@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/app/modules/provisioning/sources/default/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","IDENTITY_PROVIDER_ACCOUNT_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CACH;GACL;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;EACH;CACL;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAyB;IACzGzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAuB;EAC1G;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAU;IAC3B;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IAExBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IACxBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;IAClB;IAIDL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;IAClB,EACL;GACJ;EACJ,CACH;CACL;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C7C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM2C,yBAAyB,IAAI7E,uBAAAA;EAEnC,IAAI8E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXtE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAW;EAC5B;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAU8C,QAAQ,CAC1B;GACIjD,UAAU+C;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOtF,mBAAmB,OAAA;IAC1BuF,QAAQV,OAAOW;GACnB;GACApD,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,MAAM6F,2BAA2B,IAAIzF,yBAAAA;EAErC,IAAI0F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;GAAkB;EAC5G;OAEAoF,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;GAAqB;EAC/D;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAUyD,UAAU,CAC5B;GACI5D,UAAU0D;GACVpF,YAAY;IACRK,SAAS;IACTkF,YAAYrG,iBAAiBsG;IAC7BC,oBAAoBtG,yBAAyBuG;IAC7CzF,MAAM;IACN0F,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAjE,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,OAAO,CAACiF,WAAY;CACxB;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQrG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BmG,aAAa,KAAKhF,iBAAgB;GAClCiF,QAAQ,KAAKrE,YAAW;GACxBsE,OAAO,KAAKrE,WAAU;GACtBsE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["BuiltInPolicyType","RealmScope","SystemPolicyName","DecisionStrategy","ClientAuthMethod","ClientTokenBindingMethod","PermissionName","REALM_MASTER_NAME","ROLE_ADMIN_NAME","ROLE_REALM_ADMIN_NAME","ScopeName","buildUserFakeEmail","ClientCredentialsService","UserCredentialsService","ConfigInjectionKey","ProvisioningEntityStrategyType","DefaultProvisioningSource","buildPolicies","attributes","name","DEFAULT","type","COMPOSITE","builtIn","realmId","extraAttributes","decisionStrategy","UNANIMOUS","children","IDENTITY","PERMISSION_BINDING","CLIENT_NAMES_SELF_MANAGE","ATTRIBUTE_NAMES","invert","names","USER_NAMES_SELF_MANAGE","buildPermissions","policiesByPermission","CLIENT_SELF_MANAGE","USER_SELF_MANAGE","Object","values","map","entity","strategy","MERGE","policies","relations","buildScopes","buildRoles","globalPermissions","globalPermissionsRealmScope","ANY","globalPermissionsExclude","REALM_CREATE","REALM_UPDATE","REALM_DELETE","OWN_OR_NULL","globalPermissionsRealmScopeOverrides","OWN","CLIENT_CREATE","CLIENT_UPDATE","CLIENT_DELETE","CONSENT_DELETE","IDENTITY_PROVIDER_CREATE","IDENTITY_PROVIDER_UPDATE","IDENTITY_PROVIDER_DELETE","IDENTITY_PROVIDER_ACCOUNT_DELETE","KEY_CREATE","KEY_UPDATE","KEY_DELETE","PERMISSION_CREATE","PERMISSION_UPDATE","PERMISSION_DELETE","ROLE_CREATE","ROLE_UPDATE","ROLE_DELETE","SCOPE_CREATE","SCOPE_UPDATE","SCOPE_DELETE","SESSION_DELETE","USER_CREATE","USER_UPDATE","USER_DELETE","USER_AUTHENTICATOR_CREATE","USER_AUTHENTICATOR_UPDATE","USER_AUTHENTICATOR_DELETE","buildRealms","config","masterRealm","userCredentialsService","userStrategy","userAdminPasswordReset","users","password","protect","userAdminPassword","email","active","userAdminEnabled","globalRoles","clientCredentialsService","clientStrategy","clientSystemSecretReset","clients","authMethod","SECRET","tokenBindingMethod","NONE","secret","clientSystemSecret","secretHashed","clientSystemEnabled","load","container","resolve","permissions","scopes","roles","realms"],"sources":["../../../../../../src/app/modules/provisioning/sources/default/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n *  Author Peter Placzek (tada5hi)\n *  For the full copyright and license information,\n *  view the LICENSE file that was distributed with this source code.\n */\n\nimport { BuiltInPolicyType, RealmScope, SystemPolicyName } from '@authup/access';\nimport { DecisionStrategy } from '@authup/kit';\nimport type {\n    Client, \n    Permission, \n    Role, \n    Scope, \n    User,\n} from '@authup/core-kit';\nimport {\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    PermissionName, \n    REALM_MASTER_NAME, \n    ROLE_ADMIN_NAME, \n    ROLE_REALM_ADMIN_NAME, \n    ScopeName, \n    buildUserFakeEmail,\n} from '@authup/core-kit';\nimport type { IContainer } from 'eldin';\nimport {\n    ClientCredentialsService,\n    UserCredentialsService,\n} from '../../../../../core/index.ts';\nimport type { Config } from '../../../config/index.ts';\nimport { ConfigInjectionKey } from '../../../config/index.ts';\nimport type { PermissionProvisioningEntity } from '../../../../../core/provisioning/entities/permission/index.ts';\nimport type { PolicyProvisioningEntity } from '../../../../../core/provisioning/entities/policy/index.ts';\nimport type { RealmProvisioningEntity } from '../../../../../core/provisioning/entities/realm/index.ts';\nimport type { RoleProvisioningEntity } from '../../../../../core/provisioning/entities/role/index.ts';\nimport type { RootProvisioningEntity } from '../../../../../core/provisioning/entities/root/index.ts';\nimport type { ScopeProvisioningEntity } from '../../../../../core/provisioning/entities/scope/index.ts';\nimport type { ProvisioningEntityStrategy } from '../../../../../core/provisioning/strategy/index.ts';\nimport { ProvisioningEntityStrategyType } from '../../../../../core/provisioning/strategy/index.ts';\nimport type { IProvisioningSource } from '../../../../../core/provisioning/types.ts';\n\nexport class DefaultProvisioningSource implements IProvisioningSource {\n    buildPolicies(): PolicyProvisioningEntity[] {\n        return [\n            {\n                attributes: {\n                    name: SystemPolicyName.DEFAULT,\n                    type: BuiltInPolicyType.COMPOSITE,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: { decisionStrategy: DecisionStrategy.UNANIMOUS },\n                children: [\n                    {\n                        attributes: {\n                            name: SystemPolicyName.IDENTITY,\n                            type: BuiltInPolicyType.IDENTITY,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                    {\n                        attributes: {\n                            name: SystemPolicyName.PERMISSION_BINDING,\n                            type: BuiltInPolicyType.PERMISSION_BINDING,\n                            builtIn: true,\n                            realmId: null,\n                        },\n                    },\n                ],\n            },\n            // Self-manage policies use ATTRIBUTE_NAMES + invert: true (denylist).\n            // Each `names` entry is what self-edit must REJECT; everything else\n            // is permitted. New columns added to the entity are self-editable\n            // by default — extend the denylist when adding admin-only state.\n            {\n                attributes: {\n                    name: SystemPolicyName.CLIENT_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        // FK + lifecycle\n                        'active',\n                        'realmId',\n                        // Security-critical: a self-edit must not change the\n                        // client's authentication/binding method (changing the\n                        // auth method may clear its secret) or downgrade the\n                        // secret-storage format\n                        // (which would persist the secret in plaintext).\n                        'authMethod',\n                        'tokenBindingMethod',\n                        'secretHashed',\n                        'secretEncrypted',\n                        'accessPolicyId',\n                    ],\n                },\n            },\n            {\n                attributes: {\n                    name: SystemPolicyName.USER_NAMES_SELF_MANAGE,\n                    type: BuiltInPolicyType.ATTRIBUTE_NAMES,\n                    invert: true,\n                    builtIn: true,\n                    realmId: null,\n                },\n                extraAttributes: {\n                    names: [\n                        'active',\n                        'nameLocked',\n                        'status',\n                        'statusMessage',\n                        'realmId',\n                        // A self-edit must not assert its own address is\n                        // verified — that is the whole point of the claim.\n                        'emailVerified',\n                    ],\n                },\n            },\n        ];\n    }\n\n    buildPermissions(): PermissionProvisioningEntity[] {\n        const policiesByPermission: Partial<Record<string, string[]>> = {\n            [PermissionName.CLIENT_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.CLIENT_NAMES_SELF_MANAGE],\n            [PermissionName.USER_SELF_MANAGE]: [SystemPolicyName.DEFAULT, SystemPolicyName.USER_NAMES_SELF_MANAGE],\n        };\n\n        return Object.values(PermissionName)\n            .map((name) => {\n                const entity: PermissionProvisioningEntity = {\n                    strategy: {\n                        type: ProvisioningEntityStrategyType.MERGE,\n                        attributes: ['builtIn'] as (keyof Permission)[],\n                    },\n                    attributes: {\n                        name,\n                        builtIn: true,\n                    },\n                };\n\n                const policies = policiesByPermission[name];\n                if (policies) {\n                    entity.relations = { policies };\n                }\n\n                return entity;\n            });\n    }\n\n    buildScopes(): ScopeProvisioningEntity[] {\n        return Object.values(ScopeName)\n            .map((name) => ({\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Scope)[],\n                },\n                attributes: {\n                    name,\n                    builtIn: true,\n                },\n            }));\n    }\n\n    buildRoles(): RoleProvisioningEntity[] {\n        return [\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    // Global admin: unrestricted realm reach (any realm + null/global).