@absolutejs/absolute 0.19.0-beta.1050 → 0.19.0-beta.1051

package/dist/cli/config/server.js

@@ -31536,11 +31536,12 @@ var VIRTUAL_NAME = "__absolute_type_introspect__.ts", MAX_DEPTH2 = 6, isFramewor
     skipLibCheck: true,
     types: []
   };
-}, SCHEMA_VERSION = 1, frameworkVersion = (cwd) => {
-  for (const candidate of [
+}, SCHEMA_VERSION = 1, packageVersion = (cwd, specifier) => {
+  const candidates = specifier === "@absolutejs/absolute" ? [
     resolve6(cwd, "node_modules", "@absolutejs", "absolute", "package.json"),
     resolve6(cwd, "package.json")
-  ]) {
+  ] : [resolve6(cwd, "node_modules", ...specifier.split("/"), "package.json")];
+  for (const candidate of candidates) {
     try {
       const { version: version3 } = JSON.parse(readFileSync9(candidate, "utf-8"));
       if (typeof version3 === "string")
@@ -31548,8 +31549,8 @@ var VIRTUAL_NAME = "__absolute_type_introspect__.ts", MAX_DEPTH2 = 6, isFramewor
     } catch {}
   }
   return "unknown";
-}, cacheSignature = (cwd, typeName2, local) => {
-  let signature = `${SCHEMA_VERSION}:${frameworkVersion(cwd)}`;
+}, cacheSignature = (cwd, typeName2, local, specifier) => {
+  let signature = `${SCHEMA_VERSION}:${specifier}:${packageVersion(cwd, specifier)}`;
   if (local) {
     const file = typeName2 === "PackageJson" ? "packageJson.ts" : "build.ts";
     try {
@@ -31557,20 +31558,23 @@ var VIRTUAL_NAME = "__absolute_type_introspect__.ts", MAX_DEPTH2 = 6, isFramewor
     } catch {}
   }
   return signature;
-}, cacheFile = (cwd, typeName2) => resolve6(cwd, ".absolutejs", "config-schema", `${typeName2}.json`), readDiskCache = (cwd, typeName2, signature) => {
+}, cacheSlug = (specifier) => specifier.replace("@", "").split("/").join("-"), cacheFile = (cwd, typeName2, specifier) => {
+  const name = specifier === "@absolutejs/absolute" ? typeName2 : `${typeName2}.${cacheSlug(specifier)}`;
+  return resolve6(cwd, ".absolutejs", "config-schema", `${name}.json`);
+}, readDiskCache = (cwd, typeName2, signature, specifier) => {
   try {
-    const cached = JSON.parse(readFileSync9(cacheFile(cwd, typeName2), "utf-8"));
+    const cached = JSON.parse(readFileSync9(cacheFile(cwd, typeName2, specifier), "utf-8"));
     if (cached?.signature === signature && Array.isArray(cached.fields)) {
       return cached.fields;
     }
   } catch {}
   return null;
-}, writeDiskCache = (cwd, typeName2, signature, fields) => {
+}, writeDiskCache = (cwd, typeName2, signature, fields, specifier) => {
   try {
     mkdirSync2(resolve6(cwd, ".absolutejs", "config-schema"), {
       recursive: true
     });
-    writeFileSync4(cacheFile(cwd, typeName2), JSON.stringify({ fields, signature }));
+    writeFileSync4(cacheFile(cwd, typeName2, specifier), JSON.stringify({ fields, signature }));
   } catch {}
 }, docOf = (symbol, checker) => ts2.displayPartsToString(symbol.getDocumentationComment(checker)).trim(), typeOfSymbol = (symbol, checker) => {
   const declaration = symbol.valueDeclaration ?? symbol.declarations?.[0];
@@ -31692,31 +31696,32 @@ export { value };
     }
   });
   return nodes.sort((left, right) => left.name.localeCompare(right.name));
-}, cache, introspectType = (cwd, typeName2, exclude = new Set) => {
-  const cached = cache.get(typeName2);
+}, cache, introspectType = (cwd, typeName2, exclude = new Set, specifier = "@absolutejs/absolute") => {
+  const cacheKey = `${specifier}:${typeName2}`;
+  const cached = cache.get(cacheKey);
   if (cached)
     return cached;
-  const local = isFrameworkRepo(cwd) && existsSync7(resolve6(cwd, "types/index.ts"));
-  const signature = cacheSignature(cwd, typeName2, local);
-  const fromDisk = readDiskCache(cwd, typeName2, signature);
+  const local = specifier === "@absolutejs/absolute" && isFrameworkRepo(cwd) && existsSync7(resolve6(cwd, "types/index.ts"));
+  const signature = cacheSignature(cwd, typeName2, local, specifier);
