]\n    }): Promise<void> {\n        // uncached read — the diff must see the latest rows, and the covering\n        // cache entry must not be refreshed on the write path.\n        const existing = await this.repository.createQueryBuilder('consent')\n            .where('consent.clientId = :clientId AND consent.sub = :sub AND consent.subKind = :subKind', {\n                clientId: input.clientId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n            })\n            .getMany();\n\n        const existingTokens = new Set(existing.map((row) => row.scope));\n        const missing = input.scopes.filter((token) => !existingTokens.has(token));\n\n        // save-per-row (never a raw qb insert): entity-manager saves fire the\n        // ConsentEntitySubscriber — covering-cache invalidation, realtime\n        // destinations and audit mirroring depend on it. A duplicate-key\n        // violation is the benign race outcome under the unique index.\n        // Set the userId FK only when the subject is a user, so a user\n        // deletion cascade-drops its consent rows; non-user subjects leave it\n        // null (the row is still cleaned up when its client/realm is deleted).\n        const userId = input.owner.subKind === IdentityType.USER ?\n            input.owner.sub :\n            null;\n\n        for (const scope of missing) {\n            const entity = this.repository.create({\n                clientId: input.clientId,\n                realmId: input.realmId,\n                userId,\n                sub: input.owner.sub,\n                subKind: input.owner.subKind,\n                scope,\n                expiresAt: null,\n            });\n\n            try {\n                await this.repository.save(entity);\n            } catch (e) {\n                if (!isUniqueConstraintDatabaseError(e)) {\n                    throw e;\n                }\n            }\n        }\n    }\n\n    async remove(entity: Consent): Promise<void> {\n        await this.repository.remove(entity as ConsentEntity);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAaQ,2BAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,aAAAA;CAC/C;CAEA,MAAMO,SACFC,OACAC,UAAkC,CAAC,GACa;EAChD,MAAMC,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAE9C,MAAM,EAAEC,eAAef,WAAWa,IAAIF,KAAAA;EAEtCN,sBAAsBQ,IAAI,WAAW,CAAC,OAAO,SAAU,CAAA;EAUvDA,GAAGG,SAAS,kBAAkB,QAAA,CAAA,CACzBC,UAAU;GACP;GACA;GACA;GACA;GACA;EACH,CAAA;EAEL,IAAIL,QAAQM,OAERL,GAAGM,SAAS,+DAA+D;GACvEC,UAAUR,QAAQM,MAAMG;GACxBC,cAAcV,QAAQM,MAAMK;EAChC,CAAA;EAGJ,IAAIX,QAAQY,SAGRX,GAAGM,SAAS,8BAA8B,EAAEK,SAASZ,QAAQY,QAAQ,CAAA;EAGzE,MAAM,CAACC,UAAUC,SAAS,MAAMb,GAAGc,gBAAe;EAElD,OAAO;GACHC,MAAM3B,sBAAsBU,OAAOc,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGX;GACP;EACJ;CACJ;CAEA,MAAMe,YAAYC,IAAqC;EACnD,OAAO,KAAKxB,WAAWyB,UAAU,EAAED,GAAG,CAAA;CAC1C;CAEA,MAAME,uBAAuBC,UAAkBhB,OAAyC;EACpF,MAAML,KAAK,KAAKN,WAAWO,mBAAmB,SAAA;EAC9CD,GAAGsB,MAAM,sFAAsF;GAC3FD;GACAb,KAAKH,MAAMG;GACXE,SAASL,MAAMK;EACnB,CAAA;EACAV,GAAGuB,MACCrC,kBAAkB;GACdsC,QAAQnC,YAAYoC;GACpBC,KAAK,GAAGL,SAAS,GAAGhB,MAAMK,QAAQ,GAAGL,MAAMG;EAC/C,CAAA,GACA,GAAA;EAGJ,OAAOR,GAAG2B,QAAO;CACrB;CAEA,MAAMC,cAAcC,OAKF;EAGd,MAAMC,WAAW,MAAM,KAAKpC,WAAWO,mBAAmB,SAAA,CAAA,CACrDqB,MAAM,sFAAsF;GACzFD,UAAUQ,MAAMR;GAChBb,KAAKqB,MAAMxB,MAAMG;GACjBE,SAASmB,MAAMxB,MAAMK;EACzB,CAAA,CAAA,CACCiB,QAAO;EAEZ,MAAMI,iBAAiB,IAAIC,IAAIF,SAASG,KAAKC,QAAQA,IAAIC,KAAK,CAAA;EAC9D,MAAMC,UAAUP,MAAMQ,OAAOC,QAAQC,UAAU,CAACR,eAAeS,IAAID,KAAAA,CAAAA;EASnE,MAAME,SAASZ,MAAMxB,MAAMK,YAAYzB,aAAayD,OAChDb,MAAMxB,MAAMG,MACZ;EAEJ,KAAK,MAAM2B,SAASC,SAAS;GACzB,MAAMO,SAAS,KAAKjD,WAAWkD,OAAO;IAClCvB,UAAUQ,MAAMR;IAChBV,SAASkB,MAAMlB;IACf8B;IACAjC,KAAKqB,MAAMxB,MAAMG;IACjBE,SAASmB,MAAMxB,MAAMK;IACrByB;IACAU,WAAW;GACf,CAAA;GAEA,IAAI;IACA,MAAM,KAAKnD,WAAWoD,KAAKH,MAAAA;GAC/B,SAASI,GAAG;IACR,IAAI,CAACxD,gCAAgCwD,CAAAA,GACjC,MAAMA;GAEd;EACJ;CACJ;CAEA,MAAMC,OAAOL,QAAgC;EACzC,MAAM,KAAKjD,WAAWsD,OAAOL,MAAAA;CACjC;AACJ"}

package/dist/app/modules/oauth2/repositories/console-login/index.d.ts

@@ -0,0 +1,2 @@
+export * from './store.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/modules/oauth2/repositories/console-login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/console-login/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC"}

package/dist/app/modules/oauth2/repositories/console-login/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ConsoleLoginStore } from "./store.mjs";
+export { ConsoleLoginStore };

package/dist/app/modules/oauth2/repositories/console-login/store.d.ts

@@ -0,0 +1,19 @@
+import type { ICache } from '@authup/server-kit';
+import type { ConsoleLoginPending, IConsoleLoginStore } from '../../../../../core/index.ts';
+/**
+ * The pending console login is a 5-minute blob, so a cache entry is the right
+ * home for it, unlike the session credential it leads to: that one is a
+ * multi-day credential and lives on the `auth_sessions` row (plan 088).
+ *
+ * Deployment note (the federated login's): the kick and the callback must
+ * reach the same cache, so a multi-replica deployment without redis needs
+ * sticky routing.
+ */
+export declare class ConsoleLoginStore implements IConsoleLoginStore {
+    protected cache: ICache;
+    constructor(cache: ICache);
+    save(data: ConsoleLoginPending): Promise<string>;
+    find(id: string): Promise<ConsoleLoginPending | null>;
+    consume(id: string): Promise<ConsoleLoginPending | null>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/app/modules/oauth2/repositories/console-login/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/console-login/store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EACR,mBAAmB,EACnB,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAItC;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC;gBAEb,KAAK,EAAE,MAAM;IAInB,IAAI,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAehD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAOrD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAUjE"}

package/dist/app/modules/oauth2/repositories/console-login/store.mjs

@@ -0,0 +1,47 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { CONSOLE_LOGIN_TTL } from "../../../../../core/oauth2/console-login/constants.mjs";
+import "../../../../../core/index.mjs";
+import { CacheOAuth2Prefix } from "../constants.mjs";
+import { createNanoID } from "@authup/kit";
+import { buildCacheKey } from "@authup/server-kit";
+//#region src/app/modules/oauth2/repositories/console-login/store.ts
+/**
+* The pending console login is a 5-minute blob, so a cache entry is the right
+* home for it, unlike the session credential it leads to: that one is a
+* multi-day credential and lives on the `auth_sessions` row (plan 088).
+*
+* Deployment note (the federated login's): the kick and the callback must
+* reach the same cache, so a multi-replica deployment without redis needs
+* sticky routing.
+*/ var ConsoleLoginStore = class {
+	cache;
+	constructor(cache) {
+		this.cache = cache;
+	}
+	async save(data) {
+		const id = createNanoID();
+		await this.cache.set(buildCacheKey({
+			prefix: CacheOAuth2Prefix.CONSOLE_LOGIN,
+			key: id
+		}), data, { ttl: CONSOLE_LOGIN_TTL });
+		return id;
+	}
+	async find(id) {
+		return this.cache.get(buildCacheKey({
+			prefix: CacheOAuth2Prefix.CONSOLE_LOGIN,
+			key: id
+		}));
+	}
+	async consume(id) {
+		return this.cache.pop(buildCacheKey({
+			prefix: CacheOAuth2Prefix.CONSOLE_LOGIN,
+			key: id
+		}));
+	}
+};
+//#endregion
+export { ConsoleLoginStore };
+
+//# sourceMappingURL=store.mjs.map

package/dist/app/modules/oauth2/repositories/console-login/store.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.mjs","names":["createNanoID","buildCacheKey","CONSOLE_LOGIN_TTL","CacheOAuth2Prefix","ConsoleLoginStore","cache","save","data","id","set","prefix","CONSOLE_LOGIN","key","ttl","find","get","consume","pop"],"sources":["../../../../../../src/app/modules/oauth2/repositories/console-login/store.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createNanoID } from '@authup/kit';\nimport type { ICache } from '@authup/server-kit';\nimport { buildCacheKey } from '@authup/server-kit';\nimport type {\n    ConsoleLoginPending,\n    IConsoleLoginStore,\n} from '../../../../../core/index.ts';\nimport { CONSOLE_LOGIN_TTL } from '../../../../../core/index.ts';\nimport { CacheOAuth2Prefix } from '../constants.ts';\n\n/**\n * The pending console login is a 5-minute blob, so a cache entry is the right\n * home for it, unlike the session credential it leads to: that one is a\n * multi-day credential and lives on the `auth_sessions` row (plan 088).\n *\n * Deployment note (the federated login's): the kick and the callback must\n * reach the same cache, so a multi-replica deployment without redis needs\n * sticky routing.\n */\nexport class ConsoleLoginStore implements IConsoleLoginStore {\n    protected cache : ICache;\n\n    constructor(cache: ICache) {\n        this.cache = cache;\n    }\n\n    async save(data: ConsoleLoginPending): Promise<string> {\n        const id = createNanoID();\n\n        await this.cache.set(\n            buildCacheKey({\n                prefix: CacheOAuth2Prefix.CONSOLE_LOGIN,\n                key: id,\n            }),\n            data,\n            { ttl: CONSOLE_LOGIN_TTL },\n        );\n\n        return id;\n    }\n\n    async find(id: string): Promise<ConsoleLoginPending | null> {\n        return this.cache.get<ConsoleLoginPending>(buildCacheKey({\n            prefix: CacheOAuth2Prefix.CONSOLE_LOGIN,\n            key: id,\n        }));\n    }\n\n    async consume(id: string): Promise<ConsoleLoginPending | null> {\n        // `pop` is the atomic read-and-drop (redis GETDEL, one tick on the\n        // memory adapter). A get followed by a drop is two round-trips, and\n        // two simultaneous callbacks for one pending login would both read the\n        // payload before either drop landed.\n        return this.cache.pop<ConsoleLoginPending>(buildCacheKey({\n            prefix: CacheOAuth2Prefix.CONSOLE_LOGIN,\n            key: id,\n        }));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;GA0BA,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYA,OAAe;EACvB,KAAKA,QAAQA;CACjB;CAEA,MAAMC,KAAKC,MAA4C;EACnD,MAAMC,KAAKR,aAAAA;EAEX,MAAM,KAAKK,MAAMI,IACbR,cAAc;GACVS,QAAQP,kBAAkBQ;GAC1BC,KAAKJ;EACT,CAAA,GACAD,MACA,EAAEM,KAAKX,kBAAkB,CAAA;EAG7B,OAAOM;CACX;CAEA,MAAMM,KAAKN,IAAiD;EACxD,OAAO,KAAKH,MAAMU,IAAyBd,cAAc;GACrDS,QAAQP,kBAAkBQ;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CACJ;CAEA,MAAMQ,QAAQR,IAAiD;EAK3D,OAAO,KAAKH,MAAMY,IAAyBhB,cAAc;GACrDS,QAAQP,kBAAkBQ;GAC1BC,KAAKJ;EACT,CAAA,CAAA;CACJ;AACJ"}