\n                    globalPermissionsRealmScope: RealmScope.ANY,\n                },\n            },\n            {\n                strategy: {\n                    type: ProvisioningEntityStrategyType.MERGE,\n                    attributes: ['builtIn'] as (keyof Role)[],\n                },\n                attributes: {\n                    name: ROLE_REALM_ADMIN_NAME,\n                    builtIn: true,\n                },\n                relations: {\n                    globalPermissions: ['*'],\n                    globalPermissionsExclude: [\n                        PermissionName.REALM_CREATE,\n                        PermissionName.REALM_UPDATE,\n                        PermissionName.REALM_DELETE,\n                    ],\n                    // realm_admin: own realm + null/global by default (so it can\n                    // read/assign global building blocks), but strictly own-realm for\n                    // direct entity CUD (cannot create/modify global entities).\n                    globalPermissionsRealmScope: RealmScope.OWN_OR_NULL,\n                    globalPermissionsRealmScopeOverrides: {\n                        [RealmScope.OWN]: [\n                            PermissionName.CLIENT_CREATE,\n                            PermissionName.CLIENT_UPDATE,\n                            PermissionName.CLIENT_DELETE,\n                            PermissionName.CONSENT_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_CREATE,\n                            PermissionName.IDENTITY_PROVIDER_UPDATE,\n                            PermissionName.IDENTITY_PROVIDER_DELETE,\n                            PermissionName.IDENTITY_PROVIDER_ACCOUNT_DELETE,\n                            PermissionName.KEY_CREATE,\n                            PermissionName.KEY_UPDATE,\n                            PermissionName.KEY_DELETE,\n                            PermissionName.PERMISSION_CREATE,\n                            PermissionName.PERMISSION_UPDATE,\n                            PermissionName.PERMISSION_DELETE,\n                            PermissionName.ROLE_CREATE,\n                            PermissionName.ROLE_UPDATE,\n                            PermissionName.ROLE_DELETE,\n                            PermissionName.SCOPE_CREATE,\n                            PermissionName.SCOPE_UPDATE,\n                            PermissionName.SCOPE_DELETE,\n                            PermissionName.SESSION_DELETE,\n                            PermissionName.USER_CREATE,\n                            PermissionName.USER_UPDATE,\n                            PermissionName.USER_DELETE,\n                            PermissionName.USER_AUTHENTICATOR_CREATE,\n                            PermissionName.USER_AUTHENTICATOR_UPDATE,\n                            PermissionName.USER_AUTHENTICATOR_DELETE,\n                        ],\n                    },\n                },\n            },\n        ];\n    }\n\n    async buildRealms(config: Config): Promise<RealmProvisioningEntity[]> {\n        const masterRealm : RealmProvisioningEntity = {\n            strategy: {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn'],\n            },\n            attributes: {\n                name: REALM_MASTER_NAME,\n                builtIn: true,\n            },\n            relations: {},\n        };\n\n        const userCredentialsService = new UserCredentialsService();\n\n        let userStrategy : ProvisioningEntityStrategy<User> | undefined;\n        if (config.userAdminPasswordReset) {\n            userStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['password'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.users = [\n            {\n                strategy: userStrategy,\n                attributes: {\n                    name: 'admin',\n                    password: await userCredentialsService.protect(config.userAdminPassword),\n                    email: buildUserFakeEmail('admin'),\n                    active: config.userAdminEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        const clientCredentialsService = new ClientCredentialsService();\n\n        let clientStrategy : ProvisioningEntityStrategy<Client> | undefined;\n        if (config.clientSystemSecretReset) {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod', 'secret', 'secretHashed', 'secretEncrypted'],\n            };\n        } else {\n            clientStrategy = {\n                type: ProvisioningEntityStrategyType.MERGE,\n                attributes: ['builtIn', 'authMethod', 'tokenBindingMethod'],\n            };\n        }\n\n        masterRealm.relations = masterRealm.relations || {};\n        masterRealm.relations.clients = [\n            {\n                strategy: clientStrategy,\n                attributes: {\n                    builtIn: true,\n                    authMethod: ClientAuthMethod.SECRET,\n                    tokenBindingMethod: ClientTokenBindingMethod.NONE,\n                    name: 'system',\n                    secret: await clientCredentialsService.protect(config.clientSystemSecret, { secretHashed: false }),\n                    secretHashed: false,\n                    active: config.clientSystemEnabled,\n                },\n                relations: { globalRoles: [ROLE_ADMIN_NAME] },\n            },\n        ];\n\n        return [masterRealm];\n    }\n\n    async load(container: IContainer): Promise<RootProvisioningEntity> {\n        const config = container.resolve(ConfigInjectionKey);\n\n        return {\n            policies: this.buildPolicies(),\n            permissions: this.buildPermissions(),\n            scopes: this.buildScopes(),\n            roles: this.buildRoles(),\n            realms: await this.buildRealms(config),\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;AA2CA,IAAagB,4BAAb,MAAaA;CACTC,gBAA4C;EACxC,OAAO;GACH;IACIC,YAAY;KACRC,MAAMjB,iBAAiBkB;KACvBC,MAAMrB,kBAAkBsB;KACxBC,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EAAEC,kBAAkBvB,iBAAiBwB,UAAU;IAChEC,UAAU,CACN,EACIV,YAAY;KACRC,MAAMjB,iBAAiB2B;KACvBR,MAAMrB,kBAAkB6B;KACxBN,SAAS;KACTC,SAAS;IACb,EACJ,GACA,EACIN,YAAY;KACRC,MAAMjB,iBAAiB4B;KACvBT,MAAMrB,kBAAkB8B;KACxBP,SAAS;KACTC,SAAS;IACb,EACJ,CACH;GACL;GAKA;IACIN,YAAY;KACRC,MAAMjB,iBAAiB6B;KACvBV,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KAEH;KACA;KAMA;KACA;KACA;KACA;KACA;IACH,EACL;GACJ;GACA;IACIhB,YAAY;KACRC,MAAMjB,iBAAiBiC;KACvBd,MAAMrB,kBAAkBgC;KACxBC,QAAQ;KACRV,SAAS;KACTC,SAAS;IACb;IACAC,iBAAiB,EACbS,OAAO;KACH;KACA;KACA;KACA;KACA;KAGA;IACH,EACL;GACJ;EACH;CACL;CAEAE,mBAAmD;EAC/C,MAAMC,uBAA0D;IAC3D/B,eAAegC,qBAAqB,CAACpC,iBAAiBkB,SAASlB,iBAAiB6B,wBAAyB;IACzGzB,eAAeiC,mBAAmB,CAACrC,iBAAiBkB,SAASlB,iBAAiBiC,sBAAuB;EAC1G;EAEA,OAAOK,OAAOC,OAAOnC,cAAAA,CAAAA,CAChBoC,KAAKvB,SAAAA;GACF,MAAMwB,SAAuC;IACzCC,UAAU;KACNvB,MAAMN,+BAA+B8B;KACrC3B,YAAY,CAAC,SAAU;IAC3B;IACAA,YAAY;KACRC;KACAI,SAAS;IACb;GACJ;GAEA,MAAMuB,WAAWT,qBAAqBlB;GACtC,IAAI2B,UACAH,OAAOI,YAAY,EAAED,SAAS;GAGlC,OAAOH;EACX,CAAA;CACR;CAEAK,cAAyC;EACrC,OAAOR,OAAOC,OAAO/B,SAAAA,CAAAA,CAChBgC,KAAKvB,UAAU;GACZyB,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC;IACAI,SAAS;GACb;EACJ,EAAA;CACR;CAEA0B,aAAuC;EACnC,OAAO,CACH;GACIL,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMX;IACNe,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IAExBC,6BAA6BlD,WAAWmD;GAC5C;EACJ,GACA;GACIR,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMV;IACNc,SAAS;GACb;GACAwB,WAAW;IACPG,mBAAmB,CAAC,GAAI;IACxBG,0BAA0B;KACtB/C,eAAegD;KACfhD,eAAeiD;KACfjD,eAAekD;IAClB;IAIDL,6BAA6BlD,WAAWwD;IACxCC,sCAAsC,GACjCzD,WAAW0D,MAAM;KACdrD,eAAesD;KACftD,eAAeuD;KACfvD,eAAewD;KACfxD,eAAeyD;KACfzD,eAAe0D;KACf1D,eAAe2D;KACf3D,eAAe4D;KACf5D,eAAe6D;KACf7D,eAAe8D;KACf9D,eAAe+D;KACf/D,eAAegE;KACfhE,eAAeiE;KACfjE,eAAekE;KACflE,eAAemE;KACfnE,eAAeoE;KACfpE,eAAeqE;KACfrE,eAAesE;KACftE,eAAeuE;KACfvE,eAAewE;KACfxE,eAAeyE;KACfzE,eAAe0E;KACf1E,eAAe2E;KACf3E,eAAe4E;KACf5E,eAAe6E;KACf7E,eAAe8E;KACf9E,eAAe+E;KACf/E,eAAegF;IAClB,EACL;GACJ;EACJ,CACH;CACL;CAEA,MAAMC,YAAYC,QAAoD;EAClE,MAAMC,cAAwC;GAC1C7C,UAAU;IACNvB,MAAMN,+BAA+B8B;IACrC3B,YAAY,CAAC,SAAU;GAC3B;GACAA,YAAY;IACRC,MAAMZ;IACNgB,SAAS;GACb;GACAwB,WAAW,CAAC;EAChB;EAEA,MAAM2C,yBAAyB,IAAI7E,uBAAAA;EAEnC,IAAI8E;EACJ,IAAIH,OAAOI,wBACPD,eAAe;GACXtE,MAAMN,+BAA+B8B;GACrC3B,YAAY,CAAC,UAAW;EAC5B;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAU8C,QAAQ,CAC1B;GACIjD,UAAU+C;GACVzE,YAAY;IACRC,MAAM;IACN2E,UAAU,MAAMJ,uBAAuBK,QAAQP,OAAOQ,iBAAiB;IACvEC,OAAOtF,mBAAmB,OAAA;IAC1BuF,QAAQV,OAAOW;GACnB;GACApD,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,MAAM6F,2BAA2B,IAAIzF,yBAAAA;EAErC,IAAI0F;EACJ,IAAId,OAAOe,yBACPD,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;IAAsB;IAAU;IAAgB;GAAkB;EAC5G;OAEAoF,iBAAiB;GACbjF,MAAMN,+BAA+B8B;GACrC3B,YAAY;IAAC;IAAW;IAAc;GAAqB;EAC/D;EAGJuE,YAAY1C,YAAY0C,YAAY1C,aAAa,CAAC;EAClD0C,YAAY1C,UAAUyD,UAAU,CAC5B;GACI5D,UAAU0D;GACVpF,YAAY;IACRK,SAAS;IACTkF,YAAYrG,iBAAiBsG;IAC7BC,oBAAoBtG,yBAAyBuG;IAC7CzF,MAAM;IACN0F,QAAQ,MAAMR,yBAAyBN,QAAQP,OAAOsB,oBAAoB,EAAEC,cAAc,MAAM,CAAA;IAChGA,cAAc;IACdb,QAAQV,OAAOwB;GACnB;GACAjE,WAAW,EAAEqD,aAAa,CAAC5F,eAAgB,EAAC;EAChD,CACH;EAED,OAAO,CAACiF,WAAY;CACxB;CAEA,MAAMwB,KAAKC,WAAwD;EAC/D,MAAM1B,SAAS0B,UAAUC,QAAQrG,kBAAAA;EAEjC,OAAO;GACHgC,UAAU,KAAK7B,cAAa;GAC5BmG,aAAa,KAAKhF,iBAAgB;GAClCiF,QAAQ,KAAKrE,YAAW;GACxBsE,OAAO,KAAKrE,WAAU;GACtBsE,QAAQ,MAAM,KAAKhC,YAAYC,MAAAA;EACnC;CACJ;AACJ"}

