@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/core/oauth2/openid/claims.mjs

@@ -25,7 +25,7 @@ var OAuth2OpenIDClaimsBuilder = class {
 			return value;
 		}],
 		email: "email",
-		email_verified: "active"
+		email_verified: "emailVerified"
 	};
 	/**
 	* Build OpenID Claims form Oauth2 Identity.
@@ -41,17 +41,31 @@ var OAuth2OpenIDClaimsBuilder = class {
 	fromUser(input) {
 		return this.extract(this.userMap, input);
 	}
-	extract(attributeMap, attributes) {
+	/**
+	* A claim is emitted only for a value that exists AND is not nullish.
+	*
+	* The map reads entity columns, several of which are nullable, and OIDC
+	* models an unavailable claim as one that is not returned rather than one
+	* returned as `null` — so a user without a display name must omit
+	* `nickname`, not answer `nickname: null` (#3518). Emitting the null also
+	* put a JSON `null` claim value into every id_token, which no relying
+	* party expects.
+	*/ extract(attributeMap, attributes) {
 		const result = {};
 		const keys = Object.keys(attributeMap);
 		for (const key_ of keys) {
 			const attribute = attributeMap[key_];
+			let value;
 			if (typeof attribute === "string") {
-				if (hasOwnProperty(attributes, attribute)) result[key_] = attributes[attribute];
+				if (!hasOwnProperty(attributes, attribute)) continue;
+				value = attributes[attribute];
 			} else {
 				const [key, transformer] = attribute;
-				if (hasOwnProperty(attributes, key)) result[key_] = transformer(attributes[key]);
+				if (!hasOwnProperty(attributes, key)) continue;
+				value = transformer(attributes[key]);
 			}
+			if (typeof value === "undefined" || value === null) continue;
+			result[key_] = value;
 		}
 		return result;
 	}

package/dist/core/oauth2/openid/claims.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\ntype AttributeMap<T extends Record<string, any>> = Record<\n    keyof OpenIDTokenPayload,\nkeyof T | AttributeMapTuple<T>\n>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'lastName',\n        given_name: 'firstName',\n        nickname: 'displayName',\n        preferred_username: 'displayName',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'active',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap);\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n            if (typeof attribute === 'string') {\n                if (hasOwnProperty(attributes, attribute)) {\n                    result[key_] = attributes[attribute];\n                }\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (hasOwnProperty(attributes, key)) {\n                    result[key_] = transformer(attributes[key]);\n                }\n            }\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AA0BA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;CACL;CAEUK,UAA+B;EACrCT,MAAM;EACNU,aAAa;EACbC,YAAY;EACZV,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;EAEDQ,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASnB,cAAcoB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,OAAO,KAAKC,SAASL,SAASI,IAAI;CACtC;CAEAD,WAAWG,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAKvB,WAAWsB,KAAAA;CACxC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKb,SAASY,KAAAA;CACtC;CAEUC,QACNC,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAC/B,IAAI,OAAOC,cAAc,UACjBjC;QAAAA,eAAe4B,YAAYK,SAAAA,GAC3BJ,OAAOG,QAAQJ,WAAWK;GAAAA,OAE3B;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAIjC,eAAe4B,YAAYM,GAAAA,GAC3BL,OAAOG,QAAQG,YAAYP,WAAWM,IAAI;GAElD;EACJ;EAEA,OAAOL;CACX;AACJ"}
+{"version":3,"file":"claims.mjs","names":["hasOwnProperty","OAuth2SubKind","OAuth2OpenIDClaimsBuilder","clientMap","name","nickname","preferred_username","updated_at","value","Math","floor","Date","getTime","userMap","family_name","given_name","email","email_verified","fromIdentity","identity","type","CLIENT","fromClient","data","fromUser","input","extract","attributeMap","attributes","result","keys","Object","key_","attribute","key","transformer"],"sources":["../../../../src/core/oauth2/openid/claims.ts"],"sourcesContent":["/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type {\n    Client, \n    Identity, \n    User,\n} from '@authup/core-kit';\nimport { hasOwnProperty } from '@authup/kit';\nimport type { OpenIDClaims, OpenIDTokenPayload } from '@authup/specs';\nimport { OAuth2SubKind } from '@authup/specs';\nimport type { ObjectLiteral } from 'validup';\n\ntype AttributeMapTuple<T> = {\n    [K in keyof T]: [K, (value: unknown) => any]\n}[keyof T];\n\n/**\n * Keyed on `OpenIDClaims`, never on `OpenIDTokenPayload`: the latter inherits\n * `JWTClaims`' `[key: string]: any`, so `keyof` collapses to `string | number`\n * and the map accepts any claim name at all — a typo compiles and the claim is\n * simply never emitted, which is the failure mode #3518 is about. `OpenIDClaims`\n * carries no index signature, so a name that is not a claim fails the build.\n * `Partial`, because a map declares only the claims its entity can supply.\n */\ntype AttributeMap<T extends Record<string, any>> = Partial<Record<\n    keyof OpenIDClaims,\nkeyof T | AttributeMapTuple<T>\n>>;\n\nexport class OAuth2OpenIDClaimsBuilder {\n    protected clientMap : AttributeMap<Client> = {\n        name: 'name',\n        nickname: 'name',\n        preferred_username: 'name',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n    };\n\n    protected userMap : AttributeMap<User> = {\n        name: 'name',\n        family_name: 'lastName',\n        given_name: 'firstName',\n        nickname: 'displayName',\n        preferred_username: 'displayName',\n        updated_at: [\n            'updatedAt',\n            (value: unknown) => {\n                if (typeof value === 'string') {\n                    return Math.floor(new Date(value).getTime() / 1000);\n                }\n\n                return value;\n            },\n        ],\n\n        email: 'email',\n        email_verified: 'emailVerified',\n    };\n\n    /**\n     * Build OpenID Claims form Oauth2 Identity.\n     *\n     * @param identity\n     */\n    fromIdentity(identity: Identity) : OpenIDTokenPayload {\n        if (identity.type === OAuth2SubKind.CLIENT) {\n            return this.fromClient(identity.data);\n        }\n\n        return this.fromUser(identity.data);\n    }\n\n    fromClient(input: Client) : OpenIDTokenPayload {\n        return this.extract(this.clientMap, input);\n    }\n\n    fromUser(input: User) : OpenIDTokenPayload {\n        return this.extract(this.userMap, input);\n    }\n\n    /**\n     * A claim is emitted only for a value that exists AND is not nullish.\n     *\n     * The map reads entity columns, several of which are nullable, and OIDC\n     * models an unavailable claim as one that is not returned rather than one\n     * returned as `null` — so a user without a display name must omit\n     * `nickname`, not answer `nickname: null` (#3518). Emitting the null also\n     * put a JSON `null` claim value into every id_token, which no relying\n     * party expects.\n     */\n    protected extract<T extends ObjectLiteral = ObjectLiteral>(\n        attributeMap: AttributeMap<T>,\n        attributes: T,\n    ) : OpenIDTokenPayload {\n        const result = {} as OpenIDTokenPayload;\n\n        const keys = Object.keys(attributeMap) as (keyof OpenIDClaims)[];\n        for (const key_ of keys) {\n            const attribute = attributeMap[key_];\n\n            let value : unknown;\n            if (typeof attribute === 'string') {\n                if (!hasOwnProperty(attributes, attribute)) {\n                    continue;\n                }\n\n                value = attributes[attribute];\n            } else {\n                const [key, transformer] = attribute as AttributeMapTuple<T>;\n\n                if (!hasOwnProperty(attributes, key)) {\n                    continue;\n                }\n\n                value = transformer(attributes[key]);\n            }\n\n            if (\n                typeof value === 'undefined' ||\n                value === null\n            ) {\n                continue;\n            }\n\n            // Cast on the VALUE side only: which claim is written is checked by\n            // `AttributeMap`'s key type, while the value comes out of an entity\n            // column through an untyped transformer and never had a type here.\n            (result as Record<string, unknown>)[key_] = value;\n        }\n\n        return result;\n    }\n}\n"],"mappings":";;;;;;AAkCA,IAAaE,4BAAb,MAAaA;CACCC,YAAmC;EACzCC,MAAM;EACNC,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;CACL;CAEUK,UAA+B;EACrCT,MAAM;EACNU,aAAa;EACbC,YAAY;EACZV,UAAU;EACVC,oBAAoB;EACpBC,YAAY,CACR,cACCC,UAAAA;GACG,IAAI,OAAOA,UAAU,UACjB,OAAOC,KAAKC,MAAM,IAAIC,KAAKH,KAAAA,CAAAA,CAAOI,QAAO,IAAK,GAAA;GAGlD,OAAOJ;EACX,CACH;EAEDQ,OAAO;EACPC,gBAAgB;CACpB;;;;;IAOAC,aAAaC,UAAyC;EAClD,IAAIA,SAASC,SAASnB,cAAcoB,QAChC,OAAO,KAAKC,WAAWH,SAASI,IAAI;EAGxC,OAAO,KAAKC,SAASL,SAASI,IAAI;CACtC;CAEAD,WAAWG,OAAoC;EAC3C,OAAO,KAAKC,QAAQ,KAAKvB,WAAWsB,KAAAA;CACxC;CAEAD,SAASC,OAAkC;EACvC,OAAO,KAAKC,QAAQ,KAAKb,SAASY,KAAAA;CACtC;;;;;;;;;;IAYA,QACIE,cACAC,YACmB;EACnB,MAAMC,SAAS,CAAC;EAEhB,MAAMC,OAAOC,OAAOD,KAAKH,YAAAA;EACzB,KAAK,MAAMK,QAAQF,MAAM;GACrB,MAAMG,YAAYN,aAAaK;GAE/B,IAAIxB;GACJ,IAAI,OAAOyB,cAAc,UAAU;IAC/B,IAAI,CAACjC,eAAe4B,YAAYK,SAAAA,GAC5B;IAGJzB,QAAQoB,WAAWK;GACvB,OAAO;IACH,MAAM,CAACC,KAAKC,eAAeF;IAE3B,IAAI,CAACjC,eAAe4B,YAAYM,GAAAA,GAC5B;IAGJ1B,QAAQ2B,YAAYP,WAAWM,IAAI;GACvC;GAEA,IACI,OAAO1B,UAAU,eACjBA,UAAU,MAEV;GAMHqB,OAAmCG,QAAQxB;EAChD;EAEA,OAAOqB;CACX;AACJ"}