package/dist/app/modules/oauth2/repositories/constants.d.ts

@@ -1,6 +1,7 @@
 export declare enum CacheOAuth2Prefix {
     AUTHORIZATION_STATE = "oauth2_authorization_state",
     AUTHORIZATION_CODE = "oauth2_authorization_code",
+    CONSOLE_LOGIN = "oauth2_console_login",
     FEDERATED_LOGIN = "oauth2_federated_login",
     TOKEN = "oauth2_token",
     TOKEN_CLAIMS = "oauth2_token_claims",

package/dist/app/modules/oauth2/repositories/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB,mBAAmB,+BAA+B;IAClD,kBAAkB,8BAA8B;IAChD,eAAe,2BAA2B;IAC1C,KAAK,iBAAiB;IACtB,YAAY,wBAAwB;IACpC,cAAc,yBAAyB;CAC1C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB,mBAAmB,+BAA+B;IAClD,kBAAkB,8BAA8B;IAChD,aAAa,yBAAyB;IACtC,eAAe,2BAA2B;IAC1C,KAAK,iBAAiB;IACtB,YAAY,wBAAwB;IACpC,cAAc,yBAAyB;CAC1C"}

package/dist/app/modules/oauth2/repositories/constants.mjs

@@ -5,6 +5,7 @@ import.meta.url;
 var CacheOAuth2Prefix = /*#__PURE__*/ function(CacheOAuth2Prefix) {
 	CacheOAuth2Prefix["AUTHORIZATION_STATE"] = "oauth2_authorization_state";
 	CacheOAuth2Prefix["AUTHORIZATION_CODE"] = "oauth2_authorization_code";
+	CacheOAuth2Prefix["CONSOLE_LOGIN"] = "oauth2_console_login";
 	CacheOAuth2Prefix["FEDERATED_LOGIN"] = "oauth2_federated_login";
 	CacheOAuth2Prefix["TOKEN"] = "oauth2_token";
 	CacheOAuth2Prefix["TOKEN_CLAIMS"] = "oauth2_token_claims";

package/dist/app/modules/oauth2/repositories/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n    AUTHORIZATION_STATE = 'oauth2_authorization_state',\n    AUTHORIZATION_CODE = 'oauth2_authorization_code',\n    FEDERATED_LOGIN = 'oauth2_federated_login',\n    TOKEN = 'oauth2_token',\n    TOKEN_CLAIMS = 'oauth2_token_claims',\n    TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA;;;;;;;CAAAA,OAAAA;AAOX,EAAA,CAAA,CAAA"}
+{"version":3,"file":"constants.mjs","names":["CacheOAuth2Prefix"],"sources":["../../../../../src/app/modules/oauth2/repositories/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nexport enum CacheOAuth2Prefix {\n    AUTHORIZATION_STATE = 'oauth2_authorization_state',\n    AUTHORIZATION_CODE = 'oauth2_authorization_code',\n    CONSOLE_LOGIN = 'oauth2_console_login',\n    FEDERATED_LOGIN = 'oauth2_federated_login',\n    TOKEN = 'oauth2_token',\n    TOKEN_CLAIMS = 'oauth2_token_claims',\n    TOKEN_INACTIVE = 'oauth2_token_blocked',\n}\n"],"mappings":";;;;AAOA,IAAO,oBAAKA,uBAAAA,mBAAAA;;;;;;;;CAAAA,OAAAA;AAQX,EAAA,CAAA,CAAA"}

package/dist/app/modules/oauth2/repositories/index.d.ts

@@ -1,6 +1,7 @@
 export * from './authorize/index.ts';
 export * from './client/index.ts';
 export * from './consent/index.ts';
+export * from './console-login/index.ts';
 export * from './federated-login/index.ts';
 export * from './scope/index.ts';
 export * from './session-token/index.ts';

package/dist/app/modules/oauth2/repositories/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/app/modules/oauth2/repositories/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC"}

package/dist/app/modules/oauth2/repositories/index.mjs

@@ -8,6 +8,8 @@ import { OAuth2ClientRepository } from "./client/repository.mjs";
 import "./client/index.mjs";
 import { ConsentRepositoryAdapter } from "./consent/repository.mjs";
 import "./consent/index.mjs";
+import { ConsoleLoginStore } from "./console-login/store.mjs";
+import "./console-login/index.mjs";
 import { OAuth2FederatedLoginStore } from "./federated-login/store.mjs";
 import "./federated-login/index.mjs";
 import { OAuth2ScopeRepository } from "./scope/repository.mjs";
@@ -15,4 +17,4 @@ import { SessionTokenRepositoryAdapter } from "./session-token/repository.mjs";
 import "./session-token/index.mjs";
 import { OAuth2TokenRepository } from "./token/repository.mjs";
 import "./token/index.mjs";
-export { ConsentRepositoryAdapter, OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2FederatedLoginStore, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };
+export { ConsentRepositoryAdapter, ConsoleLoginStore, OAuth2AuthorizationCodeRepository, OAuth2AuthorizationStateRepository, OAuth2ClientRepository, OAuth2FederatedLoginStore, OAuth2ScopeRepository, OAuth2TokenRepository, SessionTokenRepositoryAdapter };

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts

@@ -3,7 +3,7 @@ import type { IQuery } from '@rapiq/core';
 import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
 import type { DataSource, Repository, SelectQueryBuilder } from 'typeorm';
 import { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';
-import type { ISessionTokenRepository, SessionTokenCreateInput, SessionTokenRef } from '../../../../../core/index.ts';
+import type { ISessionTokenRepository, SessionTokenCreateInput, SessionTokenDeleteExpiredOptions, SessionTokenRef } from '../../../../../core/index.ts';
 export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepository {
     protected repository: Repository<SessionTokenEntity>;
     constructor(dataSource: DataSource);
@@ -36,6 +36,6 @@ export declare class SessionTokenRepositoryAdapter implements ISessionTokenRepos
     findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>>;
     findOneWithSessionById(id: string): Promise<SessionToken | null>;
     findAllByQuery(query: IQuery): Promise<SessionToken[]>;
-    deleteExpired(before: string): Promise<number>;
+    deleteExpired(before: string, options?: SessionTokenDeleteExpiredOptions): Promise<number>;
 }
 //# sourceMappingURL=repository.d.ts.map

package/dist/app/modules/oauth2/repositories/session-token/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAG1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAGvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IA0C7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsBlF;;;;;;;;OAQG;IACH,SAAS,CAAC,kBAAkB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAavE;;;;;;;OAOG;IACH,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAShE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAmB9E,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUhE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAUtD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAKvD"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAI1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAGvF,OAAO,KAAK,EACR,uBAAuB,EACvB,uBAAuB,EACvB,gCAAgC,EAChC,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAEtC,qBAAa,6BAA8B,YAAW,uBAAuB;IACzE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBAEzC,UAAU,EAAE,UAAU;IAI5B,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IA0C7D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI3D,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAsBlF;;;;;;;;OAQG;IACH,SAAS,CAAC,kBAAkB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAavE;;;;;;;OAOG;IACH,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAShE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAmB9E,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUhE,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAUtD,aAAa,CACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gCAAqC,GAC/C,OAAO,CAAC,MAAM,CAAC;CAOrB"}

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs

@@ -3,11 +3,13 @@ import "node:url";
 import.meta.url;
 import { SessionTokenEntity } from "../../../../../adapters/database/domains/session-token/entity.mjs";
 import "../../../../../adapters/database/domains/index.mjs";
+import { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE } from "../../../../../core/oauth2/session-token/constants.mjs";
 import { SessionTokenRelationMissingError } from "../../../../../core/oauth2/session-token/error.mjs";
 import "../../../../../core/index.mjs";
 import { applyQuery, redactFieldConditions } from "../../../database/repositories/query.mjs";
 import { isForeignKeyConstraintDatabaseError } from "../../../../../adapters/database/errors/driver.mjs";
 import "../../../../../adapters/database/errors/index.mjs";
+import { deleteInBatches, resolveSweepBatchSize } from "../../../database/repositories/helpers.mjs";
 import { In, LessThan } from "typeorm";
 //#region src/app/modules/oauth2/repositories/session-token/repository.ts
 var SessionTokenRepositoryAdapter = class {
@@ -76,7 +78,7 @@ var SessionTokenRepositoryAdapter = class {
 	* a projection cannot neutralize the gate the way a stripped `realmId`
 	* once could on the entity repositories (plan 039).
 	*/ joinSessionForGate(qb) {
-		if (!qb.expressionMap.joinAttributes.some((join) => join.alias.name === "session")) qb.leftJoin("sessionToken.session", "session");
+		if (qb.expressionMap.joinAttributes.every((join) => join.alias.name !== "session")) qb.leftJoin("sessionToken.session", "session");
 		qb.addSelect([
 			"session.id",
 			"session.sub",
@@ -125,8 +127,8 @@ var SessionTokenRepositoryAdapter = class {
 		this.joinSessionForGate(qb);
 		return qb.getMany();
 	}
-	async deleteExpired(before) {
-		return (await this.repository.delete({ expiresAt: LessThan(before) })).affected ?? 0;
+	async deleteExpired(before, options = {}) {
+		return deleteInBatches(this.repository, { expiresAt: LessThan(before) }, resolveSweepBatchSize(options.batchSize, SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE));
 	}
 };
 //#endregion