package/dist/app/modules/runtime/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/runtime/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,qBAAa,aAAc,YAAW,OAAO;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAapD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/runtime/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAKxC,qBAAa,aAAc,YAAW,OAAO;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;;IAO1B,KAAK,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAcpD"}

package/dist/app/modules/runtime/module.mjs

@@ -20,7 +20,8 @@ var RuntimeModule = class {
 		const config = container.resolve(ConfigInjectionKey);
 		const logger = container.resolve(LoggerInjectionKey);
 		logger.debug(`Environment: ${config.env}`);
-		logger.debug(`WritableDirectoryPath: ${config.writableDirectoryPath}`);
+		logger.debug(`LogDirectoryPath: ${config.logDirectoryPath}`);
+		logger.debug(`ProvisioningDirectoryPath: ${config.provisioningDirectoryPath}`);
 		logger.debug(`Port: ${config.port}`);
 		logger.debug(`Host: ${config.host}`);
 		logger.debug(`Base-URL: ${config.publicUrl}`);

package/dist/app/modules/runtime/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["ModuleName","LoggerInjectionKey","ConfigInjectionKey","resolveURL","RuntimeModule","name","dependencies","RUNTIME","CONFIG","LOGGER","setup","container","config","resolve","logger","debug","env","writableDirectoryPath","port","host","publicUrl"],"sources":["../../../../src/app/modules/runtime/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { resolveURL } from '../../../utils/index.ts';\n\nexport class RuntimeModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.RUNTIME;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug(`Environment: ${config.env}`);\n        logger.debug(`WritableDirectoryPath: ${config.writableDirectoryPath}`);\n        logger.debug(`Port: ${config.port}`);\n        logger.debug(`Host: ${config.host}`);\n        logger.debug(`Base-URL: ${config.publicUrl}`);\n        logger.debug(`Docs-URL: ${resolveURL(config.publicUrl, 'docs')}`);\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;AAcA,IAAaI,gBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOL,WAAWO;EACvB,KAAKD,eAAe,CAACN,WAAWQ,QAAQR,WAAWS,MAAO;CAC9D;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQX,kBAAAA;EACjC,MAAMY,SAASH,UAAUE,QAAQZ,kBAAAA;EAEjCa,OAAOC,MAAM,gBAAgBH,OAAOI,KAAK;EACzCF,OAAOC,MAAM,0BAA0BH,OAAOK,uBAAuB;EACrEH,OAAOC,MAAM,SAASH,OAAOM,MAAM;EACnCJ,OAAOC,MAAM,SAASH,OAAOO,MAAM;EACnCL,OAAOC,MAAM,aAAaH,OAAOQ,WAAW;EAC5CN,OAAOC,MAAM,aAAaZ,WAAWS,OAAOQ,WAAW,MAAA,GAAS;CACpE;AAGJ"}
+{"version":3,"file":"module.mjs","names":["ModuleName","LoggerInjectionKey","ConfigInjectionKey","resolveURL","RuntimeModule","name","dependencies","RUNTIME","CONFIG","LOGGER","setup","container","config","resolve","logger","debug","env","logDirectoryPath","provisioningDirectoryPath","port","host","publicUrl"],"sources":["../../../../src/app/modules/runtime/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport type { IContainer } from 'eldin';\nimport { LoggerInjectionKey } from '../logger/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\nimport { resolveURL } from '../../../utils/index.ts';\n\nexport class RuntimeModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.RUNTIME;\n        this.dependencies = [ModuleName.CONFIG, ModuleName.LOGGER];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        const config = container.resolve(ConfigInjectionKey);\n        const logger = container.resolve(LoggerInjectionKey);\n\n        logger.debug(`Environment: ${config.env}`);\n        logger.debug(`LogDirectoryPath: ${config.logDirectoryPath}`);\n        logger.debug(`ProvisioningDirectoryPath: ${config.provisioningDirectoryPath}`);\n        logger.debug(`Port: ${config.port}`);\n        logger.debug(`Host: ${config.host}`);\n        logger.debug(`Base-URL: ${config.publicUrl}`);\n        logger.debug(`Docs-URL: ${resolveURL(config.publicUrl, 'docs')}`);\n    }\n\n    // ----------------------------------------------------\n}\n"],"mappings":";;;;;;;;;;;AAcA,IAAaI,gBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOL,WAAWO;EACvB,KAAKD,eAAe,CAACN,WAAWQ,QAAQR,WAAWS,MAAO;CAC9D;CAEA,MAAMC,MAAMC,WAAsC;EAC9C,MAAMC,SAASD,UAAUE,QAAQX,kBAAAA;EACjC,MAAMY,SAASH,UAAUE,QAAQZ,kBAAAA;EAEjCa,OAAOC,MAAM,gBAAgBH,OAAOI,KAAK;EACzCF,OAAOC,MAAM,qBAAqBH,OAAOK,kBAAkB;EAC3DH,OAAOC,MAAM,8BAA8BH,OAAOM,2BAA2B;EAC7EJ,OAAOC,MAAM,SAASH,OAAOO,MAAM;EACnCL,OAAOC,MAAM,SAASH,OAAOQ,MAAM;EACnCN,OAAOC,MAAM,aAAaH,OAAOS,WAAW;EAC5CP,OAAOC,MAAM,aAAaZ,WAAWS,OAAOS,WAAW,MAAA,GAAS;CACpE;AAGJ"}

package/dist/app/types.d.ts

@@ -1,5 +1,21 @@
 import type { ConfigModule } from './modules/index.ts';
+import type { IModule } from 'orkos';
+import type { IContainer } from 'eldin';
 export type CreateApplicationContext = {
+    /**
+     * A pre-configured DI container. Registering a token before setup wins
+     * over the module that would otherwise register it, which is the
+     * test-fake seam (see testing.md).
+     */
+    container?: IContainer;
     config?: ConfigModule;
+    /**
+     * The HTTP module to run instead of the default one, which is how a
+     * caller composes something else onto the same listener: `HTTPModule`
+     * takes a `mount` callback that runs INSIDE its own `setup()`, after its
+     * controllers and before its error middleware, so a caller's routes land
+     * exactly where a console's have to (see `HTTPModuleOptions.mount`).
+     */
+    http?: IModule;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/app/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/app/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACnC,MAAM,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/app/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAExC,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;CACjB,CAAC"}

package/dist/cli/commands/config.d.ts

@@ -0,0 +1,40 @@
+import type { ParsedArgs } from 'citty';
+import type { ConfigReadFsOptions } from '@authup/server-config';
+import type { Config } from '../../app/index.ts';
+import { ConfigModule } from '../../app/index.ts';
+import type { CLIConfigArgs } from './types.ts';
+export declare const CLI_CONFIG_ARGS: {
+    configDirectory: {
+        type: "string";
+        description: string;
+    };
+    configFile: {
+        type: "string";
+        description: string;
+    };
+};
+export declare function applyCLIConfigArgs(options: ConfigReadFsOptions<Config>, args: CLIConfigArgs): ConfigReadFsOptions<Config>;
+export declare function createCLIConfigModule(options?: ConfigReadFsOptions<Config>): ConfigModule;
+/**
+ * Refuse a positional after a command that takes none, on the ROOT args
+ * (`_` = [command, ...positionals]), before the subcommand is even resolved.
+ * citty validates nothing here: a positional's `options` are decorative.
+ *
+ * The set is the caller's, because two CLIs share this helper and disagree
+ * about which commands take a positional: the default is this package's own
+ * dev CLI, whose `start` takes none, while the `authup` CLI's `start` takes a
+ * role and validates it itself.
+ */
+export declare function assertNoStrayPositionals(args: Pick<ParsedArgs, '_'>, commands?: ReadonlySet<string>): void;
+/**
+ * The raw ValidupError message is a generic "Property <path> is invalid" and
+ * names no reason, so every issue is rendered instead. Same shape as the
+ * provisioning file loader.
+ *
+ * Anything else is rendered with its cause chain: confinity wraps a parse
+ * failure so that the file is always named, which leaves the reason (the line
+ * and column a YAML parser reports) one level down. The stack is deliberately
+ * left out, unlike the log-side describeError.
+ */
+export declare function describeConfigError(error: unknown): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/cli/commands/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,OAAO,CAAC;AAGjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACH,YAAY,EAEf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,eAAe;;;;;;;;;CAST,CAAC;AAEpB,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EACpC,IAAI,EAAE,aAAa,GACnB,mBAAmB,CAAC,MAAM,CAAC,CAU9B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,mBAAmB,CAAC,MAAM,CAAM,GAAI,YAAY,CAK9F;AAID;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACpC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAC3B,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAoC,GAChE,IAAI,CAQP;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAI,MAAM,CAc3D"}