package/dist/core/oauth2/session-credential/constants.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The cookie carrying the opaque session credential: the `secret` half of an
+ * `auth_sessions` row, never its id (the id is published as `sid` in every
+ * id_token and `/sessions` row, so it is an identifier and not a credential).
+ *
+ * `HttpOnly`, `Secure` under an https publicUrl, and `SameSite=Strict`: it is
+ * an ambient credential for the whole API, so it must never ride a cross-site
+ * request. See plan 088 for the full gate (`Strict` + `Origin` + a mandatory
+ * `Sec-Fetch-Site: same-origin`).
+ */
+export declare const SESSION_COOKIE = "authup_session";
+/**
+ * Length of the opaque session credential, in nanoid characters. 48 chars of
+ * the default 36-symbol alphabet is ~248 bits. The credential is presented on
+ * every request and never rotated within a session, so it is sized well past
+ * the point where guessing is the weakest link.
+ */
+export declare const SESSION_SECRET_LENGTH = 48;
+/**
+ * How often a cookie-authenticated request slides the session's expiry.
+ *
+ * A bearer-mode session is kept alive by the refresh grant, which cookie mode
+ * removes: `ping()` moves only `seenAt`, so an active console user would be
+ * signed out mid-task once the session reached its ~3-day lifetime. The cookie
+ * branch therefore calls `refresh()` instead, throttled to one write per
+ * window so a page load's burst of API calls does not rewrite the row a dozen
+ * times. It costs nothing extra: `ping()` was already saving the row.
+ */
+export declare const SESSION_REFRESH_THROTTLE: number;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/session-credential/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-credential/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,QAAY,CAAC"}

package/dist/core/oauth2/session-credential/constants.mjs

@@ -0,0 +1,34 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/session-credential/constants.ts
+/**
+* The cookie carrying the opaque session credential: the `secret` half of an
+* `auth_sessions` row, never its id (the id is published as `sid` in every
+* id_token and `/sessions` row, so it is an identifier and not a credential).
+*
+* `HttpOnly`, `Secure` under an https publicUrl, and `SameSite=Strict`: it is
+* an ambient credential for the whole API, so it must never ride a cross-site
+* request. See plan 088 for the full gate (`Strict` + `Origin` + a mandatory
+* `Sec-Fetch-Site: same-origin`).
+*/ const SESSION_COOKIE = "authup_session";
+/**
+* Length of the opaque session credential, in nanoid characters. 48 chars of
+* the default 36-symbol alphabet is ~248 bits. The credential is presented on
+* every request and never rotated within a session, so it is sized well past
+* the point where guessing is the weakest link.
+*/ const SESSION_SECRET_LENGTH = 48;
+/**
+* How often a cookie-authenticated request slides the session's expiry.
+*
+* A bearer-mode session is kept alive by the refresh grant, which cookie mode
+* removes: `ping()` moves only `seenAt`, so an active console user would be
+* signed out mid-task once the session reached its ~3-day lifetime. The cookie
+* branch therefore calls `refresh()` instead, throttled to one write per
+* window so a page load's burst of API calls does not rewrite the row a dozen
+* times. It costs nothing extra: `ping()` was already saving the row.
+*/ const SESSION_REFRESH_THROTTLE = 6e4;
+//#endregion
+export { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/session-credential/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["SESSION_COOKIE","SESSION_SECRET_LENGTH","SESSION_REFRESH_THROTTLE"],"sources":["../../../../src/core/oauth2/session-credential/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The cookie carrying the opaque session credential: the `secret` half of an\n * `auth_sessions` row, never its id (the id is published as `sid` in every\n * id_token and `/sessions` row, so it is an identifier and not a credential).\n *\n * `HttpOnly`, `Secure` under an https publicUrl, and `SameSite=Strict`: it is\n * an ambient credential for the whole API, so it must never ride a cross-site\n * request. See plan 088 for the full gate (`Strict` + `Origin` + a mandatory\n * `Sec-Fetch-Site: same-origin`).\n */\nexport const SESSION_COOKIE = 'authup_session';\n\n/**\n * Length of the opaque session credential, in nanoid characters. 48 chars of\n * the default 36-symbol alphabet is ~248 bits. The credential is presented on\n * every request and never rotated within a session, so it is sized well past\n * the point where guessing is the weakest link.\n */\nexport const SESSION_SECRET_LENGTH = 48;\n\n/**\n * How often a cookie-authenticated request slides the session's expiry.\n *\n * A bearer-mode session is kept alive by the refresh grant, which cookie mode\n * removes: `ping()` moves only `seenAt`, so an active console user would be\n * signed out mid-task once the session reached its ~3-day lifetime. The cookie\n * branch therefore calls `refresh()` instead, throttled to one write per\n * window so a page load's burst of API calls does not rewrite the row a dozen\n * times. It costs nothing extra: `ping()` was already saving the row.\n */\nexport const SESSION_REFRESH_THROTTLE = 1000 * 60;\n"],"mappings":";;;;;;;;;;;;;GAiBA,MAAaA,iBAAiB;;;;;;GAQ9B,MAAaC,wBAAwB;;;;;;;;;;GAYrC,MAAaC,2BAA2B"}

package/dist/core/oauth2/session-credential/index.d.ts

@@ -0,0 +1,3 @@
+export * from './constants.ts';
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/session-credential/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-credential/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/core/oauth2/session-credential/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH } from "./constants.mjs";
+import { createSessionSecret, hashSessionSecret } from "./module.mjs";
+export { SESSION_COOKIE, SESSION_REFRESH_THROTTLE, SESSION_SECRET_LENGTH, createSessionSecret, hashSessionSecret };

package/dist/core/oauth2/session-credential/module.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Mint the opaque credential a console browser presents (plan 088). It is
+ * written to `auth_sessions.secret` (a `select: false` column resolved only by
+ * `ISessionRepository.findOneBySecret`) and handed to the browser in the
+ * console session cookie.
+ */
+export declare function createSessionSecret(): string;
+/**
+ * The value actually stored in `auth_sessions.secret`.
+ *
+ * `select: false` limits what the ORM projects; it does nothing about what the
+ * database CONTAINS, so storing the credential verbatim would make any read of
+ * that table — a leaked backup, a read replica, a SQL injection that only
+ * SELECTs — a source of replayable `authup_session` cookies. The
+ * column holds a digest instead, and the cookie value never lands anywhere it
+ * can be read back.
+ *
+ * A plain SHA-256 rather than a keyed HMAC, deliberately. Keying defends a
+ * LOW-entropy input against offline guessing, which is why a password needs
+ * bcrypt; this input is 48 nanoid characters over a 36-symbol alphabet (~248
+ * bits), so there is no guessing attack for a key to frustrate. A keyed scheme
+ * would also have to be GLOBAL — the lookup resolves a session BY this value,
+ * so the realm is unknown at that point and a per-realm key is unavailable —
+ * and the only global key (`SECRETS_ENCRYPTION_KEY`) is optional, so keying
+ * would either be absent by default or need key management of its own.
+ *
+ * Deterministic, so the lookup stays a single indexed equality. Hex SHA-256 is
+ * exactly 64 characters, which is the column's width.
+ */
+export declare function hashSessionSecret(secret: string): string;
+//# sourceMappingURL=module.d.ts.map

package/dist/core/oauth2/session-credential/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-credential/module.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAK,MAAM,CAE7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,CAEzD"}