package/dist/app/modules/oauth2/repositories/session-token/repository.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repository.mjs","names":["In","LessThan","applyQuery","redactFieldConditions","SessionTokenEntity","isForeignKeyConstraintDatabaseError","SessionTokenRelationMissingError","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","clientId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","e","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","joinSessionForGate","qb","expressionMap","joinAttributes","some","join","alias","name","leftJoin","addSelect","joinClientSummary","findMany","query","pagination","entities","total","getManyAndCount","data","meta","findOneWithSessionById","getOne","findAllByQuery","getMany","deleteExpired","before","delete"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DataSource, Repository, SelectQueryBuilder } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isForeignKeyConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport { SessionTokenRelationMissingError } from '../../../../../core/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            clientId: input.clientId ?? null,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        try {\n            await this.repository.insert(entity);\n        } catch (e) {\n            // A rejection means one of the two parents was deleted between the\n            // caller resolving it and this write: the session (a concurrent\n            // replay reaction, logout, force-logout or sweep) or the client the\n            // token is attributed to. Both cascade onto this table, so either\n            // way the token rows are already gone and the caller's answer is the\n            // same, which is why the error names neither. Report that condition\n            // instead of letting a driver error escape as an unhandled internal\n            // error (issue #3435).\n            if (isForeignKeyConstraintDatabaseError(e)) {\n                throw new SessionTokenRelationMissingError();\n            }\n\n            throw e;\n        }\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    /**\n     * Join the session and pin the columns authorization reads.\n     *\n     * A token row carries no realm or subject, so `SessionTokenService`\n     * resolves both through `session`. The join is unconditional and the three\n     * columns are selected regardless of the client's `fields` projection, so\n     * a projection cannot neutralize the gate the way a stripped `realmId`\n     * once could on the entity repositories (plan 039).\n     */\n    protected joinSessionForGate(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        if (!qb.expressionMap.joinAttributes.some((join) => join.alias.name === 'session')) {\n            qb.leftJoin('sessionToken.session', 'session');\n        }\n\n        qb.addSelect([\n            'session.id',\n            'session.sub',\n            'session.subKind',\n            'session.realmId',\n        ]);\n    }\n\n    /**\n     * Always expose only a client SUMMARY (id / name / displayName) on the\n     * read paths — the consent-list shape. `client` is deliberately absent\n     * from the schema's relations allow-list, so a raw `?include=client`\n     * cannot force the full-column join (redirect patterns, grant types,\n     * secret storage flags, accessPolicyId), while a self-service reader\n     * without CLIENT_READ still gets the application name per token row.\n     */\n    protected joinClientSummary(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        qb.leftJoin('sessionToken.client', 'client');\n        qb.addSelect([\n            'client.id',\n            'client.name',\n            'client.displayName',\n        ]);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        const { pagination } = applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneWithSessionById(id: string): Promise<SessionToken | null> {\n        const qb = this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.id = :id', { id });\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        return qb.getOne();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<SessionToken[]> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n\n        return qb.getMany();\n    }\n\n    async deleteExpired(before: string): Promise<number> {\n        const result = await this.repository.delete({ expiresAt: LessThan(before) });\n\n        return result.affected ?? 0;\n    }\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,IAAaO,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcN,kBAAAA;CAC/C;CAEA,MAAMO,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,UAAUJ,MAAMI,YAAY;GAC5BC,MAAML,MAAMK;GACZC,UAAUN,MAAMM,YAAY;GAC5BC,gBAAgBP,MAAMO,kBAAkB;GACxCC,WAAWR,MAAMQ;GACjBC,WAAWT,MAAMS;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWZ,MAAMY;EACrB,CAAA;EAEA,IAAI;GACA,MAAM,KAAKhB,WAAWiB,OAAOZ,MAAAA;EACjC,SAASa,GAAG;GASR,IAAIrB,oCAAoCqB,CAAAA,GACpC,MAAM,IAAIpB,iCAAAA;GAGd,MAAMoB;EACV;EAMAb,OAAOc,YAAYd,OAAOc,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOhB;CACX;CAEA,MAAMiB,YAAYhB,IAA0C;EACxD,OAAO,KAAKN,WAAWuB,QAAQ,EAAEC,OAAO,EAAElB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMmB,gBAAgBlB,WAA4C;EAC9D,OAAO,KAAKP,WAAW0B,KAAK,EAAEF,OAAO,EAAEjB,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMoB,oBAAoBrB,IAAYsB,IAA8B;EAUhE,SAAQC,MATa,KAAK7B,WAAW8B,mBAAkB,CAAA,CAClDC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAElB,YAAYc,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiB1B,UAAoC;EAMvD,OAAO2B,MALa,KAAKrC,WAAW8B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEd,SAAS,CAAA,CAAA,CACtDuB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYsB,IAA2B;EACpD,MAAM,KAAK5B,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkBjC,WAAmBqB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKzC,WAAW0B,KAAK;GACpCF,OAAO,EAAEjB,UAAU;GACnBmC,QAAQ;IAAEpC,IAAI;IAAMU,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC4B,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRU,WAAW6B,IAAI7B;EACnB,EAAA;EACA,IAAI2B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOnC,kBAAAA,CAAAA,CACPoC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAElB,IAAId,GAAGmD,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C2B,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;;;;;;;;;IAWA,mBAA6BM,IAA4C;EACrE,IAAI,CAACA,GAAGC,cAAcC,eAAeC,MAAMC,SAASA,KAAKC,MAAMC,SAAS,SAAA,GACpEN,GAAGO,SAAS,wBAAwB,SAAA;EAGxCP,GAAGQ,UAAU;GACT;GACA;GACA;GACA;EACH,CAAA;CACL;;;;;;;;IAUA,kBAA4BR,IAA4C;EACpEA,GAAGO,SAAS,uBAAuB,QAAA;EACnCP,GAAGQ,UAAU;GACT;GACA;GACA;EACH,CAAA;CACL;CAEA,MAAME,SAASC,OAAsE;EACjF,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9C,MAAM,EAAE+B,eAAenE,WAAWuD,IAAIW,KAAAA;EAEtC,KAAKZ,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,MAAM,CAACa,UAAUC,SAAS,MAAMd,GAAGe,gBAAe;EAElD,OAAO;GACHC,MAAMtE,sBAAsBiE,OAAOE,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,uBAAuB7D,IAA0C;EACnE,MAAM2C,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA,CAAA,CACzCN,MAAM,yBAAyB,EAAElB,GAAG,CAAA;EAEzC,KAAK0C,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,OAAOA,GAAGmB,OAAM;CACpB;CAEA,MAAMC,eAAeT,OAAwC;EACzD,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9CpC,WAAWuD,IAAIW,KAAAA;EAEf,KAAKZ,mBAAmBC,EAAAA;EAExB,OAAOA,GAAGqB,QAAO;CACrB;CAEA,MAAMC,cAAcC,QAAiC;EAGjD,QAAO3C,MAFc,KAAK7B,WAAWyE,OAAO,EAAEzD,WAAWvB,SAAS+E,MAAAA,EAAQ,CAAA,EAAA,CAE5DrC,YAAY;CAC9B;AACJ"}
+{"version":3,"file":"repository.mjs","names":["In","LessThan","applyQuery","redactFieldConditions","deleteInBatches","resolveSweepBatchSize","SessionTokenEntity","isForeignKeyConstraintDatabaseError","SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE","SessionTokenRelationMissingError","SessionTokenRepositoryAdapter","repository","dataSource","getRepository","create","input","entity","id","sessionId","clientId","kind","parentId","refreshTokenId","ipAddress","userAgent","consumedAt","revokedAt","expiresAt","insert","e","createdAt","Date","toISOString","findOneById","findOne","where","findBySessionId","find","markRefreshConsumed","at","result","createQueryBuilder","update","set","andWhere","execute","affected","hasConsumedChild","count","getCount","revokeById","revokeBySessionId","rows","select","refs","map","row","length","ref","joinSessionForGate","qb","expressionMap","joinAttributes","every","join","alias","name","leftJoin","addSelect","joinClientSummary","findMany","query","pagination","entities","total","getManyAndCount","data","meta","findOneWithSessionById","getOne","findAllByQuery","getMany","deleteExpired","before","options","batchSize"],"sources":["../../../../../../src/app/modules/oauth2/repositories/session-token/repository.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { SessionToken } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\nimport type { DataSource, Repository, SelectQueryBuilder } from 'typeorm';\nimport { In, LessThan } from 'typeorm';\nimport { applyQuery, redactFieldConditions } from '../../../database/repositories/query.ts';\nimport { deleteInBatches, resolveSweepBatchSize } from '../../../database/repositories/helpers.ts';\nimport { SessionTokenEntity } from '../../../../../adapters/database/domains/index.ts';\nimport { isForeignKeyConstraintDatabaseError } from '../../../../../adapters/database/errors/index.ts';\nimport { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, SessionTokenRelationMissingError } from '../../../../../core/index.ts';\nimport type {\n    ISessionTokenRepository,\n    SessionTokenCreateInput,\n    SessionTokenDeleteExpiredOptions,\n    SessionTokenRef,\n} from '../../../../../core/index.ts';\n\nexport class SessionTokenRepositoryAdapter implements ISessionTokenRepository {\n    protected repository: Repository<SessionTokenEntity>;\n\n    constructor(dataSource: DataSource) {\n        this.repository = dataSource.getRepository(SessionTokenEntity);\n    }\n\n    async create(input: SessionTokenCreateInput): Promise<SessionToken> {\n        const entity = this.repository.create({\n            id: input.id,\n            sessionId: input.sessionId,\n            clientId: input.clientId ?? null,\n            kind: input.kind,\n            parentId: input.parentId ?? null,\n            refreshTokenId: input.refreshTokenId ?? null,\n            ipAddress: input.ipAddress,\n            userAgent: input.userAgent,\n            consumedAt: null,\n            revokedAt: null,\n            expiresAt: input.expiresAt,\n        });\n\n        try {\n            await this.repository.insert(entity);\n        } catch (e) {\n            // A rejection means one of the two parents was deleted between the\n            // caller resolving it and this write: the session (a concurrent\n            // replay reaction, logout, force-logout or sweep) or the client the\n            // token is attributed to. Both cascade onto this table, so either\n            // way the token rows are already gone and the caller's answer is the\n            // same, which is why the error names neither. Report that condition\n            // instead of letting a driver error escape as an unhandled internal\n            // error (issue #3435).\n            if (isForeignKeyConstraintDatabaseError(e)) {\n                throw new SessionTokenRelationMissingError();\n            }\n\n            throw e;\n        }\n\n        // insert() does not hydrate @CreateDateColumn back onto the in-memory\n        // entity (the DB fills created_at via its DEFAULT). Stamp it so the\n        // returned object satisfies the SessionToken contract instead of\n        // carrying an undefined createdAt.\n        entity.createdAt = entity.createdAt ?? new Date().toISOString();\n\n        return entity;\n    }\n\n    async findOneById(id: string): Promise<SessionToken | null> {\n        return this.repository.findOne({ where: { id } });\n    }\n\n    async findBySessionId(sessionId: string): Promise<SessionToken[]> {\n        return this.repository.find({ where: { sessionId } });\n    }\n\n    async markRefreshConsumed(id: string, at: string): Promise<boolean> {\n        const result = await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ consumedAt: at })\n            .where('id = :id', { id })\n            .andWhere('kind = :kind', { kind: 'refresh' })\n            .andWhere('consumedAt IS NULL')\n            .andWhere('revokedAt IS NULL')\n            .execute();\n\n        return (result.affected ?? 0) > 0;\n    }\n\n    async hasConsumedChild(parentId: string): Promise<boolean> {\n        const count = await this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.parentId = :parentId', { parentId })\n            .andWhere('sessionToken.consumedAt IS NOT NULL')\n            .getCount();\n\n        return count > 0;\n    }\n\n    async revokeById(id: string, at: string): Promise<void> {\n        await this.repository.createQueryBuilder()\n            .update(SessionTokenEntity)\n            .set({ revokedAt: at })\n            .where('id = :id', { id })\n            .andWhere('revokedAt IS NULL')\n            .execute();\n    }\n\n    async revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]> {\n        const rows = await this.repository.find({\n            where: { sessionId },\n            select: { id: true, expiresAt: true },\n        });\n\n        const refs: SessionTokenRef[] = rows.map((row) => ({\n            id: row.id,\n            expiresAt: row.expiresAt,\n        }));\n        if (refs.length > 0) {\n            await this.repository.createQueryBuilder()\n                .update(SessionTokenEntity)\n                .set({ revokedAt: at })\n                .where({ id: In(refs.map((ref) => ref.id)) })\n                .andWhere('revokedAt IS NULL')\n                .execute();\n        }\n\n        return refs;\n    }\n\n    /**\n     * Join the session and pin the columns authorization reads.\n     *\n     * A token row carries no realm or subject, so `SessionTokenService`\n     * resolves both through `session`. The join is unconditional and the three\n     * columns are selected regardless of the client's `fields` projection, so\n     * a projection cannot neutralize the gate the way a stripped `realmId`\n     * once could on the entity repositories (plan 039).\n     */\n    protected joinSessionForGate(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        if (qb.expressionMap.joinAttributes.every((join) => join.alias.name !== 'session')) {\n            qb.leftJoin('sessionToken.session', 'session');\n        }\n\n        qb.addSelect([\n            'session.id',\n            'session.sub',\n            'session.subKind',\n            'session.realmId',\n        ]);\n    }\n\n    /**\n     * Always expose only a client SUMMARY (id / name / displayName) on the\n     * read paths — the consent-list shape. `client` is deliberately absent\n     * from the schema's relations allow-list, so a raw `?include=client`\n     * cannot force the full-column join (redirect patterns, grant types,\n     * secret storage flags, accessPolicyId), while a self-service reader\n     * without CLIENT_READ still gets the application name per token row.\n     */\n    protected joinClientSummary(qb: SelectQueryBuilder<SessionTokenEntity>) {\n        qb.leftJoin('sessionToken.client', 'client');\n        qb.addSelect([\n            'client.id',\n            'client.name',\n            'client.displayName',\n        ]);\n    }\n\n    async findMany(query: IQuery): Promise<EntityRepositoryFindManyResult<SessionToken>> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        const { pagination } = applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        const [entities, total] = await qb.getManyAndCount();\n\n        return {\n            data: redactFieldConditions(query, entities),\n            meta: {\n                total,\n                ...pagination,\n            },\n        };\n    }\n\n    async findOneWithSessionById(id: string): Promise<SessionToken | null> {\n        const qb = this.repository.createQueryBuilder('sessionToken')\n            .where('sessionToken.id = :id', { id });\n\n        this.joinSessionForGate(qb);\n        this.joinClientSummary(qb);\n\n        return qb.getOne();\n    }\n\n    async findAllByQuery(query: IQuery): Promise<SessionToken[]> {\n        const qb = this.repository.createQueryBuilder('sessionToken');\n\n        applyQuery(qb, query);\n\n        this.joinSessionForGate(qb);\n\n        return qb.getMany();\n    }\n\n    async deleteExpired(\n        before: string,\n        options: SessionTokenDeleteExpiredOptions = {},\n    ): Promise<number> {\n        return deleteInBatches(\n            this.repository,\n            { expiresAt: LessThan(before) },\n            resolveSweepBatchSize(options.batchSize, SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE),\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBA,IAAaU,gCAAb,MAAaA;CACCC;CAEV,YAAYC,YAAwB;EAChC,KAAKD,aAAaC,WAAWC,cAAcP,kBAAAA;CAC/C;CAEA,MAAMQ,OAAOC,OAAuD;EAChE,MAAMC,SAAS,KAAKL,WAAWG,OAAO;GAClCG,IAAIF,MAAME;GACVC,WAAWH,MAAMG;GACjBC,UAAUJ,MAAMI,YAAY;GAC5BC,MAAML,MAAMK;GACZC,UAAUN,MAAMM,YAAY;GAC5BC,gBAAgBP,MAAMO,kBAAkB;GACxCC,WAAWR,MAAMQ;GACjBC,WAAWT,MAAMS;GACjBC,YAAY;GACZC,WAAW;GACXC,WAAWZ,MAAMY;EACrB,CAAA;EAEA,IAAI;GACA,MAAM,KAAKhB,WAAWiB,OAAOZ,MAAAA;EACjC,SAASa,GAAG;GASR,IAAItB,oCAAoCsB,CAAAA,GACpC,MAAM,IAAIpB,iCAAAA;GAGd,MAAMoB;EACV;EAMAb,OAAOc,YAAYd,OAAOc,8BAAa,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;EAE7D,OAAOhB;CACX;CAEA,MAAMiB,YAAYhB,IAA0C;EACxD,OAAO,KAAKN,WAAWuB,QAAQ,EAAEC,OAAO,EAAElB,GAAG,EAAE,CAAA;CACnD;CAEA,MAAMmB,gBAAgBlB,WAA4C;EAC9D,OAAO,KAAKP,WAAW0B,KAAK,EAAEF,OAAO,EAAEjB,UAAU,EAAE,CAAA;CACvD;CAEA,MAAMoB,oBAAoBrB,IAAYsB,IAA8B;EAUhE,SAAQC,MATa,KAAK7B,WAAW8B,mBAAkB,CAAA,CAClDC,OAAOpC,kBAAAA,CAAAA,CACPqC,IAAI,EAAElB,YAAYc,GAAG,CAAA,CAAA,CACrBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,gBAAgB,EAAExB,MAAM,UAAU,CAAA,CAAA,CAC3CwB,SAAS,oBAAA,CAAA,CACTA,SAAS,mBAAA,CAAA,CACTC,QAAO,EAAA,CAEGC,YAAY,KAAK;CACpC;CAEA,MAAMC,iBAAiB1B,UAAoC;EAMvD,OAAO2B,MALa,KAAKrC,WAAW8B,mBAAmB,cAAA,CAAA,CAClDN,MAAM,qCAAqC,EAAEd,SAAS,CAAA,CAAA,CACtDuB,SAAS,qCAAA,CAAA,CACTK,SAAQ,IAEE;CACnB;CAEA,MAAMC,WAAWjC,IAAYsB,IAA2B;EACpD,MAAM,KAAK5B,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOpC,kBAAAA,CAAAA,CACPqC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,YAAY,EAAElB,GAAG,CAAA,CAAA,CACvB2B,SAAS,mBAAA,CAAA,CACTC,QAAO;CAChB;CAEA,MAAMM,kBAAkBjC,WAAmBqB,IAAwC;EAM/E,MAAMe,QAA0BF,MALb,KAAKzC,WAAW0B,KAAK;GACpCF,OAAO,EAAEjB,UAAU;GACnBmC,QAAQ;IAAEpC,IAAI;IAAMU,WAAW;GAAK;EACxC,CAAA,EAAA,CAEqC4B,KAAKC,SAAS;GAC/CvC,IAAIuC,IAAIvC;GACRU,WAAW6B,IAAI7B;EACnB,EAAA;EACA,IAAI2B,KAAKG,SAAS,GACd,MAAM,KAAK9C,WAAW8B,mBAAkB,CAAA,CACnCC,OAAOpC,kBAAAA,CAAAA,CACPqC,IAAI,EAAEjB,WAAWa,GAAG,CAAA,CAAA,CACpBJ,MAAM,EAAElB,IAAIjB,GAAGsD,KAAKC,KAAKG,QAAQA,IAAIzC,EAAE,CAAA,EAAG,CAAA,CAAA,CAC1C2B,SAAS,mBAAA,CAAA,CACTC,QAAO;EAGhB,OAAOS;CACX;;;;;;;;;IAWA,mBAA6BM,IAA4C;EACrE,IAAIA,GAAGC,cAAcC,eAAeC,OAAOC,SAASA,KAAKC,MAAMC,SAAS,SAAA,GACpEN,GAAGO,SAAS,wBAAwB,SAAA;EAGxCP,GAAGQ,UAAU;GACT;GACA;GACA;GACA;EACH,CAAA;CACL;;;;;;;;IAUA,kBAA4BR,IAA4C;EACpEA,GAAGO,SAAS,uBAAuB,QAAA;EACnCP,GAAGQ,UAAU;GACT;GACA;GACA;EACH,CAAA;CACL;CAEA,MAAME,SAASC,OAAsE;EACjF,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9C,MAAM,EAAE+B,eAAetE,WAAW0D,IAAIW,KAAAA;EAEtC,KAAKZ,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,MAAM,CAACa,UAAUC,SAAS,MAAMd,GAAGe,gBAAe;EAElD,OAAO;GACHC,MAAMzE,sBAAsBoE,OAAOE,QAAAA;GACnCI,MAAM;IACFH;IACA,GAAGF;GACP;EACJ;CACJ;CAEA,MAAMM,uBAAuB7D,IAA0C;EACnE,MAAM2C,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA,CAAA,CACzCN,MAAM,yBAAyB,EAAElB,GAAG,CAAA;EAEzC,KAAK0C,mBAAmBC,EAAAA;EACxB,KAAKS,kBAAkBT,EAAAA;EAEvB,OAAOA,GAAGmB,OAAM;CACpB;CAEA,MAAMC,eAAeT,OAAwC;EACzD,MAAMX,KAAK,KAAKjD,WAAW8B,mBAAmB,cAAA;EAE9CvC,WAAW0D,IAAIW,KAAAA;EAEf,KAAKZ,mBAAmBC,EAAAA;EAExB,OAAOA,GAAGqB,QAAO;CACrB;CAEA,MAAMC,cACFC,QACAC,UAA4C,CAAC,GAC9B;EACf,OAAOhF,gBACH,KAAKO,YACL,EAAEgB,WAAW1B,SAASkF,MAAAA,EAAQ,GAC9B9E,sBAAsB+E,QAAQC,WAAW7E,qCAAAA,CAAAA;CAEjD;AACJ"}