package/dist/cli/commands/config.mjs

@@ -0,0 +1,65 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { describeCauseChain } from "../../utils/error.mjs";
+import "../../utils/index.mjs";
+import { readConfig } from "../../app/modules/config/read.mjs";
+import { ConfigModule } from "../../app/modules/config/module.mjs";
+import "../../app/index.mjs";
+import { isValidupError, stringifyPath } from "validup";
+//#region src/cli/commands/config.ts
+const CLI_CONFIG_ARGS = {
+	configDirectory: {
+		type: "string",
+		description: "Config directory path"
+	},
+	configFile: {
+		type: "string",
+		description: "Name of one or more configuration files."
+	}
+};
+function applyCLIConfigArgs(options, args) {
+	if (args.configDirectory) options.cwd = args.configDirectory;
+	if (args.configFile) options.file = args.configFile;
+	return options;
+}
+function createCLIConfigModule(options = {}) {
+	return new ConfigModule(() => readConfig({
+		env: true,
+		fs: options
+	}));
+}
+const CLI_COMMANDS_WITHOUT_POSITIONALS = /* @__PURE__ */ new Set(["start"]);
+/**
+* Refuse a positional after a command that takes none, on the ROOT args
+* (`_` = [command, ...positionals]), before the subcommand is even resolved.
+* citty validates nothing here: a positional's `options` are decorative.
+*
+* The set is the caller's, because two CLIs share this helper and disagree
+* about which commands take a positional: the default is this package's own
+* dev CLI, whose `start` takes none, while the `authup` CLI's `start` takes a
+* role and validates it itself.
+*/ function assertNoStrayPositionals(args, commands = CLI_COMMANDS_WITHOUT_POSITIONALS) {
+	const [command, ...rest] = args._;
+	if (!command || !commands.has(command) || rest.length === 0) return;
+	throw new Error(`Unexpected argument "${rest[0]}" for command "${command}".`);
+}
+/**
+* The raw ValidupError message is a generic "Property <path> is invalid" and
+* names no reason, so every issue is rendered instead. Same shape as the
+* provisioning file loader.
+*
+* Anything else is rendered with its cause chain: confinity wraps a parse
+* failure so that the file is always named, which leaves the reason (the line
+* and column a YAML parser reports) one level down. The stack is deliberately
+* left out, unlike the log-side describeError.
+*/ function describeConfigError(error) {
+	if (isValidupError(error)) return `The configuration is invalid.\n${error.issues.map((issue) => `  ${stringifyPath(issue.path)}: ${issue.message}`).join("\n")}`;
+	const message = error instanceof Error ? error.message : String(error);
+	const causes = describeCauseChain(error);
+	return causes ? `${message}\n  cause: ${causes}` : message;
+}
+//#endregion
+export { CLI_CONFIG_ARGS, applyCLIConfigArgs, assertNoStrayPositionals, createCLIConfigModule, describeConfigError };
+
+//# sourceMappingURL=config.mjs.map

package/dist/cli/commands/config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.mjs","names":["isValidupError","stringifyPath","describeCauseChain","ConfigModule","readConfig","CLI_CONFIG_ARGS","configDirectory","type","description","configFile","applyCLIConfigArgs","options","args","cwd","file","createCLIConfigModule","env","fs","CLI_COMMANDS_WITHOUT_POSITIONALS","Set","assertNoStrayPositionals","commands","command","rest","_","has","length","Error","describeConfigError","error","issues","map","issue","path","message","join","String","causes"],"sources":["../../../src/cli/commands/config.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ArgsDef, ParsedArgs } from 'citty';\nimport { isValidupError, stringifyPath } from 'validup';\nimport { describeCauseChain } from '../../utils/index.ts';\nimport type { ConfigReadFsOptions } from '@authup/server-config';\nimport type { Config } from '../../app/index.ts';\nimport {\n    ConfigModule,\n    readConfig,\n} from '../../app/index.ts';\nimport type { CLIConfigArgs } from './types.ts';\n\nexport const CLI_CONFIG_ARGS = {\n    configDirectory: {\n        type: 'string',\n        description: 'Config directory path',\n    },\n    configFile: {\n        type: 'string',\n        description: 'Name of one or more configuration files.',\n    },\n} satisfies ArgsDef;\n\nexport function applyCLIConfigArgs(\n    options: ConfigReadFsOptions<Config>,\n    args: CLIConfigArgs,\n) : ConfigReadFsOptions<Config> {\n    if (args.configDirectory) {\n        options.cwd = args.configDirectory;\n    }\n\n    if (args.configFile) {\n        options.file = args.configFile;\n    }\n\n    return options;\n}\n\nexport function createCLIConfigModule(options: ConfigReadFsOptions<Config> = {}) : ConfigModule {\n    return new ConfigModule(() => readConfig({\n        env: true,\n        fs: options,\n    }));\n}\n\nconst CLI_COMMANDS_WITHOUT_POSITIONALS : ReadonlySet<string> = new Set(['start']);\n\n/**\n * Refuse a positional after a command that takes none, on the ROOT args\n * (`_` = [command, ...positionals]), before the subcommand is even resolved.\n * citty validates nothing here: a positional's `options` are decorative.\n *\n * The set is the caller's, because two CLIs share this helper and disagree\n * about which commands take a positional: the default is this package's own\n * dev CLI, whose `start` takes none, while the `authup` CLI's `start` takes a\n * role and validates it itself.\n */\nexport function assertNoStrayPositionals(\n    args: Pick<ParsedArgs, '_'>,\n    commands: ReadonlySet<string> = CLI_COMMANDS_WITHOUT_POSITIONALS,\n) : void {\n    const [command, ...rest] = args._;\n\n    if (!command || !commands.has(command) || rest.length === 0) {\n        return;\n    }\n\n    throw new Error(`Unexpected argument \"${rest[0]}\" for command \"${command}\".`);\n}\n\n/**\n * The raw ValidupError message is a generic \"Property <path> is invalid\" and\n * names no reason, so every issue is rendered instead. Same shape as the\n * provisioning file loader.\n *\n * Anything else is rendered with its cause chain: confinity wraps a parse\n * failure so that the file is always named, which leaves the reason (the line\n * and column a YAML parser reports) one level down. The stack is deliberately\n * left out, unlike the log-side describeError.\n */\nexport function describeConfigError(error: unknown) : string {\n    if (isValidupError(error)) {\n        const issues = error.issues\n            .map((issue) => `  ${stringifyPath(issue.path)}: ${issue.message}`)\n            .join('\\n');\n\n        return `The configuration is invalid.\\n${issues}`;\n    }\n\n    const message = error instanceof Error ? error.message : String(error);\n\n    const causes = describeCauseChain(error);\n\n    return causes ? `${message}\\n  cause: ${causes}` : message;\n}\n"],"mappings":";;;;;;;;;;AAkBA,MAAaK,kBAAkB;CAC3BC,iBAAiB;EACbC,MAAM;EACNC,aAAa;CACjB;CACAC,YAAY;EACRF,MAAM;EACNC,aAAa;CACjB;AACJ;AAEA,SAAgBE,mBACZC,SACAC,MAAmB;CAEnB,IAAIA,KAAKN,iBACLK,QAAQE,MAAMD,KAAKN;CAGvB,IAAIM,KAAKH,YACLE,QAAQG,OAAOF,KAAKH;CAGxB,OAAOE;AACX;AAEA,SAAgBI,sBAAsBJ,UAAuC,CAAC,GAAC;CAC3E,OAAO,IAAIR,mBAAmBC,WAAW;EACrCY,KAAK;EACLC,IAAIN;CACR,CAAA,CAAA;AACJ;AAEA,MAAMO,mDAAyD,IAAIC,IAAI,CAAC,OAAQ,CAAA;;;;;;;;;;GAYhF,SAAgBC,yBACZR,MACAS,WAAgCH,kCAAgC;CAEhE,MAAM,CAACI,SAAS,GAAGC,QAAQX,KAAKY;CAEhC,IAAI,CAACF,WAAW,CAACD,SAASI,IAAIH,OAAAA,KAAYC,KAAKG,WAAW,GACtD;CAGJ,MAAM,IAAIC,MAAM,wBAAwBJ,KAAK,GAAG,iBAAiBD,QAAQ,GAAG;AAChF;;;;;;;;;;GAYA,SAAgBM,oBAAoBC,OAAc;CAC9C,IAAI7B,eAAe6B,KAAAA,GAKf,OAAO,kCAJQA,MAAMC,OAChBC,KAAKC,UAAU,KAAK/B,cAAc+B,MAAMC,IAAI,EAAE,IAAID,MAAME,SAAS,CAAA,CACjEC,KAAK,IAE+BL;CAG7C,MAAMI,UAAUL,iBAAiBF,QAAQE,MAAMK,UAAUE,OAAOP,KAAAA;CAEhE,MAAMQ,SAASnC,mBAAmB2B,KAAAA;CAElC,OAAOQ,SAAS,GAAGH,QAAQ,aAAaG,WAAWH;AACvD"}