package/dist/core/oauth2/session-credential/module.mjs

@@ -0,0 +1,43 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "./constants.mjs";
+import { createNanoID } from "@authup/kit";
+import { createHash } from "node:crypto";
+//#region src/core/oauth2/session-credential/module.ts
+/**
+* Mint the opaque credential a console browser presents (plan 088). It is
+* written to `auth_sessions.secret` (a `select: false` column resolved only by
+* `ISessionRepository.findOneBySecret`) and handed to the browser in the
+* console session cookie.
+*/ function createSessionSecret() {
+	return createNanoID(48);
+}
+/**
+* The value actually stored in `auth_sessions.secret`.
+*
+* `select: false` limits what the ORM projects; it does nothing about what the
+* database CONTAINS, so storing the credential verbatim would make any read of
+* that table — a leaked backup, a read replica, a SQL injection that only
+* SELECTs — a source of replayable `authup_session` cookies. The
+* column holds a digest instead, and the cookie value never lands anywhere it
+* can be read back.
+*
+* A plain SHA-256 rather than a keyed HMAC, deliberately. Keying defends a
+* LOW-entropy input against offline guessing, which is why a password needs
+* bcrypt; this input is 48 nanoid characters over a 36-symbol alphabet (~248
+* bits), so there is no guessing attack for a key to frustrate. A keyed scheme
+* would also have to be GLOBAL — the lookup resolves a session BY this value,
+* so the realm is unknown at that point and a per-realm key is unavailable —
+* and the only global key (`SECRETS_ENCRYPTION_KEY`) is optional, so keying
+* would either be absent by default or need key management of its own.
+*
+* Deterministic, so the lookup stays a single indexed equality. Hex SHA-256 is
+* exactly 64 characters, which is the column's width.
+*/ function hashSessionSecret(secret) {
+	return createHash("sha256").update(secret).digest("hex");
+}
+//#endregion
+export { createSessionSecret, hashSessionSecret };
+
+//# sourceMappingURL=module.mjs.map

package/dist/core/oauth2/session-credential/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["createHash","createNanoID","SESSION_SECRET_LENGTH","createSessionSecret","hashSessionSecret","secret","update","digest"],"sources":["../../../../src/core/oauth2/session-credential/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createHash } from 'node:crypto';\nimport { createNanoID } from '@authup/kit';\nimport { SESSION_SECRET_LENGTH } from './constants.ts';\n\n/**\n * Mint the opaque credential a console browser presents (plan 088). It is\n * written to `auth_sessions.secret` (a `select: false` column resolved only by\n * `ISessionRepository.findOneBySecret`) and handed to the browser in the\n * console session cookie.\n */\nexport function createSessionSecret() : string {\n    return createNanoID(SESSION_SECRET_LENGTH);\n}\n\n/**\n * The value actually stored in `auth_sessions.secret`.\n *\n * `select: false` limits what the ORM projects; it does nothing about what the\n * database CONTAINS, so storing the credential verbatim would make any read of\n * that table — a leaked backup, a read replica, a SQL injection that only\n * SELECTs — a source of replayable `authup_session` cookies. The\n * column holds a digest instead, and the cookie value never lands anywhere it\n * can be read back.\n *\n * A plain SHA-256 rather than a keyed HMAC, deliberately. Keying defends a\n * LOW-entropy input against offline guessing, which is why a password needs\n * bcrypt; this input is 48 nanoid characters over a 36-symbol alphabet (~248\n * bits), so there is no guessing attack for a key to frustrate. A keyed scheme\n * would also have to be GLOBAL — the lookup resolves a session BY this value,\n * so the realm is unknown at that point and a per-realm key is unavailable —\n * and the only global key (`SECRETS_ENCRYPTION_KEY`) is optional, so keying\n * would either be absent by default or need key management of its own.\n *\n * Deterministic, so the lookup stays a single indexed equality. Hex SHA-256 is\n * exactly 64 characters, which is the column's width.\n */\nexport function hashSessionSecret(secret: string) : string {\n    return createHash('sha256').update(secret).digest('hex');\n}\n"],"mappings":";;;;;;;;;;;;GAiBA,SAAgBG,sBAAAA;CACZ,OAAOF,aAAAA,EAAaC;AACxB;;;;;;;;;;;;;;;;;;;;;;GAwBA,SAAgBE,kBAAkBC,QAAc;CAC5C,OAAOL,WAAW,QAAA,CAAA,CAAUM,OAAOD,MAAAA,CAAAA,CAAQE,OAAO,KAAA;AACtD"}

package/dist/core/oauth2/session-token/constants.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Rows removed per statement by the session-token expiry sweep. This is the
+ * highest-volume table in the schema (one row per issued access token, so one
+ * per ~15 minutes per active session), and the sweep runs every minute on
+ * every replica. A single unbounded DELETE would be one long transaction,
+ * issued concurrently by every replica. Batching keeps each statement
+ * bounded; the sweep still drains by looping.
+ */
+export declare const SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE = 1000;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/oauth2/session-token/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,OAAO,CAAC"}

package/dist/core/oauth2/session-token/constants.mjs

@@ -0,0 +1,16 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/oauth2/session-token/constants.ts
+/**
+* Rows removed per statement by the session-token expiry sweep. This is the
+* highest-volume table in the schema (one row per issued access token, so one
+* per ~15 minutes per active session), and the sweep runs every minute on
+* every replica. A single unbounded DELETE would be one long transaction,
+* issued concurrently by every replica. Batching keeps each statement
+* bounded; the sweep still drains by looping.
+*/ const SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE = 1e3;
+//#endregion
+export { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/oauth2/session-token/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE"],"sources":["../../../../src/core/oauth2/session-token/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Rows removed per statement by the session-token expiry sweep. This is the\n * highest-volume table in the schema (one row per issued access token, so one\n * per ~15 minutes per active session), and the sweep runs every minute on\n * every replica. A single unbounded DELETE would be one long transaction,\n * issued concurrently by every replica. Batching keeps each statement\n * bounded; the sweep still drains by looping.\n */\nexport const SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE = 1000;\n"],"mappings":";;;;;;;;;;;GAeA,MAAaA,wCAAwC"}

package/dist/core/oauth2/session-token/index.d.ts

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './error.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/oauth2/session-token/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/core/oauth2/session-token/index.mjs

@@ -1,5 +1,6 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE } from "./constants.mjs";
 import { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError } from "./error.mjs";
-export { SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };
+export { SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, SESSION_TOKEN_RELATION_MISSING_ERROR_INSTANCE, SessionTokenRelationMissingError, isSessionTokenRelationMissingError };

package/dist/core/oauth2/session-token/types.d.ts

@@ -101,10 +101,21 @@ export interface ISessionTokenRepository {
      */
     revokeBySessionId(sessionId: string, at: string): Promise<SessionTokenRef[]>;
     /**
-     * Delete every token row whose `expiresAt` is before the given timestamp.
+     * Expiry sweep: delete every token row whose `expiresAt` is before the
+     * given timestamp. Returns the number of removed rows. Removal is batched
+     * (see SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE).
      *
      * @param before iso timestamp
+     * @param options
      */
-    deleteExpired(before: string): Promise<number>;
+    deleteExpired(before: string, options?: SessionTokenDeleteExpiredOptions): Promise<number>;
 }
+export type SessionTokenDeleteExpiredOptions = {
+    /**
+     * Rows removed per statement. Defaults to
+     * SESSION_TOKEN_EXPIRY_SWEEP_BATCH_SIZE, which anything that is not a
+     * positive safe integer also falls back to.
+     */
+    batchSize?: number;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/core/oauth2/session-token/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAE/E;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEvD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/oauth2/session-token/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC,CAAC;IAE/E;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEvD;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE9D;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAEtD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE7E;;;;;;;OAOG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gCAAgC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9F;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC3C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/core/provisioning/merge/module.mjs

@@ -45,8 +45,10 @@ function mergeProvisioningEntities(target, source, options = {}) {
 		...source.attributes
 	};
 	const inheritStrategy = options.inheritStrategy ?? true;
-	if (target.strategy && !source.strategy) if (inheritStrategy) output.strategy = target.strategy;
-	else delete output.strategy;
+	if (target.strategy && !source.strategy) {
+		if (inheritStrategy) output.strategy = target.strategy;
+		else delete output.strategy;
+	}
 	if (target.relations && source.relations) output.relations = mergeProvisioningRecord(target.relations, source.relations, options);
 	else if (target.relations && !source.relations) output.relations = target.relations;
 	if (target.extraAttributes && source.extraAttributes) output.extraAttributes = {
@@ -60,7 +62,7 @@ function mergeProvisioningEntities(target, source, options = {}) {
 }
 function mergeProvisioningRecord(target, source, options = {}) {
 	const output = { ...target };
-	for (const key of Object.keys(source)) output[key] = key in target ? mergeProvisioningValue(target[key], source[key], options) : source[key];
+	for (const [key, value] of Object.entries(source)) output[key] = key in target ? mergeProvisioningValue(target[key], value, options) : value;
 	return output;
 }
 function mergeProvisioningValue(target, source, options = {}) {