+  const fromDisk = readDiskCache(cwd, typeName2, signature, specifier);
   if (fromDisk) {
-    cache.set(typeName2, fromDisk);
+    cache.set(cacheKey, fromDisk);
     return fromDisk;
   }
   const options = compilerOptionsFor(cwd);
-  const specifiers = local ? ["@absolutejs/absolute", "./types"] : ["@absolutejs/absolute"];
-  for (const specifier of specifiers) {
+  const specifiers = local ? [specifier, "./types"] : [specifier];
+  for (const candidate of specifiers) {
     try {
-      const nodes = introspectFrom(cwd, specifier, typeName2, options, exclude);
+      const nodes = introspectFrom(cwd, candidate, typeName2, options, exclude);
       if (nodes.length > 0) {
-        cache.set(typeName2, nodes);
-        writeDiskCache(cwd, typeName2, signature, nodes);
+        cache.set(cacheKey, nodes);
+        writeDiskCache(cwd, typeName2, signature, nodes, specifier);
         return nodes;
       }
     } catch {}
   }
-  cache.set(typeName2, []);
-  return cache.get(typeName2) ?? [];
+  cache.set(cacheKey, []);
+  return cache.get(cacheKey) ?? [];
 };
 var init_fromType = __esm(() => {
   cache = new Map;
@@ -32070,19 +32075,351 @@ var init_resolvePackageJson = __esm(() => {
   init_fromType();
 });
 
+// src/cli/config/auth/authScaffolds.ts
+var TODO = (message) => `async () => { throw new Error("TODO: ${message}"); }`, AUTH_SCAFFOLDS, isScaffoldableFeature = (id) => (id in AUTH_SCAFFOLDS);
+var init_authScaffolds = __esm(() => {
+  AUTH_SCAFFOLDS = {
+    audit: {
+      configKey: "audit",
+      exportName: "auditConfig",
+      fields: [
+        { name: "auditStore", value: "createInMemoryAuditSink()" },
+        { name: "getUserId", value: "(user) => user.sub" }
+      ],
+      generic: true,
+      imports: ["createInMemoryAuditSink"],
+      note: "Swap the in-memory sink for a durable store (append-only table); add `onAuditEvent` to forward to a SIEM.",
+      packages: [],
+      typeName: "AuditConfig"
+    },
+    authorization: {
+      configKey: "authorization",
+      exportName: "authorizationConfig",
+      fields: [
+        {
+          name: "hasPermission",
+          value: '({ user, permission, organizationId }) => { throw new Error("TODO: decide if user has permission"); }'
+        }
+      ],
+      generic: true,
+      imports: [],
+      note: "Pair with `createMembershipPermissionResolver` (from @absolutejs/auth) when you also use organizations + roles.",
+      packages: [],
+      typeName: "AuthorizationConfig"
+    },
+    compliance: {
+      configKey: "compliance",
+      exportName: "complianceConfig",
+      fields: [
+        { name: "deleteUserData", value: TODO("erase or anonymize the user in your stores") },
+        { name: "exportUserData", value: "async ({ user }) => ({})" },
+        { name: "getUserId", value: "(user) => user.sub" }
+      ],
+      generic: true,
+      imports: [],
+      note: "exportUserData must return everything you hold on the user; getUserId lets the route revoke sibling sessions.",
+      packages: [],
+      typeName: "ComplianceConfig"
+    },
+    credentials: {
+      configKey: "credentials",
+      exportName: "credentialsConfig",
+      fields: [
+        { name: "credentialStore", value: "createInMemoryCredentialStore()" },
+        { name: "getUserByEmail", value: TODO("look up a user by email") },
+        { name: "onCreateCredentialUser", value: TODO("create and return the user for identity.email") },
+        { name: "onSendEmail", value: TODO("send the verification / reset email containing message.token") },
+        { name: "requireEmailVerification", value: "false" }
+      ],
+      generic: true,
+      imports: ["createInMemoryCredentialStore"],
+      note: "Swap the in-memory credential store for a real one (it holds password hashes + tokens).",
+      packages: [],
+      typeName: "CredentialsConfig"