package/dist/cli/commands/healthcheck.d.ts

@@ -1,3 +1,4 @@
-import type { ConfigReadFsOptions } from '../../app/index.ts';
-export declare function defineCLIHealthCheckCommand(configFs?: ConfigReadFsOptions): import("citty").CommandDef<import("citty").ArgsDef>;
+import type { ConfigReadFsOptions } from '@authup/server-config';
+import type { Config } from '../../app/index.ts';
+export declare function defineCLIHealthCheckCommand(configFs?: ConfigReadFsOptions<Config>): import("citty").CommandDef<import("citty").ArgsDef>;
 //# sourceMappingURL=healthcheck.d.ts.map

package/dist/cli/commands/healthcheck.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/healthcheck.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D,wBAAgB,2BAA2B,CAAC,QAAQ,GAAE,mBAAwB,uDAmC7E"}
+{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/healthcheck.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,wBAAgB,2BAA2B,CAAC,QAAQ,GAAE,mBAAmB,CAAC,MAAM,CAAM,uDAmCrF"}

package/dist/cli/commands/healthcheck.mjs

@@ -4,14 +4,17 @@ import.meta.url;
 import { ConfigInjectionKey } from "../../app/modules/config/constants.mjs";
 import { ApplicationBuilder } from "../../app/builder.mjs";
 import "../../app/index.mjs";
-import { createCLIConfigModule } from "../config.mjs";
-import process from "node:process";
+import { createCLIConfigModule } from "./config.mjs";
 import { defineCommand } from "citty";
 import http from "node:http";
+import process from "node:process";
 //#region src/cli/commands/healthcheck.ts
 function defineCLIHealthCheckCommand(configFs = {}) {
 	return defineCommand({
-		meta: { name: "healthcheck" },
+		meta: {
+			name: "healthcheck",
+			description: "Probe the API listener and exit non-zero when it does not answer."
+		},
 		async setup() {
 			const app = new ApplicationBuilder().withConfig(createCLIConfigModule(configFs)).build();
 			await app.setup();

package/dist/cli/commands/healthcheck.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"healthcheck.mjs","names":["defineCommand","http","process","ApplicationBuilder","ConfigInjectionKey","createCLIConfigModule","defineCLIHealthCheckCommand","configFs","meta","name","setup","app","withConfig","build","config","container","resolve","healthCheck","request","path","host","port","timeout","res","statusCode","exit","on","end"],"sources":["../../../src/cli/commands/healthcheck.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport http from 'node:http';\nimport process from 'node:process';\nimport type { ConfigReadFsOptions } from '../../app/index.ts';\nimport { ApplicationBuilder, ConfigInjectionKey } from '../../app/index.ts';\nimport { createCLIConfigModule } from '../config.ts';\n\nexport function defineCLIHealthCheckCommand(configFs: ConfigReadFsOptions = {}) {\n    return defineCommand({\n        meta: { name: 'healthcheck' },\n        async setup() {\n            const app = new ApplicationBuilder()\n                .withConfig(createCLIConfigModule(configFs))\n                .build();\n\n            await app.setup();\n\n            const config = app.container.resolve(ConfigInjectionKey);\n\n            const healthCheck = http.request(\n                {\n                    path: '/metrics',\n                    host: '0.0.0.0',\n                    port: config.port,\n                    timeout: 2000,\n                },\n                (res) => {\n                    if (res.statusCode === 200) {\n                        process.exit(0);\n                    } else {\n                        process.exit(1);\n                    }\n                },\n            );\n\n            healthCheck.on('error', () => {\n                process.exit(1);\n            });\n\n            healthCheck.end();\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;AAcA,SAAgBM,4BAA4BC,WAAgC,CAAC,GAAC;CAC1E,OAAOP,cAAc;EACjBQ,MAAM,EAAEC,MAAM,cAAc;EAC5B,MAAMC,QAAAA;GACF,MAAMC,MAAM,IAAIR,mBAAAA,CAAAA,CACXS,WAAWP,sBAAsBE,QAAAA,CAAAA,CAAAA,CACjCM,MAAK;GAEV,MAAMF,IAAID,MAAK;GAEf,MAAMI,SAASH,IAAII,UAAUC,QAAQZ,kBAAAA;GAErC,MAAMa,cAAchB,KAAKiB,QACrB;IACIC,MAAM;IACNC,MAAM;IACNC,MAAMP,OAAOO;IACbC,SAAS;GACb,IACCC,QAAAA;IACG,IAAIA,IAAIC,eAAe,KACnBtB,QAAQuB,KAAK,CAAA;SAEbvB,QAAQuB,KAAK,CAAA;GAErB,CAAA;GAGJR,YAAYS,GAAG,eAAS;IACpBxB,QAAQuB,KAAK,CAAA;GACjB,CAAA;GAEAR,YAAYU,IAAG;EACnB;CACJ,CAAA;AACJ"}
+{"version":3,"file":"healthcheck.mjs","names":["defineCommand","http","process","ApplicationBuilder","ConfigInjectionKey","createCLIConfigModule","defineCLIHealthCheckCommand","configFs","meta","name","description","setup","app","withConfig","build","config","container","resolve","healthCheck","request","path","host","port","timeout","res","statusCode","exit","on","end"],"sources":["../../../src/cli/commands/healthcheck.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport http from 'node:http';\nimport process from 'node:process';\nimport type { ConfigReadFsOptions } from '@authup/server-config';\nimport type { Config } from '../../app/index.ts';\nimport { ApplicationBuilder, ConfigInjectionKey  } from '../../app/index.ts';\nimport { createCLIConfigModule } from './config.ts';\n\nexport function defineCLIHealthCheckCommand(configFs: ConfigReadFsOptions<Config> = {}) {\n    return defineCommand({\n        meta: { name: 'healthcheck', description: 'Probe the API listener and exit non-zero when it does not answer.' },\n        async setup() {\n            const app = new ApplicationBuilder()\n                .withConfig(createCLIConfigModule(configFs))\n                .build();\n\n            await app.setup();\n\n            const config = app.container.resolve(ConfigInjectionKey);\n\n            const healthCheck = http.request(\n                {\n                    path: '/metrics',\n                    host: '0.0.0.0',\n                    port: config.port,\n                    timeout: 2000,\n                },\n                (res) => {\n                    if (res.statusCode === 200) {\n                        process.exit(0);\n                    } else {\n                        process.exit(1);\n                    }\n                },\n            );\n\n            healthCheck.on('error', () => {\n                process.exit(1);\n            });\n\n            healthCheck.end();\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgBM,4BAA4BC,WAAwC,CAAC,GAAC;CAClF,OAAOP,cAAc;EACjBQ,MAAM;GAAEC,MAAM;GAAeC,aAAa;EAAoE;EAC9G,MAAMC,QAAAA;GACF,MAAMC,MAAM,IAAIT,mBAAAA,CAAAA,CACXU,WAAWR,sBAAsBE,QAAAA,CAAAA,CAAAA,CACjCO,MAAK;GAEV,MAAMF,IAAID,MAAK;GAEf,MAAMI,SAASH,IAAII,UAAUC,QAAQb,kBAAAA;GAErC,MAAMc,cAAcjB,KAAKkB,QACrB;IACIC,MAAM;IACNC,MAAM;IACNC,MAAMP,OAAOO;IACbC,SAAS;GACb,IACCC,QAAAA;IACG,IAAIA,IAAIC,eAAe,KACnBvB,QAAQwB,KAAK,CAAA;SAEbxB,QAAQwB,KAAK,CAAA;GAErB,CAAA;GAGJR,YAAYS,GAAG,eAAS;IACpBzB,QAAQwB,KAAK,CAAA;GACjB,CAAA;GAEAR,YAAYU,IAAG;EACnB;CACJ,CAAA;AACJ"}

package/dist/cli/commands/index.d.ts

@@ -1,4 +1,7 @@
+export * from './config.ts';
 export * from './healthcheck.ts';
 export * from './migration.ts';
+export * from './shutdown.ts';
 export * from './start.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/cli/commands/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/cli/commands/index.mjs