package/dist/core/provisioning/merge/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["isObject","buildProvisioningEntityKey","attributes","name","undefined","realmId","clientId","mergeProvisioningEntities","target","source","options","result","forEach","item","key","push","idx","findIndex","r","mergeProvisioningEntity","output","inheritStrategy","strategy","relations","mergeProvisioningRecord","extraAttributes","children","Object","keys","mergeProvisioningValue","Array","isArray","isProvisioningEntityArray","Set","value","some"],"sources":["../../../../src/core/provisioning/merge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';\n\nexport function buildProvisioningEntityKey(\n    attributes: MergeableProvisioningEntity['attributes'],\n): string | undefined {\n    if (!attributes.name) return undefined;\n    return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n}\n\nexport function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(\n    target: T[] | undefined,\n    source: T[] | undefined,\n    options: MergeProvisioningOptions = {},\n): T[] | undefined {\n    if (!source) return target;\n    if (!target) return [...source];\n\n    const result = [...target];\n    source.forEach((item) => {\n        const key = buildProvisioningEntityKey(item.attributes);\n        if (!key) {\n            result.push(item);\n            return;\n        }\n\n        const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);\n        if (idx !== -1) {\n            result[idx] = mergeProvisioningEntity(result[idx], item, options) as T;\n        } else {\n            result.push(item);\n        }\n    });\n    return result;\n}\n\n/**\n * Deep-merge two entries sharing a composite key. The later (source) side\n * wins per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n *\n * Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\nexport function mergeProvisioningEntity(\n    target: MergeableProvisioningEntity,\n    source: MergeableProvisioningEntity,\n    options: MergeProvisioningOptions = {},\n): MergeableProvisioningEntity {\n    const output = { ...target, ...source };\n\n    output.attributes = { ...target.attributes, ...source.attributes };\n\n    const inheritStrategy = options.inheritStrategy ?? true;\n    if (target.strategy && !source.strategy) {\n        if (inheritStrategy) {\n            output.strategy = target.strategy;\n        } else {\n            delete output.strategy;\n        }\n    }\n\n    if (target.relations && source.relations) {\n        output.relations = mergeProvisioningRecord(target.relations, source.relations, options);\n    } else if (target.relations && !source.relations) {\n        output.relations = target.relations;\n    }\n\n    if (target.extraAttributes && source.extraAttributes) {\n        output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n    } else if (target.extraAttributes && !source.extraAttributes) {\n        output.extraAttributes = target.extraAttributes;\n    }\n\n    if (target.children && source.children) {\n        output.children = mergeProvisioningEntities(target.children, source.children, options);\n    } else if (target.children && !source.children) {\n        output.children = target.children;\n    }\n\n    return output;\n}\n\nfunction mergeProvisioningRecord(\n    target: Record<string, unknown>,\n    source: Record<string, unknown>,\n    options: MergeProvisioningOptions = {},\n): Record<string, unknown> {\n    const output : Record<string, unknown> = { ...target };\n    for (const key of Object.keys(source)) {\n        output[key] = key in target ?\n            mergeProvisioningValue(target[key], source[key], options) :\n            source[key];\n    }\n    return output;\n}\n\nfunction mergeProvisioningValue(\n    target: unknown,\n    source: unknown,\n    options: MergeProvisioningOptions = {},\n): unknown {\n    if (typeof target === 'undefined') return source;\n    if (typeof source === 'undefined') return target;\n\n    if (Array.isArray(target) && Array.isArray(source)) {\n        if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) {\n            return mergeProvisioningEntities(\n                target as MergeableProvisioningEntity[],\n                source as MergeableProvisioningEntity[],\n                options,\n            );\n        }\n        return [...new Set([...target, ...source])];\n    }\n\n    if (isObject(target) && isObject(source)) {\n        return mergeProvisioningRecord(target, source, options);\n    }\n\n    return source;\n}\n\nfunction isProvisioningEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n    return value.some(\n        (item) => isObject(item) && 'attributes' in item,\n    );\n}\n"],"mappings":";;;;;AAUA,SAAgBC,2BACZC,YAAqD;CAErD,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;CAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;AACpF;AAEA,SAAgBC,0BACZC,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,CAACD,QAAQ,OAAOD;CACpB,IAAI,CAACA,QAAQ,OAAO,CAAIC,GAAAA,MAAO;CAE/B,MAAME,SAAS,CAAIH,GAAAA,MAAO;CAC1BC,OAAOG,SAASC,SAAAA;EACZ,MAAMC,MAAMb,2BAA2BY,KAAKX,UAAU;EACtD,IAAI,CAACY,KAAK;GACNH,OAAOI,KAAKF,IAAAA;GACZ;EACJ;EAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAMjB,2BAA2BiB,EAAEhB,UAAU,MAAMY,GAAAA;EACjF,IAAIE,QAAQ,IACRL,OAAOK,OAAOG,wBAAwBR,OAAOK,MAAMH,MAAMH,OAAAA;OAEzDC,OAAOI,KAAKF,IAAAA;CAEpB,CAAA;CACA,OAAOF;AACX;;;;;;;;;;;;;GAeA,SAAgBQ,wBACZX,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAS;EAAE,GAAGZ;EAAQ,GAAGC;CAAO;CAEtCW,OAAOlB,aAAa;EAAE,GAAGM,OAAON;EAAY,GAAGO,OAAOP;CAAW;CAEjE,MAAMmB,kBAAkBX,QAAQW,mBAAmB;CACnD,IAAIb,OAAOc,YAAY,CAACb,OAAOa,UAC3B,IAAID,iBACAD,OAAOE,WAAWd,OAAOc;MAEzB,OAAOF,OAAOE;CAItB,IAAId,OAAOe,aAAad,OAAOc,WAC3BH,OAAOG,YAAYC,wBAAwBhB,OAAOe,WAAWd,OAAOc,WAAWb,OAAAA;MAC5E,IAAIF,OAAOe,aAAa,CAACd,OAAOc,WACnCH,OAAOG,YAAYf,OAAOe;CAG9B,IAAIf,OAAOiB,mBAAmBhB,OAAOgB,iBACjCL,OAAOK,kBAAkB;EAAE,GAAGjB,OAAOiB;EAAiB,GAAGhB,OAAOgB;CAAgB;MAC7E,IAAIjB,OAAOiB,mBAAmB,CAAChB,OAAOgB,iBACzCL,OAAOK,kBAAkBjB,OAAOiB;CAGpC,IAAIjB,OAAOkB,YAAYjB,OAAOiB,UAC1BN,OAAOM,WAAWnB,0BAA0BC,OAAOkB,UAAUjB,OAAOiB,UAAUhB,OAAAA;MAC3E,IAAIF,OAAOkB,YAAY,CAACjB,OAAOiB,UAClCN,OAAOM,WAAWlB,OAAOkB;CAG7B,OAAON;AACX;AAEA,SAASI,wBACLhB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAmC,EAAE,GAAGZ,OAAO;CACrD,KAAK,MAAMM,OAAOa,OAAOC,KAAKnB,MAAAA,GAC1BW,OAAON,OAAOA,OAAON,SACjBqB,uBAAuBrB,OAAOM,MAAML,OAAOK,MAAMJ,OAAAA,IACjDD,OAAOK;CAEf,OAAOM;AACX;AAEA,SAASS,uBACLrB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,OAAOF,WAAW,aAAa,OAAOC;CAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOD;CAE1C,IAAIsB,MAAMC,QAAQvB,MAAAA,KAAWsB,MAAMC,QAAQtB,MAAAA,GAAS;EAChD,IAAIuB,0BAA0BxB,MAAAA,KAAWwB,0BAA0BvB,MAAAA,GAC/D,OAAOF,0BACHC,QACAC,QACAC,OAAAA;EAGR,OAAO,CAAI,mBAAA,IAAIuB,IAAI,CAAIzB,GAAAA,QAAWC,GAAAA,MAAO,CAAA,CAAE;CAC/C;CAEA,IAAIT,SAASQ,MAAAA,KAAWR,SAASS,MAAAA,GAC7B,OAAOe,wBAAwBhB,QAAQC,QAAQC,OAAAA;CAGnD,OAAOD;AACX;AAEA,SAASuB,0BAA0BE,OAAgB;CAC/C,OAAOA,MAAMC,MACRtB,SAASb,SAASa,IAAAA,KAAS,gBAAgBA,IAAAA;AAEpD"}