package/dist/app/modules/provisioning/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAiBxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAarC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAyNjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/provisioning/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAoBtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAiBxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE/E,OAAO,EAQH,uBAAuB,EAQ1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAYrC,qBAAa,iBAAkB,YAAW,OAAO;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAEhC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAE7B,OAAO,GAAE,mBAAmB,EAAO;IAMzC,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;cAyNjC,mBAAmB,CAC/B,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,uBAAuB,GAC1C,OAAO,CAAC,IAAI,CAAC;CAuBnB"}

package/dist/app/modules/provisioning/module.mjs

@@ -33,8 +33,11 @@ import { WildcardRealmProvisioner, expandWildcardRealmEntry, extractWildcardReal
 import "../../../core/provisioning/wildcard/index.mjs";
 import { ModuleName } from "../constants.mjs";
 import { ConfigInjectionKey } from "../config/constants.mjs";
-import { getAppOrigins } from "../config/origins.mjs";
+import { getAppOrigins } from "../config/app-origins.mjs";
 import "../config/index.mjs";
+import { LoggerInjectionKey } from "../logger/constants.mjs";
+import "../logger/index.mjs";
+import { OAuth2InjectionToken } from "../oauth2/constants.mjs";
 import "../../../adapters/database/index.mjs";
 import { RealmRepositoryAdapter } from "../database/repositories/realm/repository.mjs";
 import { ClientRepositoryAdapter } from "../database/repositories/client/repository.mjs";
@@ -53,17 +56,13 @@ import { UserPermissionRepositoryAdapter } from "../database/repositories/user-p
 import { UserRoleRepositoryAdapter } from "../database/repositories/user-role/repository.mjs";
 import "../database/repositories/index.mjs";
 import { DatabaseInjectionKey } from "../database/constants.mjs";
-import { LoggerInjectionKey } from "../logger/constants.mjs";
-import "../logger/index.mjs";
 import "../database/index.mjs";
-import { OAuth2InjectionToken } from "../oauth2/constants.mjs";
 import { ProvisioningInjectionKey } from "./constants.mjs";
 import { CompositeProvisioningSource } from "./sources/composite/module.mjs";
 import { FileProvisioningSource } from "./sources/file/module.mjs";
 import "./sources/index.mjs";
 import { SymmetricCipher } from "@authup/server-kit";
 import { SystemPolicyName } from "@authup/access";
-import path from "node:path";
 import fs from "node:fs";
 //#region src/app/modules/provisioning/module.ts
 var ProvisionerModule = class {
@@ -78,7 +77,7 @@ var ProvisionerModule = class {
 	async setup(container) {
 		const sources = [...this.sources];
 		const config = container.resolve(ConfigInjectionKey);
-		const provisioningDir = path.join(config.writableDirectoryPath, "provisioning");
+		const provisioningDir = config.provisioningDirectoryPath;
 		if (fs.existsSync(provisioningDir)) sources.push(new FileProvisioningSource({
 			cwd: provisioningDir,
 			logger: container.resolve(LoggerInjectionKey)