@@ -1,7 +1,9 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { CLI_CONFIG_ARGS, applyCLIConfigArgs, assertNoStrayPositionals, createCLIConfigModule, describeConfigError } from "./config.mjs";
 import { defineCLIHealthCheckCommand } from "./healthcheck.mjs";
 import { defineCLIMigrationCommand } from "./migration.mjs";
+import { registerShutdownHandlers } from "./shutdown.mjs";
 import { defineCLIStartCommand } from "./start.mjs";
-export { defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand };
+export { CLI_CONFIG_ARGS, applyCLIConfigArgs, assertNoStrayPositionals, createCLIConfigModule, defineCLIHealthCheckCommand, defineCLIMigrationCommand, defineCLIStartCommand, describeConfigError, registerShutdownHandlers };

package/dist/cli/commands/migration.d.ts

@@ -1,17 +1,10 @@
-import type { ConfigReadFsOptions } from '../../app/index.ts';
-declare enum MigrationOperation {
-    GENERATE = "generate",
-    REVERT = "revert",
-    STATUS = "status",
-    RUN = "run"
-}
-export declare function defineCLIMigrationCommand(configFs?: ConfigReadFsOptions): import("citty").CommandDef<{
+import type { ConfigReadFsOptions } from '@authup/server-config';
+import type { Config } from '../../app/index.ts';
+export declare function defineCLIMigrationCommand(configFs?: ConfigReadFsOptions<Config>): import("citty").CommandDef<{
     readonly operation: {
         readonly required: true;
         readonly type: "positional";
-        readonly options: MigrationOperation[];
         readonly valueHint: string;
     };
 }>;
-export {};
 //# sourceMappingURL=migration.d.ts.map

package/dist/cli/commands/migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAW9D,aAAK,kBAAkB;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAsID,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,mBAAwB;;;;;;;GAyC3E"}
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migration.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA+JjD,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,mBAAmB,CAAC,MAAM,CAAM;;;;;;GA+CnF"}

package/dist/cli/commands/migration.mjs

@@ -3,18 +3,18 @@ import "node:url";
 import.meta.url;
 import { ModuleName } from "../../app/modules/constants.mjs";
 import { ConfigInjectionKey } from "../../app/modules/config/constants.mjs";
-import { DataSourceOptionsBuilder } from "../../adapters/database/data-source/options/module.mjs";
-import "../../adapters/database/index.mjs";
 import { LoggerInjectionKey } from "../../app/modules/logger/constants.mjs";
 import { CODE_PATH } from "../../path.mjs";
+import { DataSourceOptionsBuilder } from "../../adapters/database/data-source/options/module.mjs";
+import "../../adapters/database/index.mjs";
 import { ApplicationBuilder } from "../../app/builder.mjs";
 import "../../app/index.mjs";
-import { createCLIConfigModule } from "../config.mjs";
+import { createCLIConfigModule } from "./config.mjs";
 import { DataSource } from "typeorm";
 import { checkDatabase, createDatabase, dropDatabase, generateMigration, transformFilePath } from "typeorm-extension";
 import path from "node:path";
-import process from "node:process";
 import { defineCommand } from "citty";
+import process from "node:process";
 //#region src/cli/commands/migration.ts
 var MigrationOperation = /*#__PURE__*/ function(MigrationOperation) {
 	MigrationOperation["GENERATE"] = "generate";
@@ -23,6 +23,10 @@ var MigrationOperation = /*#__PURE__*/ function(MigrationOperation) {
 	MigrationOperation["RUN"] = "run";
 	return MigrationOperation;
 }(MigrationOperation || {});
+const OPERATIONS = Object.values(MigrationOperation);
+function isMigrationOperation(value) {
+	return OPERATIONS.includes(value);
+}
 async function runMigrationOperation(container, operation) {
 	const config = container.resolve(ConfigInjectionKey);
 	const logger = container.resolve(LoggerInjectionKey);
@@ -110,23 +114,27 @@ async function generateMigrations() {
 }
 function defineCLIMigrationCommand(configFs = {}) {
 	return defineCommand({
-		meta: { name: "migration" },
+		meta: {
+			name: "migration",
+			description: "Apply, revert or generate the database migrations."
+		},
 		args: { operation: {
 			required: true,
 			type: "positional",
-			options: Object.values(MigrationOperation),
-			valueHint: Object.values(MigrationOperation).join("|")
+			valueHint: OPERATIONS.join("|")
 		} },
 		async setup(context) {
+			const { operation } = context.args;
+			if (!isMigrationOperation(operation)) throw new Error(`Unknown migration operation "${operation}". Expected one of: ${OPERATIONS.join(", ")}.`);
 			try {
-				if (context.args.operation === "generate") await generateMigrations();
+				if (operation === "generate") await generateMigrations();
 				else {
 					const app = new ApplicationBuilder().withConfig(createCLIConfigModule(configFs)).withLogger().build();
 					app.addModule({
 						name: ModuleName.DATABASE,
 						dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],
 						async setup(container) {
-							await runMigrationOperation(container, context.args.operation);
+							await runMigrationOperation(container, operation);
 						}
 					});
 					await app.setup();