+{"version":3,"file":"module.mjs","names":["isObject","buildProvisioningEntityKey","attributes","name","undefined","realmId","clientId","mergeProvisioningEntities","target","source","options","result","forEach","item","key","push","idx","findIndex","r","mergeProvisioningEntity","output","inheritStrategy","strategy","relations","mergeProvisioningRecord","extraAttributes","children","value","Object","entries","mergeProvisioningValue","Array","isArray","isProvisioningEntityArray","Set","some"],"sources":["../../../../src/core/provisioning/merge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport type { MergeProvisioningOptions, MergeableProvisioningEntity } from './types.ts';\n\nexport function buildProvisioningEntityKey(\n    attributes: MergeableProvisioningEntity['attributes'],\n): string | undefined {\n    if (!attributes.name) return undefined;\n    return `${attributes.name}:${attributes.realmId || ''}:${attributes.clientId || ''}`;\n}\n\nexport function mergeProvisioningEntities<T extends MergeableProvisioningEntity>(\n    target: T[] | undefined,\n    source: T[] | undefined,\n    options: MergeProvisioningOptions = {},\n): T[] | undefined {\n    if (!source) return target;\n    if (!target) return [...source];\n\n    const result = [...target];\n    source.forEach((item) => {\n        const key = buildProvisioningEntityKey(item.attributes);\n        if (!key) {\n            result.push(item);\n            return;\n        }\n\n        const idx = result.findIndex((r) => buildProvisioningEntityKey(r.attributes) === key);\n        if (idx !== -1) {\n            result[idx] = mergeProvisioningEntity(result[idx], item, options) as T;\n        } else {\n            result.push(item);\n        }\n    });\n    return result;\n}\n\n/**\n * Deep-merge two entries sharing a composite key. The later (source) side\n * wins per attribute, but relations are UNIONED — a later source (e.g. a\n * mounted provisioning file) extending a built-in entry (the default\n * source's master realm) must not silently drop the built-in relations\n * (admin user, system client).\n *\n * Policy extraAttributes merge per key with the later source winning —\n * like attributes, NOT like relations: an EA value (a names denylist,\n * an ATTRIBUTES query tree) is policy configuration, and unioning would\n * make shrinking a list impossible and fabricate predicates neither\n * source authored.\n */\nexport function mergeProvisioningEntity(\n    target: MergeableProvisioningEntity,\n    source: MergeableProvisioningEntity,\n    options: MergeProvisioningOptions = {},\n): MergeableProvisioningEntity {\n    const output = { ...target, ...source };\n\n    output.attributes = { ...target.attributes, ...source.attributes };\n\n    const inheritStrategy = options.inheritStrategy ?? true;\n    if (target.strategy && !source.strategy) {\n        if (inheritStrategy) {\n            output.strategy = target.strategy;\n        } else {\n            delete output.strategy;\n        }\n    }\n\n    if (target.relations && source.relations) {\n        output.relations = mergeProvisioningRecord(target.relations, source.relations, options);\n    } else if (target.relations && !source.relations) {\n        output.relations = target.relations;\n    }\n\n    if (target.extraAttributes && source.extraAttributes) {\n        output.extraAttributes = { ...target.extraAttributes, ...source.extraAttributes };\n    } else if (target.extraAttributes && !source.extraAttributes) {\n        output.extraAttributes = target.extraAttributes;\n    }\n\n    if (target.children && source.children) {\n        output.children = mergeProvisioningEntities(target.children, source.children, options);\n    } else if (target.children && !source.children) {\n        output.children = target.children;\n    }\n\n    return output;\n}\n\nfunction mergeProvisioningRecord(\n    target: Record<string, unknown>,\n    source: Record<string, unknown>,\n    options: MergeProvisioningOptions = {},\n): Record<string, unknown> {\n    const output : Record<string, unknown> = { ...target };\n    for (const [key, value] of Object.entries(source)) {\n        output[key] = key in target ?\n            mergeProvisioningValue(target[key], value, options) :\n            value;\n    }\n    return output;\n}\n\nfunction mergeProvisioningValue(\n    target: unknown,\n    source: unknown,\n    options: MergeProvisioningOptions = {},\n): unknown {\n    if (typeof target === 'undefined') return source;\n    if (typeof source === 'undefined') return target;\n\n    if (Array.isArray(target) && Array.isArray(source)) {\n        if (isProvisioningEntityArray(target) || isProvisioningEntityArray(source)) {\n            return mergeProvisioningEntities(\n                target as MergeableProvisioningEntity[],\n                source as MergeableProvisioningEntity[],\n                options,\n            );\n        }\n        return [...new Set([...target, ...source])];\n    }\n\n    if (isObject(target) && isObject(source)) {\n        return mergeProvisioningRecord(target, source, options);\n    }\n\n    return source;\n}\n\nfunction isProvisioningEntityArray(value: unknown[]): value is MergeableProvisioningEntity[] {\n    return value.some(\n        (item) => isObject(item) && 'attributes' in item,\n    );\n}\n"],"mappings":";;;;;AAUA,SAAgBC,2BACZC,YAAqD;CAErD,IAAI,CAACA,WAAWC,MAAM,OAAOC,KAAAA;CAC7B,OAAO,GAAGF,WAAWC,KAAK,GAAGD,WAAWG,WAAW,GAAG,GAAGH,WAAWI,YAAY;AACpF;AAEA,SAAgBC,0BACZC,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,CAACD,QAAQ,OAAOD;CACpB,IAAI,CAACA,QAAQ,OAAO,CAAIC,GAAAA,MAAO;CAE/B,MAAME,SAAS,CAAIH,GAAAA,MAAO;CAC1BC,OAAOG,SAASC,SAAAA;EACZ,MAAMC,MAAMb,2BAA2BY,KAAKX,UAAU;EACtD,IAAI,CAACY,KAAK;GACNH,OAAOI,KAAKF,IAAAA;GACZ;EACJ;EAEA,MAAMG,MAAML,OAAOM,WAAWC,MAAMjB,2BAA2BiB,EAAEhB,UAAU,MAAMY,GAAAA;EACjF,IAAIE,QAAQ,IACRL,OAAOK,OAAOG,wBAAwBR,OAAOK,MAAMH,MAAMH,OAAAA;OAEzDC,OAAOI,KAAKF,IAAAA;CAEpB,CAAA;CACA,OAAOF;AACX;;;;;;;;;;;;;GAeA,SAAgBQ,wBACZX,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAS;EAAE,GAAGZ;EAAQ,GAAGC;CAAO;CAEtCW,OAAOlB,aAAa;EAAE,GAAGM,OAAON;EAAY,GAAGO,OAAOP;CAAW;CAEjE,MAAMmB,kBAAkBX,QAAQW,mBAAmB;CACnD,IAAIb,OAAOc,YAAY,CAACb,OAAOa,UAAU;EACrC,IAAID,iBACAD,OAAOE,WAAWd,OAAOc;OAEzB,OAAOF,OAAOE;CAEtB;CAEA,IAAId,OAAOe,aAAad,OAAOc,WAC3BH,OAAOG,YAAYC,wBAAwBhB,OAAOe,WAAWd,OAAOc,WAAWb,OAAAA;MAC5E,IAAIF,OAAOe,aAAa,CAACd,OAAOc,WACnCH,OAAOG,YAAYf,OAAOe;CAG9B,IAAIf,OAAOiB,mBAAmBhB,OAAOgB,iBACjCL,OAAOK,kBAAkB;EAAE,GAAGjB,OAAOiB;EAAiB,GAAGhB,OAAOgB;CAAgB;MAC7E,IAAIjB,OAAOiB,mBAAmB,CAAChB,OAAOgB,iBACzCL,OAAOK,kBAAkBjB,OAAOiB;CAGpC,IAAIjB,OAAOkB,YAAYjB,OAAOiB,UAC1BN,OAAOM,WAAWnB,0BAA0BC,OAAOkB,UAAUjB,OAAOiB,UAAUhB,OAAAA;MAC3E,IAAIF,OAAOkB,YAAY,CAACjB,OAAOiB,UAClCN,OAAOM,WAAWlB,OAAOkB;CAG7B,OAAON;AACX;AAEA,SAASI,wBACLhB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,MAAMU,SAAmC,EAAE,GAAGZ,OAAO;CACrD,KAAK,MAAM,CAACM,KAAKa,UAAUC,OAAOC,QAAQpB,MAAAA,GACtCW,OAAON,OAAOA,OAAON,SACjBsB,uBAAuBtB,OAAOM,MAAMa,OAAOjB,OAAAA,IAC3CiB;CAER,OAAOP;AACX;AAEA,SAASU,uBACLtB,QACAC,QACAC,UAAoC,CAAC,GAAC;CAEtC,IAAI,OAAOF,WAAW,aAAa,OAAOC;CAC1C,IAAI,OAAOA,WAAW,aAAa,OAAOD;CAE1C,IAAIuB,MAAMC,QAAQxB,MAAAA,KAAWuB,MAAMC,QAAQvB,MAAAA,GAAS;EAChD,IAAIwB,0BAA0BzB,MAAAA,KAAWyB,0BAA0BxB,MAAAA,GAC/D,OAAOF,0BACHC,QACAC,QACAC,OAAAA;EAGR,OAAO,CAAI,mBAAA,IAAIwB,IAAI,CAAI1B,GAAAA,QAAWC,GAAAA,MAAO,CAAA,CAAE;CAC/C;CAEA,IAAIT,SAASQ,MAAAA,KAAWR,SAASS,MAAAA,GAC7B,OAAOe,wBAAwBhB,QAAQC,QAAQC,OAAAA;CAGnD,OAAOD;AACX;AAEA,SAASwB,0BAA0BN,OAAgB;CAC/C,OAAOA,MAAMQ,MACRtB,SAASb,SAASa,IAAAA,KAAS,gBAAgBA,IAAAA;AAEpD"}