+    },
+    lockout: {
+      configKey: "lockout",
+      exportName: "lockoutConfig",
+      fields: [
+        { name: "lockoutStore", value: "createInMemoryLockoutStore()" },
+        { name: "maxAttempts", value: "5" },
+        { name: "windowMs", value: "15 * 60 * 1000" }
+      ],
+      generic: false,
+      imports: ["createInMemoryLockoutStore"],
+      note: "Throttles the credential login route; pair with the `credentials` block.",
+      packages: [],
+      typeName: "LockoutConfig"
+    },
+    mfa: {
+      configKey: "mfa",
+      exportName: "mfaConfig",
+      fields: [
+        { name: "mfaStore", value: "createInMemoryMfaStore()" },
+        { name: "getUserId", value: "(user) => user.sub" },
+        { name: "getChallengeUser", value: TODO("resolve the parked challenge identity to a user") },
+        { name: "issuer", value: "'YourApp'" }
+      ],
+      generic: true,
+      imports: ["createInMemoryMfaStore"],
+      note: "Set `encryptionKey` (base64url) to encrypt the TOTP secret at rest in any real deployment.",
+      packages: [],
+      typeName: "MfaConfig"
+    },
+    organizations: {
+      configKey: "organizations",
+      exportName: "organizationsConfig",
+      fields: [
+        { name: "getUserId", value: "(user) => user.sub" },
+        { name: "organizationStore", value: "createInMemoryOrganizationStore()" }
+      ],
+      generic: true,
+      imports: ["createInMemoryOrganizationStore"],
+      note: "Add `onSendInvitation` to deliver invite emails; otherwise the plaintext token is returned from the invite route.",
+      packages: [],
+      typeName: "OrganizationsConfig"
+    },
+    passwordless: {
+      configKey: "passwordless",
+      exportName: "passwordlessConfig",
+      fields: [
+        { name: "passwordlessTokenStore", value: "createInMemoryPasswordlessTokenStore()" },
+        { name: "getUserByEmail", value: TODO("look up a user by email") },
+        { name: "onSendMagicLink", value: TODO("email the magic link containing message.token") }
+      ],
+      generic: true,
+      imports: ["createInMemoryPasswordlessTokenStore"],
+      note: "The magic-link flow mounts when `onSendMagicLink` is set; add `onSendOtp` to also mount the email/SMS OTP flow.",
+      packages: [],
+      typeName: "PasswordlessConfig"
+    },
+    portal: {
+      configKey: "portal",
+      exportName: "portalConfig",
+      fields: [
+        { name: "setupSessionStore", value: "createInMemorySetupSessionStore()" }
+      ],
+      generic: false,
+      imports: ["createInMemorySetupSessionStore"],
+      note: "Pass the same `ssoConnectionStore` / `scimTokenStore` your sso / scim blocks use so portal edits take effect live.",
+      packages: [],
+      typeName: "PortalConfig"
+    },
+    roles: {
+      configKey: "roles",
+      exportName: "rolesConfig",
+      fields: [
+        { name: "getUserId", value: "(user) => user.sub" },
+        { name: "organizationStore", value: "createInMemoryOrganizationStore()" },
+        { name: "roleStore", value: "createInMemoryRoleStore()" }
+      ],
+      generic: true,
+      imports: ["createInMemoryOrganizationStore", "createInMemoryRoleStore"],
+      note: "Builds on the `organizations` block \u2014 reuse the same organizationStore instance there.",
+      packages: [],
+      typeName: "RolesConfig"
+    },
+    scim: {
+      configKey: "scim",
+      exportName: "scimConfig",
+      fields: [
+        { name: "scimTokenStore", value: "createInMemoryScimTokenStore()" },
+        { name: "getScimUser", value: TODO("return the SCIM user for { id, organizationId }") },
+        { name: "listScimUsers", value: "async () => []" },
+        { name: "onScimUserCreate", value: TODO("create and return the SCIM user") },
+        { name: "onScimUserDeactivate", value: TODO("deprovision the user (hard-delete or deactivate)") },