package/dist/cli/commands/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","createCLIConfigModule","MigrationOperation","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","isInitialized","destroy","e","error","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","console","defineCLIMigrationCommand","configFs","meta","args","required","Object","values","valueHint","setup","context","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase, \n    dropDatabase, \n    generateMigration, \n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport type { ConfigReadFsOptions } from '../../app/index.ts';\nimport {\n    ApplicationBuilder,\n    ConfigInjectionKey,\n    LoggerInjectionKey,\n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\nimport { createCLIConfigModule } from '../config.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: string,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        options = optionsBuilder.buildWith(config.db);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true, \n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n\n    try {\n        await dataSource.initialize();\n\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        if (dataSource.isInitialized) {\n            try {\n                await dataSource.destroy();\n            } catch (e) {\n                logger.error(`Failed to destroy data source after migration operation: ${e}`);\n            }\n        }\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false, \n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        try {\n            await dataSource.initialize();\n\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            if (dataSource.isInitialized) {\n                try {\n                    await dataSource.destroy();\n                } catch (e) {\n                    // eslint-disable-next-line no-console\n                    console.error(e);\n                }\n            }\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand(configFs: ConfigReadFsOptions = {}) {\n    return defineCommand({\n        meta: { name: 'migration' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                options: Object.values(MigrationOperation),\n                valueHint: Object.values(MigrationOperation).join('|'),\n            },\n        },\n        async setup(context) {\n            try {\n                if (context.args.operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig(createCLIConfigModule(configFs))\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, context.args.operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA8BA,IAAA,qBAAKgB,uBAAAA,oBAAAA;;;;;CAAAA,OAAAA;AAAAA,EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,eAAeC,sBACXC,WACAC,WAAiB;CAEjB,MAAMC,SAASF,UAAUG,QAAQV,kBAAAA;CACjC,MAAMW,SAASJ,UAAUG,QAAQT,kBAAAA;CAEjC,MAAMW,iBAAiB,IAAId,yBAAAA;CAE3B,IAAIe;CACJ,IAAIJ,OAAOK,IACPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU,GAC3B;OAAA,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFejC,cAAc,EAAEqB,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMjC,eAAe;EACjBoB;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAIhC,WAAW;EAC9B,GAAGgB;EACHiB,SAAS;GAAC;GAAS;GAAU;EAAY;CAC7C,CAAA;CAEA,IAAI;EACA,MAAMD,WAAWE,WAAU;EAE3B,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,IAAIL,WAAWM,eACX,IAAI;GACA,MAAMN,WAAWO,QAAO;EAC5B,SAASC,GAAG;GACR1B,OAAO2B,MAAM,4DAA4DD,GAAG;EAChF;CAER;AACJ;AAEA,eAAeE,qBAAAA;CACX,MAAM3B,iBAAiB,IAAId,yBAAAA;CAE3B,MAAM0C,cAAmC,CACrC;EACItB,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACI1B,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CACH;CAED,MAAMC,gBAAgBjD,kBAClBN,KAAKwD,KAAK3C,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAM4C,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBvC,eAAeG,UAAUmC,UAAAA;EACnD,MAAME,gBAAgB9D,KAAKwD,KAAKD,eAAeM,kBAAkBjC,IAAI;EAErE,MAAMxB,aAAa,EAAEmB,SAASsC,kBAAkB,CAAA;EAChD,MAAM1D,eAAe;GACjBoB,SAASsC;GACTxB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAIhC,WAAWsD,iBAAAA;EAElC,IAAI;GACA,MAAMtB,WAAWE,WAAU;GAE3B,MAAMF,WAAWK,cAAa;GAE9B,MAAMvC,kBAAkB;IACpBkC;IACAwB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,IAAIzB,WAAWM,eACX,IAAI;IACA,MAAMN,WAAWO,QAAO;GAC5B,SAASC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;GAClB;EAER;CACJ;AACJ;AAEA,SAAgBmB,0BAA0BC,WAAgC,CAAC,GAAC;CACxE,OAAOpE,cAAc;EACjBqE,MAAM,EAAEL,MAAM,YAAY;EAC1BM,MAAM,EACFnD,WAAW;GACPoD,UAAU;GACV1C,MAAM;GACNL,SAASgD,OAAOC,OAAOzD,kBAAAA;GACvB0D,WAAWF,OAAOC,OAAOzD,kBAAAA,CAAAA,CAAoByC,KAAK,GAAA;EACtD,EACJ;EACA,MAAMkB,MAAMC,SAAO;GACf,IAAI;IACA,IAAIA,QAAQN,KAAKnD,cAAS,YACtB,MAAM+B,mBAAAA;SACH;KACH,MAAM2B,MAAM,IAAInE,mBAAAA,CAAAA,CACXoE,WAAW/D,sBAAsBqD,QAAAA,CAAAA,CAAAA,CACjCW,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVjB,MAAMnD,WAAWqE;MACjBC,cAAc,CAACtE,WAAWuE,QAAQvE,WAAWwE,MAAO;MACpD,MAAMV,MAAMzD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAW0D,QAAQN,KAAKnD,SAAS;MACjE;KACJ,CAAA;KAEA,MAAM0D,IAAIF,MAAK;IACnB;IAEAzE,QAAQoF,KAAK,CAAA;GACjB,SAAStC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;IAEd9C,QAAQoF,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}
+{"version":3,"file":"migration.mjs","names":["defineCommand","path","process","checkDatabase","createDatabase","dropDatabase","generateMigration","transformFilePath","DataSource","DataSourceOptionsBuilder","ApplicationBuilder","ConfigInjectionKey","LoggerInjectionKey","ModuleName","CODE_PATH","createCLIConfigModule","MigrationOperation","OPERATIONS","Object","values","isMigrationOperation","value","includes","runMigrationOperation","container","operation","config","resolve","logger","optionsBuilder","options","db","buildWith","buildWithEnv","debug","type","database","Array","isArray","migrations","i","length","check","exists","synchronize","ifNotExist","dataSource","logging","initialize","undoLastMigration","showMigrations","runMigrations","isInitialized","destroy","e","error","generateMigrations","connections","host","port","username","password","baseDirectory","join","timestamp","Date","now","connection","dataSourceOptions","directoryPath","name","prettify","console","defineCLIMigrationCommand","configFs","meta","description","args","required","valueHint","setup","context","Error","app","withConfig","withLogger","build","addModule","DATABASE","dependencies","CONFIG","LOGGER","exit"],"sources":["../../../src/cli/commands/migration.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport path from 'node:path';\nimport process from 'node:process';\nimport {\n    checkDatabase,\n    createDatabase,\n    dropDatabase,\n    generateMigration,\n    transformFilePath,\n} from 'typeorm-extension';\nimport { DataSource, type DataSourceOptions } from 'typeorm';\nimport { DataSourceOptionsBuilder } from '../../adapters/database/index.ts';\nimport type { ConfigReadFsOptions } from '@authup/server-config';\nimport type { Config } from '../../app/index.ts';\nimport {\n    ApplicationBuilder,\n    ConfigInjectionKey,\n    LoggerInjectionKey,\n    ModuleName,\n} from '../../app/index.ts';\nimport type { IContainer } from 'eldin';\nimport { CODE_PATH } from '../../path.ts';\nimport { createCLIConfigModule } from './config.ts';\n\nenum MigrationOperation {\n    GENERATE = 'generate',\n    REVERT = 'revert',\n    STATUS = 'status',\n    RUN = 'run',\n}\n\nconst OPERATIONS = Object.values(MigrationOperation);\n\nfunction isMigrationOperation(value: string) : value is MigrationOperation {\n    return (OPERATIONS as string[]).includes(value);\n}\n\nasync function runMigrationOperation(\n    container: IContainer,\n    operation: MigrationOperation,\n): Promise<void> {\n    const config = container.resolve(ConfigInjectionKey);\n    const logger = container.resolve(LoggerInjectionKey);\n\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    let options: DataSourceOptions;\n    if (config.db) {\n        // the configuration surface is deliberately untyped: `db` is authup's\n        // own loose shape, so the driver union is applied here, at the\n        // boundary where the value reaches typeorm.\n        options = optionsBuilder.buildWith(config.db as DataSourceOptions);\n    } else {\n        options = optionsBuilder.buildWithEnv();\n    }\n\n    logger.debug(`Type: ${options.type}`);\n    logger.debug(`Database: ${options.database}`);\n\n    if (Array.isArray(options.migrations)) {\n        for (let i = 0; i < options.migrations.length; i++) {\n            if (typeof options.migrations[i] === 'string') {\n                logger.debug(`Migration-Directory: ${options.migrations[i]}`);\n            }\n        }\n    } else if (typeof options.migrations === 'string') {\n        logger.debug(`Migration-Directory: ${options.migrations}`);\n    }\n\n    const check = await checkDatabase({ options });\n\n    if (!check.exists) {\n        await createDatabase({\n            options,\n            synchronize: false,\n            ifNotExist: true,\n        });\n    }\n\n    const dataSource = new DataSource({\n        ...options,\n        logging: ['error', 'schema', 'migration'],\n    });\n\n    try {\n        await dataSource.initialize();\n\n        if (operation === MigrationOperation.REVERT) {\n            await dataSource.undoLastMigration();\n        } else if (operation === MigrationOperation.STATUS) {\n            await dataSource.showMigrations();\n        } else {\n            await dataSource.runMigrations();\n        }\n    } finally {\n        if (dataSource.isInitialized) {\n            try {\n                await dataSource.destroy();\n            } catch (e) {\n                logger.error(`Failed to destroy data source after migration operation: ${e}`);\n            }\n        }\n    }\n}\n\nasync function generateMigrations(): Promise<void> {\n    const optionsBuilder = new DataSourceOptionsBuilder();\n\n    const connections: DataSourceOptions[] = [\n        {\n            type: 'postgres',\n            database: 'migrations',\n            host: 'localhost',\n            port: 5432,\n            username: 'postgres',\n            password: 'start123',\n        },\n        {\n            type: 'mysql',\n            database: 'migrations',\n            host: 'localhost',\n            port: 3306,\n            username: 'root',\n            password: 'start123',\n        },\n    ];\n\n    const baseDirectory = transformFilePath(\n        path.join(CODE_PATH, 'adapters', 'database', 'migrations'),\n        './src',\n        './dist',\n    );\n\n    const timestamp = Date.now();\n\n    for (const connection of connections) {\n        const dataSourceOptions = optionsBuilder.buildWith(connection);\n        const directoryPath = path.join(baseDirectory, dataSourceOptions.type);\n\n        await dropDatabase({ options: dataSourceOptions });\n        await createDatabase({\n            options: dataSourceOptions,\n            synchronize: false,\n        });\n\n        const dataSource = new DataSource(dataSourceOptions);\n\n        try {\n            await dataSource.initialize();\n\n            await dataSource.runMigrations();\n\n            await generateMigration({\n                dataSource,\n                name: 'Default',\n                directoryPath,\n                timestamp,\n                prettify: true,\n            });\n        } finally {\n            if (dataSource.isInitialized) {\n                try {\n                    await dataSource.destroy();\n                } catch (e) {\n                    // eslint-disable-next-line no-console\n                    console.error(e);\n                }\n            }\n        }\n    }\n}\n\nexport function defineCLIMigrationCommand(configFs: ConfigReadFsOptions<Config> = {}) {\n    return defineCommand({\n        meta: { name: 'migration', description: 'Apply, revert or generate the database migrations.' },\n        args: {\n            operation: {\n                required: true,\n                type: 'positional',\n                valueHint: OPERATIONS.join('|'),\n            },\n        },\n        async setup(context) {\n            // citty checks a positional's options nowhere, so an unknown operation\n            // used to fall through to `runMigrations` (#3542).\n            const { operation } = context.args;\n            if (!isMigrationOperation(operation)) {\n                throw new Error(`Unknown migration operation \"${operation}\". Expected one of: ${OPERATIONS.join(', ')}.`);\n            }\n\n            try {\n                if (operation === MigrationOperation.GENERATE) {\n                    await generateMigrations();\n                } else {\n                    const app = new ApplicationBuilder()\n                        .withConfig(createCLIConfigModule(configFs))\n                        .withLogger()\n                        .build();\n\n                    app.addModule({\n                        name: ModuleName.DATABASE,\n                        dependencies: [ModuleName.CONFIG, ModuleName.LOGGER],\n                        async setup(container: IContainer): Promise<void> {\n                            await runMigrationOperation(container, operation);\n                        },\n                    });\n\n                    await app.setup();\n                }\n\n                process.exit(0);\n            } catch (e) {\n                // eslint-disable-next-line no-console\n                console.error(e);\n\n                process.exit(1);\n            }\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA+BA,IAAA,qBAAKgB,uBAAAA,oBAAAA;;;;;CAAAA,OAAAA;AAAAA,EAAAA,sBAAAA,CAAAA,CAAAA;AAOL,MAAMC,aAAaC,OAAOC,OAAOH,kBAAAA;AAEjC,SAASI,qBAAqBC,OAAa;CACvC,OAAO,WAAyBC,SAASD,KAAAA;AAC7C;AAEA,eAAeE,sBACXC,WACAC,WAA6B;CAE7B,MAAMC,SAASF,UAAUG,QAAQhB,kBAAAA;CACjC,MAAMiB,SAASJ,UAAUG,QAAQf,kBAAAA;CAEjC,MAAMiB,iBAAiB,IAAIpB,yBAAAA;CAE3B,IAAIqB;CACJ,IAAIJ,OAAOK,IAIPD,UAAUD,eAAeG,UAAUN,OAAOK,EAAE;MAE5CD,UAAUD,eAAeI,aAAY;CAGzCL,OAAOM,MAAM,SAASJ,QAAQK,MAAM;CACpCP,OAAOM,MAAM,aAAaJ,QAAQM,UAAU;CAE5C,IAAIC,MAAMC,QAAQR,QAAQS,UAAU,GAC3B;OAAA,IAAIC,IAAI,GAAGA,IAAIV,QAAQS,WAAWE,QAAQD,KAC3C,IAAI,OAAOV,QAAQS,WAAWC,OAAO,UACjCZ,OAAOM,MAAM,wBAAwBJ,QAAQS,WAAWC,IAAI;CAAA,OAGjE,IAAI,OAAOV,QAAQS,eAAe,UACrCX,OAAOM,MAAM,wBAAwBJ,QAAQS,YAAY;CAK7D,IAAI,EAACG,MAFevC,cAAc,EAAE2B,QAAQ,CAAA,EAAA,CAEjCa,QACP,MAAMvC,eAAe;EACjB0B;EACAc,aAAa;EACbC,YAAY;CAChB,CAAA;CAGJ,MAAMC,aAAa,IAAItC,WAAW;EAC9B,GAAGsB;EACHiB,SAAS;GAAC;GAAS;GAAU;EAAY;CAC7C,CAAA;CAEA,IAAI;EACA,MAAMD,WAAWE,WAAU;EAE3B,IAAIvB,cAAAA,UACA,MAAMqB,WAAWG,kBAAiB;OAC/B,IAAIxB,cAAAA,UACP,MAAMqB,WAAWI,eAAc;OAE/B,MAAMJ,WAAWK,cAAa;CAEtC,UAAU;EACN,IAAIL,WAAWM,eACX,IAAI;GACA,MAAMN,WAAWO,QAAO;EAC5B,SAASC,GAAG;GACR1B,OAAO2B,MAAM,4DAA4DD,GAAG;EAChF;CAER;AACJ;AAEA,eAAeE,qBAAAA;CACX,MAAM3B,iBAAiB,IAAIpB,yBAAAA;CAE3B,MAAMgD,cAAmC,CACrC;EACItB,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,GACA;EACI1B,MAAM;EACNC,UAAU;EACVsB,MAAM;EACNC,MAAM;EACNC,UAAU;EACVC,UAAU;CACd,CACH;CAED,MAAMC,gBAAgBvD,kBAClBN,KAAK8D,KAAKjD,WAAW,YAAY,YAAY,YAAA,GAC7C,SACA,QAAA;CAGJ,MAAMkD,YAAYC,KAAKC,IAAG;CAE1B,KAAK,MAAMC,cAAcV,aAAa;EAClC,MAAMW,oBAAoBvC,eAAeG,UAAUmC,UAAAA;EACnD,MAAME,gBAAgBpE,KAAK8D,KAAKD,eAAeM,kBAAkBjC,IAAI;EAErE,MAAM9B,aAAa,EAAEyB,SAASsC,kBAAkB,CAAA;EAChD,MAAMhE,eAAe;GACjB0B,SAASsC;GACTxB,aAAa;EACjB,CAAA;EAEA,MAAME,aAAa,IAAItC,WAAW4D,iBAAAA;EAElC,IAAI;GACA,MAAMtB,WAAWE,WAAU;GAE3B,MAAMF,WAAWK,cAAa;GAE9B,MAAM7C,kBAAkB;IACpBwC;IACAwB,MAAM;IACND;IACAL;IACAO,UAAU;GACd,CAAA;EACJ,UAAU;GACN,IAAIzB,WAAWM,eACX,IAAI;IACA,MAAMN,WAAWO,QAAO;GAC5B,SAASC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;GAClB;EAER;CACJ;AACJ;AAEA,SAAgBmB,0BAA0BC,WAAwC,CAAC,GAAC;CAChF,OAAO1E,cAAc;EACjB2E,MAAM;GAAEL,MAAM;GAAaM,aAAa;EAAqD;EAC7FC,MAAM,EACFpD,WAAW;GACPqD,UAAU;GACV3C,MAAM;GACN4C,WAAW9D,WAAW8C,KAAK,GAAA;EAC/B,EACJ;EACA,MAAMiB,MAAMC,SAAO;GAGf,MAAM,EAAExD,cAAcwD,QAAQJ;GAC9B,IAAI,CAACzD,qBAAqBK,SAAAA,GACtB,MAAM,IAAIyD,MAAM,gCAAgCzD,UAAU,sBAAsBR,WAAW8C,KAAK,IAAA,EAAM,EAAE;GAG5G,IAAI;IACA,IAAItC,cAAAA,YACA,MAAM+B,mBAAAA;SACH;KACH,MAAM2B,MAAM,IAAIzE,mBAAAA,CAAAA,CACX0E,WAAWrE,sBAAsB2D,QAAAA,CAAAA,CAAAA,CACjCW,WAAU,CAAA,CACVC,MAAK;KAEVH,IAAII,UAAU;MACVjB,MAAMzD,WAAW2E;MACjBC,cAAc,CAAC5E,WAAW6E,QAAQ7E,WAAW8E,MAAO;MACpD,MAAMX,MAAMxD,WAAqB;OAC7B,MAAMD,sBAAsBC,WAAWC,SAAAA;MAC3C;KACJ,CAAA;KAEA,MAAM0D,IAAIH,MAAK;IACnB;IAEA9E,QAAQ0F,KAAK,CAAA;GACjB,SAAStC,GAAG;IAERkB,QAAQjB,MAAMD,CAAAA;IAEdpD,QAAQ0F,KAAK,CAAA;GACjB;EACJ;CACJ,CAAA;AACJ"}