package/dist/core/query/module.mjs

@@ -98,7 +98,7 @@ for (const schema of schemas) schemaRegistry.add(schema);
 * anonymous — the HTTP adapter always builds one); a decode without
 * an actor is a system call and runs unrestricted.
 */ async function decodeQuery(input, options) {
-	const normalized = isObject(input) || typeof input === "string" ? input : {};
+	const normalized = typeof input === "string" || isObject(input) ? input : {};
 	return await queryCodec.decodeAsync(normalized, {
 		schema: options.schema,
 		parameters: options.parameters,

package/dist/core/query/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderAccountSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","sessionTokenSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition,\n    IQuery,\n    ObjectLiteral,\n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderAccountSchema } from '../entities/identity-provider-account/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { sessionTokenSchema } from '../entities/session-token/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\n/**\n * Every registered entity schema. Exported so the invariant guard can\n * enumerate them: `SchemaRegistry` keeps its map protected and exposes\n * no iterator (tada5hi/rapiq#904).\n */\nexport const schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderAccountSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    sessionTokenSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = isObject(input) || typeof input === 'string' ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. A client-sent\n * condition on the same field intersects with the scope instead of\n * replacing it, and compound client trees (`or(...)`) are preserved\n * as-is. Same guarantee class as a mandatory `andWhere` at the\n * repository — expressed once in the IR. Appended conditions do not\n * pass through `decodeQuery`, so the schema allow-lists do not\n * constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n *\n * Non-displaceability is structural since rapiq beta.19\n * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so\n * no later composition step can drop a conjunct and the appended scope\n * needs no marker to survive.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,MAAa8B,iBAAiB,IAAI5B,eAAAA;;;;;GAOlC,MAAa6B,UAA0B;CACnC3B;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAalC,eAAe8B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAanC,SAASiC,KAAAA,KAAU,OAAOA,UAAU,WAAWA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAI1C,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;;;;;GAuBA,SAAgB2C,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI7C,MAAM;EACb8C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}
+{"version":3,"file":"module.mjs","names":["createURLCodec","Query","SchemaRegistry","isObject","clientSchema","clientPermissionSchema","clientRoleSchema","clientScopeSchema","consentSchema","eventSchema","identityProviderSchema","identityProviderAccountSchema","identityProviderRoleMappingSchema","keySchema","permissionSchema","permissionPolicySchema","policySchema","realmSchema","roleSchema","roleAttributeSchema","rolePermissionSchema","scopeSchema","sessionSchema","sessionTokenSchema","trustAnchorSchema","userSchema","userAttributeSchema","userAuthenticatorSchema","userPermissionSchema","userRoleSchema","schemaRegistry","schemas","schema","add","queryCodec","decodeQuery","input","options","normalized","parsed","decodeAsync","parameters","context","actor","appendQueryConditions","query","conditions","fields","filters","and","relations","pagination","sorts"],"sources":["../../../src/core/query/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createURLCodec } from '@rapiq/codec-url';\nimport type {\n    ICondition,\n    IQuery,\n    ObjectLiteral,\n    Schema,\n} from '@rapiq/core';\nimport { Query, SchemaRegistry, isObject } from '@rapiq/core';\nimport { clientSchema } from '../entities/client/schema.ts';\nimport { clientPermissionSchema } from '../entities/client-permission/schema.ts';\nimport { clientRoleSchema } from '../entities/client-role/schema.ts';\nimport { clientScopeSchema } from '../entities/client-scope/schema.ts';\nimport { consentSchema } from '../entities/consent/schema.ts';\nimport { eventSchema } from '../entities/event/schema.ts';\nimport { identityProviderSchema } from '../entities/identity-provider/schema.ts';\nimport { identityProviderAccountSchema } from '../entities/identity-provider-account/schema.ts';\nimport { identityProviderRoleMappingSchema } from '../entities/identity-provider-role-mapping/schema.ts';\nimport { keySchema } from '../entities/key/schema.ts';\nimport { permissionSchema } from '../entities/permission/schema.ts';\nimport { permissionPolicySchema } from '../entities/permission-policy/schema.ts';\nimport { policySchema } from '../entities/policy/schema.ts';\nimport { realmSchema } from '../entities/realm/schema.ts';\nimport { roleSchema } from '../entities/role/schema.ts';\nimport { roleAttributeSchema } from '../entities/role-attribute/schema.ts';\nimport { rolePermissionSchema } from '../entities/role-permission/schema.ts';\nimport { scopeSchema } from '../entities/scope/schema.ts';\nimport { sessionSchema } from '../entities/session/schema.ts';\nimport { sessionTokenSchema } from '../entities/session-token/schema.ts';\nimport { trustAnchorSchema } from '../entities/trust-anchor/schema.ts';\nimport { userSchema } from '../entities/user/schema.ts';\nimport { userAttributeSchema } from '../entities/user-attribute/schema.ts';\nimport { userAuthenticatorSchema } from '../entities/user-authenticator/schema.ts';\nimport { userPermissionSchema } from '../entities/user-permission/schema.ts';\nimport { userRoleSchema } from '../entities/user-role/schema.ts';\nimport type { DecodeQueryOptions, QueryDecodeContext } from './types.ts';\n\n/**\n * Registry of every entity schema — the server-side allow-list layer.\n * Relation traversal (e.g. a `realm.name` filter) resolves through the\n * `schemaMapping` of the owning schema into the related schema's own\n * allow-lists.\n *\n * The registry deliberately lives in core (persistence-agnostic): the\n * schemas are security policy over the domain types, and services\n * consume them to decode wire queries into the rapiq IR. A repository\n * layer MAY extend the registry with additional, storage-derived\n * schemas (e.g. `@rapiq/adapter-typeorm`'s `defineSchemaRegistryWithDataSource`\n * with the `registry` option — already-registered schemas take\n * precedence), but the allow-lists themselves stay explicit and are\n * never auto-derived from entity metadata.\n */\nexport const schemaRegistry = new SchemaRegistry();\n\n/**\n * Every registered entity schema. Exported so the invariant guard can\n * enumerate them: `SchemaRegistry` keeps its map protected and exposes\n * no iterator (tada5hi/rapiq#904).\n */\nexport const schemas : Schema<any>[] = [\n    clientSchema,\n    clientPermissionSchema,\n    clientRoleSchema,\n    clientScopeSchema,\n    consentSchema,\n    eventSchema,\n    identityProviderSchema,\n    identityProviderAccountSchema,\n    identityProviderRoleMappingSchema,\n    keySchema,\n    permissionSchema,\n    permissionPolicySchema,\n    policySchema,\n    realmSchema,\n    roleSchema,\n    roleAttributeSchema,\n    rolePermissionSchema,\n    scopeSchema,\n    sessionSchema,\n    sessionTokenSchema,\n    trustAnchorSchema,\n    userSchema,\n    userAttributeSchema,\n    userAuthenticatorSchema,\n    userPermissionSchema,\n    userRoleSchema,\n];\n\nfor (const schema of schemas) {\n    schemaRegistry.add(schema);\n}\n\n/**\n * URL transport codec bound to the schema registry: decodes both the\n * v2 expression dialect (stamped or detected) and legacy v1 bracket\n * payloads, so pre-v2 clients keep working.\n */\nexport const queryCodec = createURLCodec(schemaRegistry);\n\n/**\n * Decode a raw wire query (routup `useRequestQuery` output or a raw\n * query string) against a registered schema into the rapiq IR. The\n * schema's allow-lists, defaults and pagination bounds are applied\n * here — downstream consumers (repository adapters) only execute the\n * returned query.\n *\n * Async because the schema validate hooks are: the relations read\n * gate (`createRelationsReadGate`) awaits the actor's permission\n * pre-gate per include, and rapiq refuses async validators on the\n * synchronous decode path. Pass the acting identity via\n * `options.actor` on every request-driven decode (authenticated or\n * anonymous — the HTTP adapter always builds one); a decode without\n * an actor is a system call and runs unrestricted.\n */\nexport async function decodeQuery<RECORD extends ObjectLiteral = ObjectLiteral>(\n    input: unknown,\n    options: DecodeQueryOptions<RECORD>,\n) : Promise<Query> {\n    const normalized = typeof input === 'string' || isObject(input) ? input : {};\n\n    const parsed = await queryCodec.decodeAsync(normalized, {\n        // Schema<RECORD> is invariant; the codec's non-generic options\n        // accept Schema<ObjectLiteral>, so collapse the variance here.\n        schema: options.schema as Schema<any> | string,\n        parameters: options.parameters,\n        context: { actor: options.actor } satisfies QueryDecodeContext,\n    });\n\n    return parsed ?? new Query({});\n}\n\n/**\n * Append server-derived conditions (a route realm, an owner scope, ...)\n * onto a decoded query by AND-wrapping its filter tree. A client-sent\n * condition on the same field intersects with the scope instead of\n * replacing it, and compound client trees (`or(...)`) are preserved\n * as-is. Same guarantee class as a mandatory `andWhere` at the\n * repository — expressed once in the IR. Appended conditions do not\n * pass through `decodeQuery`, so the schema allow-lists do not\n * constrain them (server-derived context).\n *\n * Immutable: returns a new `Query` whose filters node is the\n * AND-wrapped successor (`IFilters.and`); every other parameter node is\n * carried over **by reference**, so the input query stays untouched and\n * nothing is copied. The node enumeration mirrors rapiq's\n * `QueryContext` — keep it in sync when the IR gains a parameter.\n *\n * Non-displaceability is structural since rapiq beta.19\n * (tada5hi/rapiq#890): filter composition is conjunctive throughout, so\n * no later composition step can drop a conjunct and the appended scope\n * needs no marker to survive.\n */\nexport function appendQueryConditions(query: IQuery, ...conditions: ICondition[]) : Query {\n    return new Query({\n        fields: query.fields,\n        filters: query.filters.and(...conditions),\n        relations: query.relations,\n        pagination: query.pagination,\n        sorts: query.sorts,\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DA,MAAa8B,iBAAiB,IAAI5B,eAAAA;;;;;GAOlC,MAAa6B,UAA0B;CACnC3B;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;CACAC;AACH;AAED,KAAK,MAAMG,UAAUD,SACjBD,eAAeG,IAAID,MAAAA;;;;;GAQvB,MAAaE,aAAalC,eAAe8B,cAAAA;;;;;;;;;;;;;;;GAiBzC,eAAsBK,YAClBC,OACAC,SAAmC;CAEnC,MAAMC,aAAa,OAAOF,UAAU,YAAYjC,SAASiC,KAAAA,IAASA,QAAQ,CAAC;CAU3E,OAAOG,MARcL,WAAWM,YAAYF,YAAY;EAGpDN,QAAQK,QAAQL;EAChBS,YAAYJ,QAAQI;EACpBC,SAAS,EAAEC,OAAON,QAAQM,MAAM;CACpC,CAAA,KAEiB,IAAI1C,MAAM,CAAC,CAAA;AAChC;;;;;;;;;;;;;;;;;;;;;GAuBA,SAAgB2C,sBAAsBC,OAAe,GAAGC,YAAwB;CAC5E,OAAO,IAAI7C,MAAM;EACb8C,QAAQF,MAAME;EACdC,SAASH,MAAMG,QAAQC,IAAG,GAAIH,UAAAA;EAC9BI,WAAWL,MAAMK;EACjBC,YAAYN,MAAMM;EAClBC,OAAOP,MAAMO;CACjB,CAAA;AACJ"}