+        { name: "onScimUserReplace", value: TODO("replace and return the SCIM user (undefined if unknown)") }
+      ],
+      generic: false,
+      imports: ["createInMemoryScimTokenStore"],
+      note: "Group hooks are optional (the /Groups routes 501 without them). Mint per-org tokens with `createScimToken`.",
+      packages: [],
+      typeName: "ScimConfig"
+    },
+    sessions: {
+      configKey: "sessions",
+      exportName: "sessionsConfig",
+      fields: [{ name: "getUserId", value: "(user) => user.sub" }],
+      generic: true,
+      imports: [],
+      note: "Requires an `authSessionStore` (top-level) that can enumerate a user\u2019s sessions.",
+      packages: [],
+      typeName: "SessionsConfig"
+    },
+    sso: {
+      configKey: "sso",
+      exportName: "ssoConfig",
+      fields: [
+        { name: "ssoConnectionStore", value: "createInMemorySsoConnectionStore()" },
+        { name: "getSsoUser", value: TODO("map the verified SSO identity to your user (create on first sign-in)") }
+      ],
+      generic: true,
+      imports: ["createInMemorySsoConnectionStore"],
+      note: "OIDC works out of the box; add a `samlAdapter` (wrapping e.g. @node-saml/node-saml) to also mount SAML.",
+      packages: [],
+      typeName: "SSOConfig"
+    },
+    webauthn: {
+      configKey: "webauthn",
+      exportName: "webauthnConfig",
+      fields: [
+        { name: "credentialStore", value: "createInMemoryWebAuthnCredentialStore()" },
+        { name: "getUserId", value: "(user) => user.sub" },
+        { name: "getWebAuthnUser", value: TODO("resolve a stored credential userId back to a user") },
+        { name: "origin", value: "'http://localhost:3000'" },
+        { name: "rpId", value: "'localhost'" },
+        { name: "rpName", value: "'YourApp'" },
+        {
+          name: "webauthnAdapter",
+          value: "{} as unknown as WebAuthnAdapter"
+        }
+      ],
+      generic: true,
+      imports: ["createInMemoryWebAuthnCredentialStore", "type WebAuthnAdapter"],
+      note: "Provide a real `webauthnAdapter` wrapping a vetted library (e.g. @simplewebauthn/server); set origin/rpId/rpName for your domain.",
+      packages: [],
+      typeName: "WebAuthnConfig"
+    },
+    webhooks: {
+      configKey: "webhooks",
+      exportName: "webhooksConfig",
+      fields: [{ name: "endpoints", value: "[]" }],
+      generic: false,
+      imports: [],
+      note: "Add endpoints as { url, secret } \u2014 each event is HMAC-signed (Standard Webhooks) with that secret.",
+      packages: [],
+      typeName: "WebhooksConfig"
+    }
+  };
+});
+
+// src/cli/config/auth/resolveAuthSettings.ts
+var exports_resolveAuthSettings = {};
+__export(exports_resolveAuthSettings, {
+  resolveAuthSettingsState: () => resolveAuthSettingsState,
+  parseAuthSettingsObject: () => parseAuthSettingsObject,
+  findAuthSettingsPath: () => findAuthSettingsPath,
+  findAuthSettingsObject: () => findAuthSettingsObject
+});
+import ts5 from "typescript";
+import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
+import { resolve as resolve9 } from "path";
+var AUTH_PACKAGE = "@absolutejs/auth", CONFIG_CANDIDATES4, findAuthSettingsPath = (cwd, override) => {
+  if (override) {
+    const resolved = resolve9(cwd, override);
+    return existsSync10(resolved) ? resolved : null;
+  }
+  for (const name of CONFIG_CANDIDATES4) {
+    const candidate = resolve9(cwd, name);
+    if (existsSync10(candidate))
+      return candidate;
+  }
+  return null;
+}, parseSource2 = (configPath, text) => ts5.createSourceFile(configPath, text, ts5.ScriptTarget.Latest, true), findAuthSettingsObject = (sourceFile) => {
+  let found = null;
+  const visit2 = (node) => {
+    if (found)
+      return;
+    const [firstArgument] = ts5.isCallExpression(node) ? node.arguments : [];