package/dist/app/modules/provisioning/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","WildcardRealmProvisioner","expandWildcardRealmEntry","extractWildcardRealmEntry","ProvisioningInjectionKey","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","path","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","SystemClientProvisioner","KeyProvisioner","OAuth2InjectionToken","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","join","writableDirectoryPath","existsSync","push","cwd","logger","composite","data","load","wildcardEntry","wildcardVariants","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","systemClientProvisioner","appOrigins","keyStore","has","KeyStore","secretsCipher","secretsEncryptionKey","keyProvisioner","wildcardProvisioner","unregister","relations","relationsByRealmName","synchronizer","register","useValue","realms","find","realm","ensureForRealm","hasExplicitEntry","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { RealmProvisioningRelations } from '../../../core/provisioning/entities/index.ts';\nimport {\n    WildcardRealmProvisioner,\n    expandWildcardRealmEntry,\n    extractWildcardRealmEntry,\n} from '../../../core/provisioning/wildcard/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { SystemClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport type { IKeyStore } from '../../../core/key/index.ts';\nimport { OAuth2InjectionToken } from '../oauth2/constants.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = path.join(config.writableDirectoryPath, 'provisioning');\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        // ---------------------------------------------------------------\n        // Wildcard realm entry (plan 082): split the `name: \"*\"` entry out\n        // of `data.realms` and deep-merge it UNDER every explicit realm\n        // entry (explicit wins per attribute, relation lists union) so the\n        // graph sync below covers declared realms in one pass. Realms\n        // without an explicit entry get the wildcard applied by the\n        // backfill loop; runtime-created realms via the DI-registered\n        // provisioner (RealmService hook).\n        // ---------------------------------------------------------------\n        const wildcardEntry = extractWildcardRealmEntry(data);\n        let wildcardVariants : Map<string, RealmProvisioningRelations> | undefined;\n        if (wildcardEntry) {\n            wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm system clients (web, admin-console, account-console).\n        // Single provisioning mechanism: list every realm (incl.\n        // pre-existing) and upsert its clients.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const systemClientProvisioner = new SystemClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use.\n        //\n        // The oauth2 module's registration is PREFERRED but optional, so\n        // provisioning stays runnable in minimal module graphs (test setup,\n        // CLI) where oauth2 never registered one; the locally constructed\n        // fallback handles the KEK identically. Sharing the instance when\n        // it exists matters because mint de-duplication is per adapter\n        // (see KeyRepositoryAdapter.mintExclusive): a second adapter has\n        // its own in-flight map, so this backfill and a concurrent\n        // realm-create request would each mint their own key.\n        const keyStore = container.has(OAuth2InjectionToken.KeyStore) ?\n            container.resolve<IKeyStore>(OAuth2InjectionToken.KeyStore) :\n            new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            });\n\n        const keyProvisioner = new KeyProvisioner({\n            keyStore,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Wildcard realm provisioning (plan 082): one shared instance for\n        // the boot backfill below AND the runtime realm-create hook (the\n        // realm controller factory resolves the DI key lazily), so the two\n        // paths cannot drift. Registered only when a wildcard entry was\n        // declared.\n        let wildcardProvisioner : WildcardRealmProvisioner | undefined;\n        if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);\n        }\n        if (wildcardEntry) {\n            wildcardProvisioner = new WildcardRealmProvisioner({\n                relations: wildcardEntry.relations ?? {},\n                relationsByRealmName: wildcardVariants,\n                synchronizer: realmSynchronizer,\n                logger: container.resolve(LoggerInjectionKey),\n            });\n            container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });\n        }\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await systemClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n            // Realms with an explicit entry were already covered by the\n            // wildcard expansion inside the graph sync above.\n            if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) {\n                await wildcardProvisioner.ensureForRealm(realm);\n            }\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,IAAauD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOb,WAAWgB;EACvB,KAAKF,eAAe,CAACd,WAAWiB,QAAQjB,WAAWkB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQnB,kBAAAA;EACjC,MAAMoB,kBAAkBrB,KAAKsB,KAAKH,OAAOI,uBAAuB,cAAA;EAChE,IAAIxB,GAAGyB,WAAWH,eAAAA,GACdR,QAAQY,KAAK,IAAIhB,uBAAuB;GACpCiB,KAAKL;GACLM,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMyB,OAAO,MAAMD,IADGpB,4BAA4BK,OAC/Be,CAAAA,CAAUE,KAAKZ,SAAAA;EAWlC,MAAMa,gBAAgBnD,0BAA0BiD,IAAAA;EAChD,IAAIG;EACJ,IAAID,eACAC,mBAAmBrD,yBAAyBoD,eAAeF,IAAAA;EAG/D,MAAMI,aAAaf,UAAUE,QAAQvB,qBAAqBqC,UAAU;EACpE,MAAMC,kBAAkBjB,UAAUE,QAA2B5D,WAAAA;EAE7D,MAAM4E,uBAAuB,IAAIhD,4BAA4B;GACzDiD,YAAYnB,UAAUE,QAAsC7D,gBAAAA;GAC5D4E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAIjD,wBAAwB;GACjDgD,YAAY,IAAIrE,iBAAiBiE,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIpD,kCACnC+B,UAAUE,QAAsCrD,sBAAAA,CAAAA;EAGpD,MAAMyE,qBAAqB,IAAInE,+BAA+B;GAC1DgE,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAIjD,sBAAsB;GAC7C6C,YAAYnB,UAAUE,QAA0B3D,UAAAA;GAChD0E;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAI3D,wBAAwB;GACjDsD,YAAYnB,UAAUE,QAA4BjE,YAAAA;GAClDgF;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAIlD,uBAAuB;GAC/C4C,YAAYnB,UAAUE,QAA2BzD,WAAAA;GACjDwE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAI3D,6BAC9BiC,UAAUE,QAAiC9D,iBAAAA,CAAAA;EAG/C,MAAMuF,yBAAyB,IAAIzE,mCAAmC;GAClEiE,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIvE,6BAA6B;GACtD8D,YAAYI;GACZL;GACAW,0BAA0B,IAAIxD,gCAC1B2B,UAAUE,QAAoC1D,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMsF,qBAAqB,IAAI9E,+BAA+B;GAC1DwE;GACAO,sBAAsB,IAAIjE,4BACtBkC,UAAUE,QAAgC/D,gBAAAA,CAAAA;GAE9C6F,4BAA4B,IAAIpE,kCAC5BoC,UAAUE,QAAsChE,sBAAAA,CAAAA;GAEpDwF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAI1E,6BAA6B;GACtD2E,gBAAgB,IAAIzD,sBAAsB;IACtC0C,YAAY,IAAIpE,eAAegE,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAIzD,0BACpBsB,UAAUE,QAA8BvD,cAAAA,CAAAA;GAE5CyF,0BAA0B,IAAI5D,gCAC1BwB,UAAUE,QAAoCxD,oBAAAA,CAAAA;GAGlD8E;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAI/E,8BAA8B,EAAE6D,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAIlF,8BAA8B;GACxD+D,YAAY,IAAI/C,uBAAuB6C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuBtF,8BAA8B;GACvDqE;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY7B,IAAAA;EAQnC,MAAM8B,0BAA0B,IAAItD,wBAAwB;GACxDqC;GACAC;GACAC;GACAgB,YAAY1D,cAAciB,MAAAA;GAC1BQ,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAcA,MAAMyD,WAAW3C,UAAU4C,IAAIvD,qBAAqBwD,QAAQ,IACxD7C,UAAUE,QAAmBb,qBAAqBwD,QAAQ,IAC1D,IAAI7E,qBAAqB+C,YAAY,EACjC+B,eAAe7C,OAAO8C,uBAClB,IAAI9D,gBAAgBgB,OAAO8C,oBAAoB,IAC/C,KACR,CAAA;EAEJ,MAAMC,iBAAiB,IAAI5D,eAAe;GACtCuD;GACAlC,QAAQT,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAOA,IAAI+D;EACJ,IAAIjD,UAAU4C,IAAIjF,yBAAyBH,wBAAwB,GAC/DwC,UAAUkD,WAAWvF,yBAAyBH,wBAAwB;EAE1E,IAAIqD,eAAe;GACfoC,sBAAsB,IAAIzF,yBAAyB;IAC/C2F,WAAWtC,cAAcsC,aAAa,CAAC;IACvCC,sBAAsBtC;IACtBuC,cAAcf;IACd7B,QAAQT,UAAUE,QAAQhB,kBAAAA;GAC9B,CAAA;GACAc,UAAUsD,SAAS3F,yBAAyBH,0BAA0B,EAAE+F,UAAUN,oBAAoB,CAAA;EAC1G;EAEA,MAAMO,SAAS,MAAMvC,gBAAgBwC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMf,wBAAwBkB,eAAeD,KAAAA;GAC7C,MAAMV,eAAeW,eAAeD,KAAAA;GAGpC,IAAIT,uBAAuB,CAACA,oBAAoBW,iBAAiBF,KAAAA,GAC7D,MAAMT,oBAAoBU,eAAeD,KAAAA;EAEjD;EAEA,IAAIzD,OAAO4D,oCACP,MAAM,KAAKC,oBAAoB/C,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB0C,oBACZ/C,YACAK,kBACa;EACb,MAAM2C,gBAAgB,MAAM3C,iBAAiB4C,cAAcpH,iBAAiBqH,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBnD,WAAWoD,cAAc9H,gBAAAA;EAChD,MAAM+H,eAAerD,WAAWoD,cAActH,sBAAAA;EAE9C,MAAMwH,cAAc,MAAMH,eAAeT,KAAI;EAC7C,KAAK,MAAMa,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}