package/dist/core/security/policy/evaluator.mjs

@@ -104,7 +104,7 @@ var PermissionBindingPolicyEvaluator = class {
 				pending: true,
 				issues: pendingIssues
 			};
-			if (ctx.withConditions && lowerable && conditions.length > 0) result.condition = conditions.length === 1 ? conditions[0] : or(...conditions);
+			if (lowerable && ctx.withConditions && conditions.length > 0) result.condition = conditions.length === 1 ? conditions[0] : or(...conditions);
 			return result;
 		}
 		const success = maybeInvertPolicyOutcome(false, policy.invert);

package/dist/core/security/policy/evaluator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from '@ebec/core';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (ctx.withConditions && lowerable && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAmB;CACjD;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CACEjB,GAAAA,IAAIiB,QAAQ,CAAA,CACnB;GACL,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIhC,IAAIiD,kBAAkBd,aAAaF,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}
+{"version":3,"file":"evaluator.mjs","names":["and","or","BuiltInPolicyType","IdentityPolicyEvaluator","PermissionBindingPolicyValidator","PolicyEngine","PolicyIssueCode","RealmMatchPolicyEvaluator","RealmScope","aggregatePermissionPolicyBindings","definePolicyIssueItem","maybeInvertPolicyOutcome","normalizeRealmScope","PermissionBindingPolicyEvaluator","validator","identityEvaluator","realmMatchEvaluator","identityPermissionProvider","requires","PERMISSION_BINDING","accessData","ctx","data","has","isValidated","get","set","setValidated","evaluate","value","policy","run","identity","success","issues","code","DATA_MISSING","message","path","binding","identityBindings","getFor","then","bindings","filter","item","permission","name","realmId","clientId","length","invert","aggr","pendingIssues","conditions","pending","lowerable","grant","grants","reachCondition","realmOutcome","scope","realmScope","NONE","ANY","condition","push","engine","evaluators","outcome","withConditions","result"],"sources":["../../../../src/core/security/policy/evaluator.ts"],"sourcesContent":["/*\n * Copyright (c) 2024-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition } from '@rapiq/core';\nimport { and, or } from '@rapiq/core';\nimport type { Issue } from '@ebec/core';\nimport type {\n    IPolicyEvaluator,\n    PermissionPolicyBindingAggregated,\n    PolicyEvaluationContext,\n    PolicyEvaluationResult,\n} from '@authup/access';\nimport {\n    BuiltInPolicyType,\n    IdentityPolicyEvaluator,\n    PermissionBindingPolicyValidator,\n    PolicyEngine,\n    PolicyIssueCode,\n    RealmMatchPolicyEvaluator,\n    RealmScope,\n    aggregatePermissionPolicyBindings,\n    definePolicyIssueItem,\n    maybeInvertPolicyOutcome,\n    normalizeRealmScope,\n} from '@authup/access';\nimport type { IIdentityPermissionProvider } from '../../identity/permission/types.ts';\n\nexport class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {\n    protected validator : PermissionBindingPolicyValidator;\n\n    protected identityEvaluator: IdentityPolicyEvaluator;\n\n    protected realmMatchEvaluator : RealmMatchPolicyEvaluator;\n\n    protected identityPermissionProvider: IIdentityPermissionProvider;\n\n    constructor(identityPermissionProvider: IIdentityPermissionProvider) {\n        this.validator = new PermissionBindingPolicyValidator();\n        this.identityEvaluator = new IdentityPolicyEvaluator();\n        this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();\n        this.identityPermissionProvider = identityPermissionProvider;\n    }\n\n    requires() : string[] {\n        // IDENTITY is deliberately NOT declared: a missing identity must stay a\n        // settled DATA_MISSING deny (fail-closed) so a scope-restricted or anonymous\n        // bearer still fails the pre-gate through system.default — pending would be\n        // permitted there.\n        return [BuiltInPolicyType.PERMISSION_BINDING];\n    }\n\n    async accessData(ctx: PolicyEvaluationContext) : Promise<PermissionPolicyBindingAggregated | null> {\n        if (!ctx.data.has(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return null;\n        }\n\n        if (ctx.data.isValidated(BuiltInPolicyType.PERMISSION_BINDING)) {\n            return ctx.data.get(BuiltInPolicyType.PERMISSION_BINDING);\n        }\n\n        const data = ctx.data.get<PermissionPolicyBindingAggregated>(BuiltInPolicyType.PERMISSION_BINDING);\n\n        ctx.data.set(BuiltInPolicyType.PERMISSION_BINDING, data);\n        ctx.data.setValidated(BuiltInPolicyType.PERMISSION_BINDING);\n\n        return data;\n    }\n\n    async evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult> {\n        const policy = await this.validator.run(value);\n\n        const identity = await this.identityEvaluator.accessData(ctx);\n        if (!identity) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property identity is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n        const binding = await this.accessData(ctx);\n        if (!binding) {\n            return {\n                success: false,\n                issues: [\n                    definePolicyIssueItem({\n                        code: PolicyIssueCode.DATA_MISSING,\n                        message: 'The data property permission is missing',\n                        path: ctx.path,\n                    }),\n                ],\n            };\n        }\n\n        const identityBindings = await this.identityPermissionProvider.getFor(identity)\n            .then((bindings) => bindings.filter((item) => {\n                if (item.permission.name !== binding.permission.name) {\n                    return false;\n                }\n\n                return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) &&\n                    (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);\n            }));\n\n        if (identityBindings.length === 0) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        const [aggr] = aggregatePermissionPolicyBindings(identityBindings);\n        if (!aggr) {\n            return { success: maybeInvertPolicyOutcome(false, policy.invert) };\n        }\n\n        // identityBindings is filtered to a single (name, realm_id, client_id) key, so the\n        // aggregate yields exactly one entry whose `grants` are the actor's per-grant\n        // (realm_scope, policy) disjunction terms; access is the DISJUNCTION over them:\n        //   ∃ grant . realmScopeMatches(grant.realmScope, resource) ∧ (grant.policy passes)\n        // Pairing each grant's realm reach with its OWN policy is what fixes both the mixed\n        // policy-free + policy-bound UNDER-grant (a policy-free `own` grant must not mask a\n        // policy-bound `any` grant's wider reach) and the symmetric OVER-grant (an `own`\n        // grant's passing policy must not ride an `any` grant's wider reach).\n        const issues : Issue[] = [];\n        const pendingIssues : Issue[] = [];\n        const conditions : ICondition[] = [];\n        let pending = false;\n        let lowerable = true;\n        for (const grant of aggr.grants) {\n            // Realm reach (coarse, actor-relative) — a SEPARATE factor from the grant's\n            // policy, ANDed with it. The realm-match evaluator runs in SCOPE MODE: it reads the\n            // resource realm from ctx.data[REALM_MATCH] (fallback ATTRIBUTES.realmId) and\n            // neutral-passes when absent (preEvaluate / gate checks / realm-less resources) —\n            // key-PRESENCE is the discriminator. Invoked DIRECTLY (not via PolicyEngine) so\n            // the reach factor can never be skipped by a caller's include/exclude filters or\n            // deferred by the engine's data-availability gate.