+    if (ts5.isCallExpression(node) && ts5.isIdentifier(node.expression) && node.expression.text === "defineAuthSettings" && firstArgument && ts5.isObjectLiteralExpression(firstArgument)) {
+      found = firstArgument;
+      return;
+    }
+    if (ts5.isExportAssignment(node) && ts5.isObjectLiteralExpression(node.expression)) {
+      found = node.expression;
+      return;
+    }
+    ts5.forEachChild(node, visit2);
+  };
+  visit2(sourceFile);
+  return found;
+}, parseAuthSettingsObject = (configPath) => {
+  const text = readFileSync14(configPath, "utf-8");
+  return {
+    object: findAuthSettingsObject(parseSource2(configPath, text)),
+    text
+  };
+}, evalLiteral2 = (node) => {
+  if (ts5.isStringLiteralLike(node))
+    return { opaque: false, value: node.text };
+  if (node.kind === ts5.SyntaxKind.TrueKeyword) {
+    return { opaque: false, value: true };
+  }
+  if (node.kind === ts5.SyntaxKind.FalseKeyword) {
+    return { opaque: false, value: false };
+  }
+  if (node.kind === ts5.SyntaxKind.NullKeyword) {
+    return { opaque: false, value: null };
+  }
+  if (ts5.isNumericLiteral(node)) {
+    return { opaque: false, value: Number(node.text) };
+  }
+  if (ts5.isPrefixUnaryExpression(node) && node.operator === ts5.SyntaxKind.MinusToken && ts5.isNumericLiteral(node.operand)) {
+    return { opaque: false, value: -Number(node.operand.text) };
+  }
+  if (ts5.isArrayLiteralExpression(node)) {
+    const items = [];
+    for (const element of node.elements) {
+      const result = evalLiteral2(element);
+      if (result.opaque)
+        return { opaque: true, value: undefined };
+      items.push(result.value);
+    }
+    return { opaque: false, value: items };
+  }
+  return { opaque: true, value: undefined };
+}, readCurrent3 = (configPath) => {
+  const current2 = {};
+  const opaqueKeys = [];
+  const { object } = parseAuthSettingsObject(configPath);
+  if (!object)
+    return { current: current2, opaqueKeys };
+  for (const property of object.properties) {
+    if (!ts5.isPropertyAssignment(property) || !(ts5.isIdentifier(property.name) || ts5.isStringLiteral(property.name))) {
+      continue;
+    }
+    const name = property.name.text;
+    const result = evalLiteral2(property.initializer);
+    if (result.opaque)
+      opaqueKeys.push(name);
+    else
+      current2[name] = result.value;
+  }
+  return { current: current2, opaqueKeys };
+}, resolveAuthSettingsState = (cwd, override) => {
+  const configPath = findAuthSettingsPath(cwd, override);
+  const fields = introspectType(cwd, "AuthSettings", new Set, AUTH_PACKAGE);
+  const { current: current2, opaqueKeys } = configPath ? readCurrent3(configPath) : { current: {}, opaqueKeys: [] };
+  return {
+    available: fields.length > 0,
+    configPath,
+    current: current2,
+    fields,
+    opaqueKeys
+  };
+};
+var init_resolveAuthSettings = __esm(() => {
+  init_fromType();
+  CONFIG_CANDIDATES4 = [
+    "auth.config.ts",
+    "auth.config.js",
+    "auth.config.mjs"
+  ];
+});
+
 // src/cli/config/auth/resolveAuthState.ts
 var exports_resolveAuthState = {};
 __export(exports_resolveAuthState, {
   resolveAuthState: () => resolveAuthState
 });
-import ts5 from "typescript";
-import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync14 } from "fs";
-import { join as join2, relative, resolve as resolve9 } from "path";
-var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs/absolute-auth", NPM_URL = "https://www.npmjs.com/package/@absolutejs/auth", SKIP_DIRS, MAX_FILES = 4000, SETUP_EXPORTS, isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readJson = (path) => {
-  if (!existsSync10(path))
+import ts6 from "typescript";
+import { existsSync as existsSync11, readdirSync, readFileSync as readFileSync15 } from "fs";
+import { join as join2, relative, resolve as resolve10 } from "path";