+{"version":3,"file":"module.mjs","names":["ClientEntity","ClientPermissionEntity","ClientRoleEntity","ClientScopeEntity","PermissionEntity","RealmEntity","RoleEntity","RolePermissionEntity","ScopeEntity","UserPermissionEntity","UserRoleEntity","SystemPolicyName","PermissionPolicyEntity","PolicyRepository","UserRepository","ClientProvisioningSynchronizer","GraphProvisioningSynchronizer","PermissionProvisioningSynchronizer","PolicyProvisioningSynchronizer","RealmProvisioningSynchronizer","RoleProvisioningSynchronizer","ScopeProvisioningSynchronizer","UserProvisioningSynchronizer","WildcardRealmProvisioner","expandWildcardRealmEntry","extractWildcardRealmEntry","ProvisioningInjectionKey","ClientPermissionRepositoryAdapter","ClientRepositoryAdapter","ClientRoleRepositoryAdapter","ClientScopeRepositoryAdapter","KeyRepositoryAdapter","PermissionPolicyRepositoryAdapter","PermissionRepositoryAdapter","PolicyRepositoryAdapter","RealmRepositoryAdapter","RolePermissionRepositoryAdapter","RoleRepositoryAdapter","ScopeRepositoryAdapter","UserPermissionRepositoryAdapter","UserRepositoryAdapter","UserRoleRepositoryAdapter","DatabaseInjectionKey","ModuleName","fs","ConfigInjectionKey","getAppOrigins","SymmetricCipher","LoggerInjectionKey","SystemClientProvisioner","KeyProvisioner","OAuth2InjectionToken","CompositeProvisioningSource","FileProvisioningSource","ProvisionerModule","name","dependencies","sources","PROVISIONING","CONFIG","DATABASE","setup","container","config","resolve","provisioningDir","provisioningDirectoryPath","existsSync","push","cwd","logger","composite","data","load","wildcardEntry","wildcardVariants","dataSource","DataSource","realmRepository","permissionRepository","repository","policyRepository","permissionPolicyRepository","policySynchronizer","roleRepository","clientRepository","scopeRepository","clientScopeRepository","permissionSynchronizer","roleSynchronizer","rolePermissionRepository","clientSynchronizer","clientRoleRepository","clientPermissionRepository","userSynchronizer","userRepository","userRoleRepository","userPermissionRepository","scopeSynchronizer","realmSynchronizer","rootSynchronizer","synchronize","systemClientProvisioner","appOrigins","keyStore","has","KeyStore","secretsCipher","secretsEncryptionKey","keyProvisioner","wildcardProvisioner","unregister","relations","relationsByRealmName","synchronizer","register","useValue","realms","find","realm","ensureForRealm","hasExplicitEntry","permissionsDefaultPolicyAssignment","assignDefaultPolicy","defaultPolicy","findOneByName","DEFAULT","permissionRepo","getRepository","junctionRepo","permissions","permission","hasAnyPolicy","findOneBy","permissionId","id","save","create","permissionRealmId","realmId","policyId","policyRealmId"],"sources":["../../../../src/app/modules/provisioning/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\nimport type {\n    Client,\n    ClientPermission,\n    ClientRole,\n    ClientScope,\n    PermissionPolicy,\n    Realm,\n    Role,\n    RolePermission,\n    Scope,\n    UserPermission,\n    UserRole,\n} from '@authup/core-kit';\nimport type { DataSource, Repository } from 'typeorm';\nimport {\n    ClientEntity,\n    ClientPermissionEntity,\n    ClientRoleEntity,\n    ClientScopeEntity,\n    PermissionEntity,\n    RealmEntity,\n    RoleEntity,\n    RolePermissionEntity,\n    ScopeEntity,\n    UserPermissionEntity,\n    UserRoleEntity,\n} from '../../../adapters/database/index.ts';\nimport { SystemPolicyName } from '@authup/access';\nimport {\n    PermissionPolicyEntity,\n    PolicyRepository,\n    UserRepository,\n} from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientProvisioningSynchronizer,\n    GraphProvisioningSynchronizer,\n    PermissionProvisioningSynchronizer,\n    PolicyProvisioningSynchronizer,\n    RealmProvisioningSynchronizer,\n    RoleProvisioningSynchronizer,\n    ScopeProvisioningSynchronizer,\n    UserProvisioningSynchronizer,\n} from '../../../core/provisioning/synchronizer/index.ts';\nimport type { RealmProvisioningRelations } from '../../../core/provisioning/entities/index.ts';\nimport {\n    WildcardRealmProvisioner,\n    expandWildcardRealmEntry,\n    extractWildcardRealmEntry,\n} from '../../../core/provisioning/wildcard/index.ts';\nimport type { IProvisioningSource } from '../../../core/provisioning/types.ts';\nimport { ProvisioningInjectionKey } from './constants.ts';\nimport {\n    ClientPermissionRepositoryAdapter,\n    ClientRepositoryAdapter,\n    ClientRoleRepositoryAdapter,\n    ClientScopeRepositoryAdapter,\n    KeyRepositoryAdapter,\n    PermissionPolicyRepositoryAdapter,\n    PermissionRepositoryAdapter,\n    PolicyRepositoryAdapter,\n    RealmRepositoryAdapter,\n    RolePermissionRepositoryAdapter,\n    RoleRepositoryAdapter,\n    ScopeRepositoryAdapter,\n    UserPermissionRepositoryAdapter,\n    UserRepositoryAdapter, \n    UserRoleRepositoryAdapter, \n} from '../database/repositories/index.ts';\nimport { DatabaseInjectionKey } from '../database/index.ts';\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport fs from 'node:fs';\nimport { ConfigInjectionKey, getAppOrigins } from '../config/index.ts';\nimport { SymmetricCipher } from '@authup/server-kit';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { SystemClientProvisioner } from '../../../core/entities/client/index.ts';\nimport { KeyProvisioner } from '../../../core/key/index.ts';\nimport type { IKeyStore } from '../../../core/key/index.ts';\nimport { OAuth2InjectionToken } from '../oauth2/constants.ts';\nimport { CompositeProvisioningSource, FileProvisioningSource } from './sources/index.ts';\n\nexport class ProvisionerModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    protected sources: IProvisioningSource[];\n\n    constructor(sources: IProvisioningSource[] = []) {\n        this.name = ModuleName.PROVISIONING;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.DATABASE];\n        this.sources = sources;\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const sources = [...this.sources];\n\n        const config = container.resolve(ConfigInjectionKey);\n        const provisioningDir = config.provisioningDirectoryPath;\n        if (fs.existsSync(provisioningDir)) {\n            sources.push(new FileProvisioningSource({\n                cwd: provisioningDir,\n                logger: container.resolve(LoggerInjectionKey),\n            }));\n        }\n\n        const composite = new CompositeProvisioningSource(sources);\n        const data = await composite.load(container);\n\n        // ---------------------------------------------------------------\n        // Wildcard realm entry (plan 082): split the `name: \"*\"` entry out\n        // of `data.realms` and deep-merge it UNDER every explicit realm\n        // entry (explicit wins per attribute, relation lists union) so the\n        // graph sync below covers declared realms in one pass. Realms\n        // without an explicit entry get the wildcard applied by the\n        // backfill loop; runtime-created realms via the DI-registered\n        // provisioner (RealmService hook).\n        // ---------------------------------------------------------------\n        const wildcardEntry = extractWildcardRealmEntry(data);\n        let wildcardVariants : Map<string, RealmProvisioningRelations> | undefined;\n        if (wildcardEntry) {\n            wildcardVariants = expandWildcardRealmEntry(wildcardEntry, data);\n        }\n\n        const dataSource = container.resolve(DatabaseInjectionKey.DataSource);\n        const realmRepository = container.resolve<Repository<Realm>>(RealmEntity);\n\n        const permissionRepository = new PermissionRepositoryAdapter({\n            repository: container.resolve<Repository<PermissionEntity>>(PermissionEntity),\n            realmRepository,\n        });\n\n        const policyRepository = new PolicyRepositoryAdapter({\n            repository: new PolicyRepository(dataSource),\n            realmRepository,\n        });\n\n        // ---------------------------------------------------------------\n        // Synchronize all entities (policies → permissions → roles → ...)\n        // ---------------------------------------------------------------\n\n        const permissionPolicyRepository = new PermissionPolicyRepositoryAdapter(\n            container.resolve<Repository<PermissionPolicy>>(PermissionPolicyEntity),\n        );\n\n        const policySynchronizer = new PolicyProvisioningSynchronizer({\n            repository: policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleRepository = new RoleRepositoryAdapter({\n            repository: container.resolve<Repository<Role>>(RoleEntity),\n            realmRepository,\n        });\n        const clientRepository = new ClientRepositoryAdapter({\n            repository: container.resolve<Repository<Client>>(ClientEntity),\n            realmRepository,\n        });\n        const scopeRepository = new ScopeRepositoryAdapter({\n            repository: container.resolve<Repository<Scope>>(ScopeEntity),\n            realmRepository,\n        });\n        const clientScopeRepository = new ClientScopeRepositoryAdapter(\n            container.resolve<Repository<ClientScope>>(ClientScopeEntity),\n        );\n\n        const permissionSynchronizer = new PermissionProvisioningSynchronizer({\n            repository: permissionRepository,\n            policyRepository,\n            permissionPolicyRepository,\n        });\n\n        const roleSynchronizer = new RoleProvisioningSynchronizer({\n            repository: roleRepository,\n            permissionRepository,\n            rolePermissionRepository: new RolePermissionRepositoryAdapter(\n                container.resolve<Repository<RolePermission>>(RolePermissionEntity),\n            ),\n        });\n\n        const clientSynchronizer = new ClientProvisioningSynchronizer({\n            clientRepository,\n            clientRoleRepository: new ClientRoleRepositoryAdapter(\n                container.resolve<Repository<ClientRole>>(ClientRoleEntity),\n            ),\n            clientPermissionRepository: new ClientPermissionRepositoryAdapter(\n                container.resolve<Repository<ClientPermission>>(ClientPermissionEntity),\n            ),\n            clientScopeRepository,\n\n            roleRepository,\n            permissionRepository,\n            scopeRepository,\n\n            roleSynchronizer,\n            permissionSynchronizer,\n        });\n\n        const userSynchronizer = new UserProvisioningSynchronizer({\n            userRepository: new UserRepositoryAdapter({\n                repository: new UserRepository(dataSource),\n                realmRepository,\n            }),\n            userRoleRepository: new UserRoleRepositoryAdapter(\n                container.resolve<Repository<UserRole>>(UserRoleEntity),\n            ),\n            userPermissionRepository: new UserPermissionRepositoryAdapter(\n                container.resolve<Repository<UserPermission>>(UserPermissionEntity),\n            ),\n\n            clientRepository,\n            roleRepository,\n            permissionRepository,\n        });\n\n        const scopeSynchronizer = new ScopeProvisioningSynchronizer({ repository: scopeRepository });\n\n        const realmSynchronizer = new RealmProvisioningSynchronizer({\n            repository: new RealmRepositoryAdapter(realmRepository),\n\n            clientSynchronizer,\n            roleSynchronizer,\n            permissionSynchronizer,\n            userSynchronizer,\n            scopeSynchronizer,\n        });\n\n        const rootSynchronizer = new GraphProvisioningSynchronizer({\n            policySynchronizer,\n            permissionSynchronizer,\n            roleSynchronizer,\n            realmSynchronizer,\n            scopeSynchronizer,\n        });\n\n        await rootSynchronizer.synchronize(data);\n\n        // ---------------------------------------------------------------\n        // Per-realm system clients (web, admin-console, account-console).