\n            //\n            // Under `withConditions` (query-build) with no resource realm present, the\n            // reach PENDS with its condition form over the row's realm column instead of\n            // neutral-passing — `any` stays unrestricted and `none` reaches nothing, so\n            // neither pollutes the composed WHERE with constant terms.\n            let reachCondition : ICondition | null = null;\n            const realmOutcome = await this.realmMatchEvaluator.evaluate(\n                { scope: grant.realmScope },\n                ctx,\n            );\n            if (realmOutcome.pending) {\n                const scope = normalizeRealmScope(grant.realmScope);\n                if (scope === RealmScope.NONE) {\n                    continue;\n                }\n\n                if (scope !== RealmScope.ANY) {\n                    if (!realmOutcome.condition) {\n                        pending = true;\n                        lowerable = false;\n                        continue;\n                    }\n\n                    reachCondition = realmOutcome.condition;\n                }\n            } else if (!realmOutcome.success) {\n                continue;\n            }\n\n            if (!grant.policy) {\n                if (!reachCondition) {\n                    // Reach matches and this grant carries no further restriction.\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                // Reach is the grant's only restriction — a pure condition term.\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // Missing evaluators is a misconfiguration: let the engine fail CLOSED with a\n            // surfaced POLICY_EVALUATOR_NOT_FOUND issue (new PolicyEngine(undefined) defaults\n            // to an empty registry, so grant.policy resolves to no evaluator) rather than\n            // swallowing the grant with a silent issue-less deny.\n            const engine = new PolicyEngine(ctx.evaluators);\n            const outcome = await engine.evaluate(grant.policy, {\n                ...ctx,\n                path: [\n                    ...(ctx.path || []),\n                ],\n            });\n\n            if (outcome.success) {\n                if (!reachCondition) {\n                    return { success: maybeInvertPolicyOutcome(true, policy.invert) };\n                }\n\n                conditions.push(reachCondition);\n                pending = true;\n                continue;\n            }\n\n            // A PENDING junction policy (required data key absent — e.g. an ATTRIBUTES\n            // policy at the pre-gate) leaves this grant term UNKNOWN, not failed: the\n            // grant could still pass once the data arrives, so it must not settle the\n            // disjunction to false.\n            if (outcome.pending) {\n                pending = true;\n\n                if (ctx.withConditions && outcome.condition) {\n                    conditions.push(\n                        reachCondition ?\n                            and(reachCondition, outcome.condition) :\n                            outcome.condition,\n                    );\n                } else {\n                    lowerable = false;\n                }\n\n                if (outcome.issues) {\n                    pendingIssues.push(...outcome.issues);\n                }\n\n                continue;\n            }\n\n            if (outcome.issues) {\n                issues.push(...outcome.issues);\n            }\n        }\n\n        // No grant term settled true. If some term is still pending, the disjunction is\n        // pending — deliberately uninverted (unknown stays unknown under negation). The\n        // condition form composes the grant terms as a disjunction, all-or-nothing: a\n        // single non-expressible grant term makes the whole binding non-expressible\n        // (pushing a partial OR would wrongly exclude rows).\n        if (pending) {\n            const result : PolicyEvaluationResult = {\n                success: false,\n                pending: true,\n                issues: pendingIssues,\n            };\n\n            if (lowerable && ctx.withConditions && conditions.length > 0) {\n                result.condition = conditions.length === 1 ?\n                    conditions[0]! :\n                    or(...conditions);\n            }\n\n            return result;\n        }\n\n        // No grant term satisfied (reach ∧ policies). Apply `invert` ONCE to the aggregated\n        // disjunction outcome — never per term, which would corrupt the quantifier.\n        const success = maybeInvertPolicyOutcome(false, policy.invert);\n        return {\n            success,\n            issues: success ? [] : issues,\n        };\n    }\n}\n"],"mappings":";;;;;;AA+BA,IAAaa,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEV,YAAYA,4BAAyD;EACjE,KAAKH,YAAY,IAAIV,iCAAAA;EACrB,KAAKW,oBAAoB,IAAIZ,wBAAAA;EAC7B,KAAKa,sBAAsB,IAAIT,0BAAAA;EAC/B,KAAKU,6BAA6BA;CACtC;CAEAC,WAAsB;EAKlB,OAAO,CAAChB,kBAAkBiB,kBAAmB;CACjD;CAEA,MAAMC,WAAWC,KAAkF;EAC/F,IAAI,CAACA,IAAIC,KAAKC,IAAIrB,kBAAkBiB,kBAAkB,GAClD,OAAO;EAGX,IAAIE,IAAIC,KAAKE,YAAYtB,kBAAkBiB,kBAAkB,GACzD,OAAOE,IAAIC,KAAKG,IAAIvB,kBAAkBiB,kBAAkB;EAG5D,MAAMG,OAAOD,IAAIC,KAAKG,IAAuCvB,kBAAkBiB,kBAAkB;EAEjGE,IAAIC,KAAKI,IAAIxB,kBAAkBiB,oBAAoBG,IAAAA;EACnDD,IAAIC,KAAKK,aAAazB,kBAAkBiB,kBAAkB;EAE1D,OAAOG;CACX;CAEA,MAAMM,SAASC,OAA4BR,KAA+D;EACtG,MAAMS,SAAS,MAAM,KAAKhB,UAAUiB,IAAIF,KAAAA;EAExC,MAAMG,WAAW,MAAM,KAAKjB,kBAAkBK,WAAWC,GAAAA;EACzD,IAAI,CAACW,UACD,OAAO;GACHC,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAEJ,MAAMC,UAAU,MAAM,KAAKnB,WAAWC,GAAAA;EACtC,IAAI,CAACkB,SACD,OAAO;GACHN,SAAS;GACTC,QAAQ,CACJxB,sBAAsB;IAClByB,MAAM7B,gBAAgB8B;IACtBC,SAAS;IACTC,MAAMjB,IAAIiB;GACd,CAAA,CACH;EACL;EAGJ,MAAME,mBAAmB,MAAM,KAAKvB,2BAA2BwB,OAAOT,QAAAA,CAAAA,CACjEU,MAAMC,aAAaA,SAASC,QAAQC,SAAAA;GACjC,IAAIA,KAAKC,WAAWC,SAASR,QAAQO,WAAWC,MAC5C,OAAO;GAGX,QAAQR,QAAQO,WAAWE,WAAW,WAAWH,KAAKC,WAAWE,WAAW,UACvET,QAAQO,WAAWG,YAAY,WAAWJ,KAAKC,WAAWG,YAAY;EAC/E,CAAA,CAAA;EAEJ,IAAIT,iBAAiBU,WAAW,GAC5B,OAAO,EAAEjB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAGrE,MAAM,CAACC,QAAQ3C,kCAAkC+B,gBAAAA;EACjD,IAAI,CAACY,MACD,OAAO,EAAEnB,SAAStB,yBAAyB,OAAOmB,OAAOqB,MAAM,EAAE;EAWrE,MAAMjB,SAAmB,CAAA;EACzB,MAAMmB,gBAA0B,CAAA;EAChC,MAAMC,aAA4B,CAAA;EAClC,IAAIC,UAAU;EACd,IAAIC,YAAY;EAChB,KAAK,MAAMC,SAASL,KAAKM,QAAQ;GAa7B,IAAIC,iBAAqC;GACzC,MAAMC,eAAe,MAAM,KAAK5C,oBAAoBY,SAChD,EAAEiC,OAAOJ,MAAMK,WAAW,GAC1BzC,GAAAA;GAEJ,IAAIuC,aAAaL,SAAS;IACtB,MAAMM,QAAQjD,oBAAoB6C,MAAMK,UAAU;IAClD,IAAID,UAAUrD,WAAWuD,MACrB;IAGJ,IAAIF,UAAUrD,WAAWwD,KAAK;KAC1B,IAAI,CAACJ,aAAaK,WAAW;MACzBV,UAAU;MACVC,YAAY;MACZ;KACJ;KAEAG,iBAAiBC,aAAaK;IAClC;GACJ,OAAO,IAAI,CAACL,aAAa3B,SACrB;GAGJ,IAAI,CAACwB,MAAM3B,QAAQ;IACf,IAAI,CAAC6B,gBAED,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAIpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAOA,MAAMc,UAAU,MAAMF,IADH9D,aAAagB,IAAI+C,UACdD,CAAAA,CAAOvC,SAAS6B,MAAM3B,QAAQ;IAChD,GAAGT;IACHiB,MAAM,CACEjB,GAAAA,IAAIiB,QAAQ,CAAA,CACnB;GACL,CAAA;GAEA,IAAI+B,QAAQpC,SAAS;IACjB,IAAI,CAAC0B,gBACD,OAAO,EAAE1B,SAAStB,yBAAyB,MAAMmB,OAAOqB,MAAM,EAAE;IAGpEG,WAAWY,KAAKP,cAAAA;IAChBJ,UAAU;IACV;GACJ;GAMA,IAAIc,QAAQd,SAAS;IACjBA,UAAU;IAEV,IAAIlC,IAAIiD,kBAAkBD,QAAQJ,WAC9BX,WAAWY,KACPP,iBACI3D,IAAI2D,gBAAgBU,QAAQJ,SAAS,IACrCI,QAAQJ,SAAS;SAGzBT,YAAY;IAGhB,IAAIa,QAAQnC,QACRmB,cAAca,KAAI,GAAIG,QAAQnC,MAAM;IAGxC;GACJ;GAEA,IAAImC,QAAQnC,QACRA,OAAOgC,KAAI,GAAIG,QAAQnC,MAAM;EAErC;EAOA,IAAIqB,SAAS;GACT,MAAMgB,SAAkC;IACpCtC,SAAS;IACTsB,SAAS;IACTrB,QAAQmB;GACZ;GAEA,IAAIG,aAAanC,IAAIiD,kBAAkBhB,WAAWJ,SAAS,GACvDqB,OAAON,YAAYX,WAAWJ,WAAW,IACrCI,WAAW,KACXrD,GAAAA,GAAMqD,UAAAA;GAGd,OAAOiB;EACX;EAIA,MAAMtC,UAAUtB,yBAAyB,OAAOmB,OAAOqB,MAAM;EAC7D,OAAO;GACHlB;GACAC,QAAQD,UAAU,CAAA,IAAKC;EAC3B;CACJ;AACJ"}