package/dist/cli/commands/shutdown.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Terminate a long-running application on SIGINT / SIGTERM.
+ *
+ * The first signal tears the application down and exits with its outcome, a
+ * second one exits immediately, and a teardown outlasting the timeout is
+ * forced. Every command that keeps a process alive shares this, so a worker
+ * answers a container stop exactly like the server does.
+ *
+ * Typed structurally rather than against orkos' `IApplication`: a console
+ * role owns listeners rather than a module graph, and teardown is the whole
+ * of what this needs.
+ */
+export declare function registerShutdownHandlers(app: {
+    teardown(): Promise<unknown>;
+}): void;
+//# sourceMappingURL=shutdown.d.ts.map

package/dist/cli/commands/shutdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/shutdown.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE;IAAE,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,GAAI,IAAI,CAyBrF"}

package/dist/cli/commands/shutdown.mjs

@@ -0,0 +1,41 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import process from "node:process";
+//#region src/cli/commands/shutdown.ts
+const FORCE_EXIT_TIMEOUT_MS = 1e4;
+/**
+* Terminate a long-running application on SIGINT / SIGTERM.
+*
+* The first signal tears the application down and exits with its outcome, a
+* second one exits immediately, and a teardown outlasting the timeout is
+* forced. Every command that keeps a process alive shares this, so a worker
+* answers a container stop exactly like the server does.
+*
+* Typed structurally rather than against orkos' `IApplication`: a console
+* role owns listeners rather than a module graph, and teardown is the whole
+* of what this needs.
+*/ function registerShutdownHandlers(app) {
+	let shuttingDown = false;
+	const shutdown = async (signal) => {
+		if (shuttingDown) process.exit(1);
+		shuttingDown = true;
+		setTimeout(() => {
+			process.stderr.write(`\n${signal} teardown timed out after ${FORCE_EXIT_TIMEOUT_MS}ms — forcing exit.\n`);
+			process.exit(1);
+		}, FORCE_EXIT_TIMEOUT_MS).unref();
+		try {
+			await app.teardown();
+			process.exit(0);
+		} catch (err) {
+			process.stderr.write(`Error during ${signal} teardown: ${err.stack ?? String(err)}\n`);
+			process.exit(1);
+		}
+	};
+	process.on("SIGINT", shutdown);
+	process.on("SIGTERM", shutdown);
+}
+//#endregion
+export { registerShutdownHandlers };
+
+//# sourceMappingURL=shutdown.mjs.map

package/dist/cli/commands/shutdown.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown.mjs","names":["process","FORCE_EXIT_TIMEOUT_MS","registerShutdownHandlers","app","shuttingDown","shutdown","signal","exit","force","setTimeout","stderr","write","unref","teardown","err","stack","String","on"],"sources":["../../../src/cli/commands/shutdown.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport process from 'node:process';\n\nconst FORCE_EXIT_TIMEOUT_MS = 10_000;\n\n/**\n * Terminate a long-running application on SIGINT / SIGTERM.\n *\n * The first signal tears the application down and exits with its outcome, a\n * second one exits immediately, and a teardown outlasting the timeout is\n * forced. Every command that keeps a process alive shares this, so a worker\n * answers a container stop exactly like the server does.\n *\n * Typed structurally rather than against orkos' `IApplication`: a console\n * role owns listeners rather than a module graph, and teardown is the whole\n * of what this needs.\n */\nexport function registerShutdownHandlers(app: { teardown(): Promise<unknown> }) : void {\n    let shuttingDown = false;\n    const shutdown = async (signal: NodeJS.Signals) => {\n        if (shuttingDown) {\n            process.exit(1);\n        }\n        shuttingDown = true;\n\n        const force = setTimeout(() => {\n            process.stderr.write(`\\n${signal} teardown timed out after ${FORCE_EXIT_TIMEOUT_MS}ms — forcing exit.\\n`);\n            process.exit(1);\n        }, FORCE_EXIT_TIMEOUT_MS);\n        force.unref();\n\n        try {\n            await app.teardown();\n            process.exit(0);\n        } catch (err) {\n            process.stderr.write(`Error during ${signal} teardown: ${(err as Error).stack ?? String(err)}\\n`);\n            process.exit(1);\n        }\n    };\n\n    process.on('SIGINT', shutdown);\n    process.on('SIGTERM', shutdown);\n}\n"],"mappings":";;;;;AASA,MAAMC,wBAAwB;;;;;;;;;;;;GAc9B,SAAgBC,yBAAyBC,KAAqC;CAC1E,IAAIC,eAAe;CACnB,MAAMC,WAAW,OAAOC,WAAAA;EACpB,IAAIF,cACAJ,QAAQO,KAAK,CAAA;EAEjBH,eAAe;EAMfI,iBAJyB;GACrBR,QAAQU,OAAOC,MAAM,KAAKL,OAAO,4BAA4BL,sBAAsB,qBAAqB;GACxGD,QAAQO,KAAK,CAAA;EACjB,GAAGN,qBACHO,CAAAA,CAAMI,MAAK;EAEX,IAAI;GACA,MAAMT,IAAIU,SAAQ;GAClBb,QAAQO,KAAK,CAAA;EACjB,SAASO,KAAK;GACVd,QAAQU,OAAOC,MAAM,gBAAgBL,OAAO,aAAa,IAAeS,SAASC,OAAOF,GAAAA,EAAK,GAAG;GAChGd,QAAQO,KAAK,CAAA;EACjB;CACJ;CAEAP,QAAQiB,GAAG,UAAUZ,QAAAA;CACrBL,QAAQiB,GAAG,WAAWZ,QAAAA;AAC1B"}

package/dist/cli/commands/start.d.ts

@@ -1,3 +1,4 @@
-import type { ConfigReadFsOptions } from '../../app/index.ts';
-export declare function defineCLIStartCommand(configFs?: ConfigReadFsOptions): import("citty").CommandDef<import("citty").ArgsDef>;
+import type { Config } from '../../app/index.ts';
+import type { ConfigReadFsOptions } from '@authup/server-config';
+export declare function defineCLIStartCommand(configFs?: ConfigReadFsOptions<Config>): import("citty").CommandDef<import("citty").ArgsDef>;
 //# sourceMappingURL=start.d.ts.map