\n        // Single provisioning mechanism: list every realm (incl.\n        // pre-existing) and upsert its clients.\n        // Idempotent; guarded on builtIn inside the provisioner.\n        // ---------------------------------------------------------------\n        const systemClientProvisioner = new SystemClientProvisioner({\n            clientRepository,\n            scopeRepository,\n            clientScopeRepository,\n            appOrigins: getAppOrigins(config),\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Eager key minting (plan 071 hybrid model): every realm — incl.\n        // pre-existing ones — holds sig + enc keys after startup, so the\n        // management API shows them without waiting for first use.\n        //\n        // The oauth2 module's registration is PREFERRED but optional, so\n        // provisioning stays runnable in minimal module graphs (test setup,\n        // CLI) where oauth2 never registered one; the locally constructed\n        // fallback handles the KEK identically. Sharing the instance when\n        // it exists matters because mint de-duplication is per adapter\n        // (see KeyRepositoryAdapter.mintExclusive): a second adapter has\n        // its own in-flight map, so this backfill and a concurrent\n        // realm-create request would each mint their own key.\n        const keyStore = container.has(OAuth2InjectionToken.KeyStore) ?\n            container.resolve<IKeyStore>(OAuth2InjectionToken.KeyStore) :\n            new KeyRepositoryAdapter(dataSource, {\n                secretsCipher: config.secretsEncryptionKey ?\n                    new SymmetricCipher(config.secretsEncryptionKey) :\n                    null,\n            });\n\n        const keyProvisioner = new KeyProvisioner({\n            keyStore,\n            logger: container.resolve(LoggerInjectionKey),\n        });\n\n        // Wildcard realm provisioning (plan 082): one shared instance for\n        // the boot backfill below AND the runtime realm-create hook (the\n        // realm controller factory resolves the DI key lazily), so the two\n        // paths cannot drift. Registered only when a wildcard entry was\n        // declared.\n        let wildcardProvisioner : WildcardRealmProvisioner | undefined;\n        if (container.has(ProvisioningInjectionKey.WildcardRealmProvisioner)) {\n            container.unregister(ProvisioningInjectionKey.WildcardRealmProvisioner);\n        }\n        if (wildcardEntry) {\n            wildcardProvisioner = new WildcardRealmProvisioner({\n                relations: wildcardEntry.relations ?? {},\n                relationsByRealmName: wildcardVariants,\n                synchronizer: realmSynchronizer,\n                logger: container.resolve(LoggerInjectionKey),\n            });\n            container.register(ProvisioningInjectionKey.WildcardRealmProvisioner, { useValue: wildcardProvisioner });\n        }\n\n        const realms = await realmRepository.find();\n        for (const realm of realms) {\n            await systemClientProvisioner.ensureForRealm(realm);\n            await keyProvisioner.ensureForRealm(realm);\n            // Realms with an explicit entry were already covered by the\n            // wildcard expansion inside the graph sync above.\n            if (wildcardProvisioner && !wildcardProvisioner.hasExplicitEntry(realm)) {\n                await wildcardProvisioner.ensureForRealm(realm);\n            }\n        }\n\n        if (config.permissionsDefaultPolicyAssignment) {\n            await this.assignDefaultPolicy(dataSource, policyRepository);\n        }\n    }\n\n    protected async assignDefaultPolicy(\n        dataSource: DataSource,\n        policyRepository: PolicyRepositoryAdapter,\n    ): Promise<void> {\n        const defaultPolicy = await policyRepository.findOneByName(SystemPolicyName.DEFAULT);\n        if (!defaultPolicy) {\n            return;\n        }\n\n        const permissionRepo = dataSource.getRepository(PermissionEntity);\n        const junctionRepo = dataSource.getRepository(PermissionPolicyEntity);\n\n        const permissions = await permissionRepo.find();\n        for (const permission of permissions) {\n            const hasAnyPolicy = await junctionRepo.findOneBy({ permissionId: permission.id });\n\n            if (!hasAnyPolicy) {\n                await junctionRepo.save(junctionRepo.create({\n                    permissionId: permission.id,\n                    permissionRealmId: permission.realmId,\n                    policyId: defaultPolicy.id,\n                    policyRealmId: defaultPolicy.realmId,\n                }));\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwFA,IAAasD,oBAAb,MAAaA;CACAC;CAEAC;CAECC;CAEV,YAAYA,UAAiC,CAAA,GAAI;EAC7C,KAAKF,OAAOZ,WAAWe;EACvB,KAAKF,eAAe,CAACb,WAAWgB,QAAQhB,WAAWiB,QAAS;EAC5D,KAAKH,UAAUA;CACnB;CAEA,MAAMI,MAAMC,WAAsC;EAC9C,MAAML,UAAU,CAAI,GAAA,KAAKA,OAAQ;EAEjC,MAAMM,SAASD,UAAUE,QAAQnB,kBAAAA;EACjC,MAAMoB,kBAAkBF,OAAOG;EAC/B,IAAItB,GAAGuB,WAAWF,eAAAA,GACdR,QAAQW,KAAK,IAAIf,uBAAuB;GACpCgB,KAAKJ;GACLK,QAAQR,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA,CAAA;EAIJ,MAAMwB,OAAO,MAAMD,IADGnB,4BAA4BK,OAC/Bc,CAAAA,CAAUE,KAAKX,SAAAA;EAWlC,MAAMY,gBAAgBjD,0BAA0B+C,IAAAA;EAChD,IAAIG;EACJ,IAAID,eACAC,mBAAmBnD,yBAAyBkD,eAAeF,IAAAA;EAG/D,MAAMI,aAAad,UAAUE,QAAQtB,qBAAqBmC,UAAU;EACpE,MAAMC,kBAAkBhB,UAAUE,QAA2B3D,WAAAA;EAE7D,MAAM0E,uBAAuB,IAAI9C,4BAA4B;GACzD+C,YAAYlB,UAAUE,QAAsC5D,gBAAAA;GAC5D0E;EACJ,CAAA;EAEA,MAAMG,mBAAmB,IAAI/C,wBAAwB;GACjD8C,YAAY,IAAInE,iBAAiB+D,UAAAA;GACjCE;EACJ,CAAA;EAMA,MAAMI,6BAA6B,IAAIlD,kCACnC8B,UAAUE,QAAsCpD,sBAAAA,CAAAA;EAGpD,MAAMuE,qBAAqB,IAAIjE,+BAA+B;GAC1D8D,YAAYC;GACZC;EACJ,CAAA;EAEA,MAAME,iBAAiB,IAAI/C,sBAAsB;GAC7C2C,YAAYlB,UAAUE,QAA0B1D,UAAAA;GAChDwE;EACJ,CAAA;EACA,MAAMO,mBAAmB,IAAIzD,wBAAwB;GACjDoD,YAAYlB,UAAUE,QAA4BhE,YAAAA;GAClD8E;EACJ,CAAA;EACA,MAAMQ,kBAAkB,IAAIhD,uBAAuB;GAC/C0C,YAAYlB,UAAUE,QAA2BxD,WAAAA;GACjDsE;EACJ,CAAA;EACA,MAAMS,wBAAwB,IAAIzD,6BAC9BgC,UAAUE,QAAiC7D,iBAAAA,CAAAA;EAG/C,MAAMqF,yBAAyB,IAAIvE,mCAAmC;GAClE+D,YAAYD;GACZE;GACAC;EACJ,CAAA;EAEA,MAAMO,mBAAmB,IAAIrE,6BAA6B;GACtD4D,YAAYI;GACZL;GACAW,0BAA0B,IAAItD,gCAC1B0B,UAAUE,QAAoCzD,oBAAAA,CAAAA;EAEtD,CAAA;EAEA,MAAMoF,qBAAqB,IAAI5E,+BAA+B;GAC1DsE;GACAO,sBAAsB,IAAI/D,4BACtBiC,UAAUE,QAAgC9D,gBAAAA,CAAAA;GAE9C2F,4BAA4B,IAAIlE,kCAC5BmC,UAAUE,QAAsC/D,sBAAAA,CAAAA;GAEpDsF;GAEAH;GACAL;GACAO;GAEAG;GACAD;EACJ,CAAA;EAEA,MAAMM,mBAAmB,IAAIxE,6BAA6B;GACtDyE,gBAAgB,IAAIvD,sBAAsB;IACtCwC,YAAY,IAAIlE,eAAe8D,UAAAA;IAC/BE;GACJ,CAAA;GACAkB,oBAAoB,IAAIvD,0BACpBqB,UAAUE,QAA8BtD,cAAAA,CAAAA;GAE5CuF,0BAA0B,IAAI1D,gCAC1BuB,UAAUE,QAAoCvD,oBAAAA,CAAAA;GAGlD4E;GACAD;GACAL;EACJ,CAAA;EAEA,MAAMmB,oBAAoB,IAAI7E,8BAA8B,EAAE2D,YAAYM,gBAAgB,CAAA;EAE1F,MAAMa,oBAAoB,IAAIhF,8BAA8B;GACxD6D,YAAY,IAAI7C,uBAAuB2C,eAAAA;GAEvCa;GACAF;GACAD;GACAM;GACAI;EACJ,CAAA;EAUA,MAAME,IARuBpF,8BAA8B;GACvDmE;GACAK;GACAC;GACAU;GACAD;EACJ,CAEME,CAAAA,CAAiBC,YAAY7B,IAAAA;EAQnC,MAAM8B,0BAA0B,IAAIrD,wBAAwB;GACxDoC;GACAC;GACAC;GACAgB,YAAYzD,cAAciB,MAAAA;GAC1BO,QAAQR,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAcA,MAAMwD,WAAW1C,UAAU2C,IAAItD,qBAAqBuD,QAAQ,IACxD5C,UAAUE,QAAmBb,qBAAqBuD,QAAQ,IAC1D,IAAI3E,qBAAqB6C,YAAY,EACjC+B,eAAe5C,OAAO6C,uBAClB,IAAI7D,gBAAgBgB,OAAO6C,oBAAoB,IAC/C,KACR,CAAA;EAEJ,MAAMC,iBAAiB,IAAI3D,eAAe;GACtCsD;GACAlC,QAAQR,UAAUE,QAAQhB,kBAAAA;EAC9B,CAAA;EAOA,IAAI8D;EACJ,IAAIhD,UAAU2C,IAAI/E,yBAAyBH,wBAAwB,GAC/DuC,UAAUiD,WAAWrF,yBAAyBH,wBAAwB;EAE1E,IAAImD,eAAe;GACfoC,sBAAsB,IAAIvF,yBAAyB;IAC/CyF,WAAWtC,cAAcsC,aAAa,CAAC;IACvCC,sBAAsBtC;IACtBuC,cAAcf;IACd7B,QAAQR,UAAUE,QAAQhB,kBAAAA;GAC9B,CAAA;GACAc,UAAUqD,SAASzF,yBAAyBH,0BAA0B,EAAE6F,UAAUN,oBAAoB,CAAA;EAC1G;EAEA,MAAMO,SAAS,MAAMvC,gBAAgBwC,KAAI;EACzC,KAAK,MAAMC,SAASF,QAAQ;GACxB,MAAMf,wBAAwBkB,eAAeD,KAAAA;GAC7C,MAAMV,eAAeW,eAAeD,KAAAA;GAGpC,IAAIT,uBAAuB,CAACA,oBAAoBW,iBAAiBF,KAAAA,GAC7D,MAAMT,oBAAoBU,eAAeD,KAAAA;EAEjD;EAEA,IAAIxD,OAAO2D,oCACP,MAAM,KAAKC,oBAAoB/C,YAAYK,gBAAAA;CAEnD;CAEA,MAAgB0C,oBACZ/C,YACAK,kBACa;EACb,MAAM2C,gBAAgB,MAAM3C,iBAAiB4C,cAAclH,iBAAiBmH,OAAO;EACnF,IAAI,CAACF,eACD;EAGJ,MAAMG,iBAAiBnD,WAAWoD,cAAc5H,gBAAAA;EAChD,MAAM6H,eAAerD,WAAWoD,cAAcpH,sBAAAA;EAE9C,MAAMsH,cAAc,MAAMH,eAAeT,KAAI;EAC7C,KAAK,MAAMa,cAAcD,aAGrB,IAAI,CAACE,MAFsBH,aAAaI,UAAU,EAAEC,cAAcH,WAAWI,GAAG,CAAA,GAG5E,MAAMN,aAAaO,KAAKP,aAAaQ,OAAO;GACxCH,cAAcH,WAAWI;GACzBG,mBAAmBP,WAAWQ;GAC9BC,UAAUhB,cAAcW;GACxBM,eAAejB,cAAce;EACjC,CAAA,CAAA;CAGZ;AACJ"}

package/dist/app/modules/provisioning/sources/composite/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AAEtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYlE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;CAOvE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AAEtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,SAAS,CAAC,OAAO,EAAG,mBAAmB,EAAE,CAAC;gBAE9B,OAAO,EAAG,mBAAmB,EAAE;IAIrC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAclE,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,sBAAsB;CAOvE"}

package/dist/app/modules/provisioning/sources/composite/module.mjs

@@ -11,7 +11,8 @@ var CompositeProvisioningSource = class {
 	}
 	async load(container) {
 		const output = {};
-		(await Promise.all(this.sources.map((source) => source.load(container)))).map((sourceData) => this.merge(output, sourceData));
+		const sourcesData = await Promise.all(this.sources.map((source) => source.load(container)));
+		for (const sourceData of sourcesData) this.merge(output, sourceData);
 		return output;
 	}
 	merge(target, source) {

package/dist/app/modules/provisioning/sources/composite/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["mergeProvisioningEntities","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","permissions","roles","scopes","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport { mergeProvisioningEntities } from '../../../../../core/provisioning/merge/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        sourcesData.map((sourceData) => this.merge(output, sourceData));\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = mergeProvisioningEntities(target.policies, source.policies);\n        target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);\n        target.roles = mergeProvisioningEntities(target.roles, source.roles);\n        target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);\n        target.realms = mergeProvisioningEntities(target.realms, source.realms);\n    }\n}\n"],"mappings":";;;;;;AAYA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAMzCC,CAAAA,MAJ0BC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA,EAAAA,CAGnCK,KAAKE,eAAe,KAAKC,MAAMP,QAAQM,UAAAA,CAAAA;EAEnD,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAWd,0BAA0Ba,OAAOC,UAAUJ,OAAOI,QAAQ;EAC5ED,OAAOE,cAAcf,0BAA0Ba,OAAOE,aAAaL,OAAOK,WAAW;EACrFF,OAAOG,QAAQhB,0BAA0Ba,OAAOG,OAAON,OAAOM,KAAK;EACnEH,OAAOI,SAASjB,0BAA0Ba,OAAOI,QAAQP,OAAOO,MAAM;EACtEJ,OAAOK,SAASlB,0BAA0Ba,OAAOK,QAAQR,OAAOQ,MAAM;CAC1E;AACJ"}
+{"version":3,"file":"module.mjs","names":["mergeProvisioningEntities","CompositeProvisioningSource","sources","load","container","output","sourcesData","Promise","all","map","source","sourceData","merge","target","policies","permissions","roles","scopes","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/composite/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport { mergeProvisioningEntities } from '../../../../../core/provisioning/merge/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\nimport type { IContainer } from 'eldin';\n\nexport class CompositeProvisioningSource implements IProvisioningSource {\n    protected sources : IProvisioningSource[];\n\n    constructor(sources : IProvisioningSource[]) {\n        this.sources = sources;\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const output : RootProvisioningEntity = {};\n\n        const sourcesData = await Promise.all(\n            (this.sources).map((source) => source.load(container)),\n        );\n\n        for (const sourceData of sourcesData) {\n            this.merge(output, sourceData);\n        }\n\n        return output;\n    }\n\n    merge(target: RootProvisioningEntity, source: RootProvisioningEntity) {\n        target.policies = mergeProvisioningEntities(target.policies, source.policies);\n        target.permissions = mergeProvisioningEntities(target.permissions, source.permissions);\n        target.roles = mergeProvisioningEntities(target.roles, source.roles);\n        target.scopes = mergeProvisioningEntities(target.scopes, source.scopes);\n        target.realms = mergeProvisioningEntities(target.realms, source.realms);\n    }\n}\n"],"mappings":";;;;;;AAYA,IAAaC,8BAAb,MAAaA;CACCC;CAEV,YAAYA,SAAiC;EACzC,KAAKA,UAAUA;CACnB;CAEA,MAAMC,KAAKC,WAAwD;EAC/D,MAAMC,SAAkC,CAAC;EAEzC,MAAMC,cAAc,MAAMC,QAAQC,IAC9B,KAAMN,QAASO,KAAKC,WAAWA,OAAOP,KAAKC,SAAAA,CAAAA,CAAAA;EAG/C,KAAK,MAAMO,cAAcL,aACrB,KAAKM,MAAMP,QAAQM,UAAAA;EAGvB,OAAON;CACX;CAEAO,MAAMC,QAAgCH,QAAgC;EAClEG,OAAOC,WAAWd,0BAA0Ba,OAAOC,UAAUJ,OAAOI,QAAQ;EAC5ED,OAAOE,cAAcf,0BAA0Ba,OAAOE,aAAaL,OAAOK,WAAW;EACrFF,OAAOG,QAAQhB,0BAA0Ba,OAAOG,OAAON,OAAOM,KAAK;EACnEH,OAAOI,SAASjB,0BAA0Ba,OAAOI,QAAQP,OAAOO,MAAM;EACtEJ,OAAOK,SAASlB,0BAA0Ba,OAAOK,QAAQR,OAAOQ,MAAM;CAC1E;AACJ"}

package/dist/app/modules/provisioning/sources/default/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAgF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAyEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+DAA+D,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AACxG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0DAA0D,CAAC;AAGxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,qBAAa,yBAA0B,YAAW,mBAAmB;IACjE,aAAa,IAAI,wBAAwB,EAAE;IAmF3C,gBAAgB,IAAI,4BAA4B,EAAE;IA4BlD,WAAW,IAAI,uBAAuB,EAAE;IAcxC,UAAU,IAAI,sBAAsB,EAAE;IAyEhC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwE/D,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAWrE"}

package/dist/app/modules/provisioning/sources/default/module.mjs

@@ -66,7 +66,8 @@ var DefaultProvisioningSource = class {
 					"nameLocked",
 					"status",
 					"statusMessage",
-					"realmId"
+					"realmId",
+					"emailVerified"
 				] }
 			}
 		];