+var AUTH_PACKAGE2 = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs/absolute-auth", NPM_URL = "https://www.npmjs.com/package/@absolutejs/auth", SKIP_DIRS, MAX_FILES = 4000, SETUP_EXPORTS, isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readJson = (path) => {
+  if (!existsSync11(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync14(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync15(path, "utf-8"));
     return isRecord3(parsed) ? parsed : null;
   } catch {
     return null;
@@ -32098,12 +32435,12 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
     const group = pkg[field];
     if (!isRecord3(group))
       continue;
-    const version3 = group[AUTH_PACKAGE];
+    const version3 = group[AUTH_PACKAGE2];
     if (typeof version3 === "string")
       return version3;
   }
   return null;
-}, installedVersionFor = (cwd) => stringField(readJson(join2(cwd, "node_modules", AUTH_PACKAGE, "package.json")), "version"), SOURCE_FILE, safeReaddir = (dir) => {
+}, installedVersionFor = (cwd) => stringField(readJson(join2(cwd, "node_modules", AUTH_PACKAGE2, "package.json")), "version"), SOURCE_FILE, safeReaddir = (dir) => {
   try {
     return readdirSync(dir, { withFileTypes: true });
   } catch {
@@ -32132,9 +32469,9 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
     collectFrom(dir, found, stack);
   }
   return found;
-}, isAuthPackageImport = (statement) => ts5.isImportDeclaration(statement) && ts5.isStringLiteral(statement.moduleSpecifier) && statement.moduleSpecifier.text === AUTH_PACKAGE, addAuthNames = (statement, names) => {
+}, isAuthPackageImport = (statement) => ts6.isImportDeclaration(statement) && ts6.isStringLiteral(statement.moduleSpecifier) && statement.moduleSpecifier.text === AUTH_PACKAGE2, addAuthNames = (statement, names) => {
   const bindings = statement.importClause?.namedBindings;
-  if (!bindings || !ts5.isNamedImports(bindings))
+  if (!bindings || !ts6.isNamedImports(bindings))
     return;
   for (const element of bindings.elements) {
     const imported = element.propertyName?.text ?? element.name.text;
@@ -32149,18 +32486,18 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
       addAuthNames(statement, names);
   }
   return names;
-}, isAuthCall = (node, bindings) => ts5.isIdentifier(node.expression) && bindings.has(node.expression.text), providerCountOf = (property) => {
-  if (!ts5.isPropertyAssignment(property) || !ts5.isObjectLiteralExpression(property.initializer)) {
+}, isAuthCall = (node, bindings) => ts6.isIdentifier(node.expression) && bindings.has(node.expression.text), providerCountOf = (property) => {
+  if (!ts6.isPropertyAssignment(property) || !ts6.isObjectLiteralExpression(property.initializer)) {
     return null;
   }
   return property.initializer.properties.length;
 }, readConfigKeys = (object) => {
   const keys = new Set;
   let providerCount = null;
-  const usesSpread = object.properties.some((property) => ts5.isSpreadAssignment(property));
+  const usesSpread = object.properties.some((property) => ts6.isSpreadAssignment(property));
   for (const property of object.properties) {
     const { name } = property;
-    if (name === undefined || !ts5.isIdentifier(name))
+    if (name === undefined || !ts6.isIdentifier(name))
       continue;
     keys.add(name.text);
     if (name.text !== "providersConfiguration")
@@ -32170,20 +32507,20 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
   return { keys, providerCount, usesSpread };
 }, matchFromCall = (node) => {
   const [arg] = node.arguments;
-  if (arg && ts5.isObjectLiteralExpression(arg))
+  if (arg && ts6.isObjectLiteralExpression(arg))
     return readConfigKeys(arg);
   return { keys: new Set, providerCount: null, usesSpread: true };
 }, readFileOrNull = (path) => {
   try {
-    return readFileSync14(path, "utf-8");
+    return readFileSync15(path, "utf-8");
   } catch {
     return null;
   }
 }, findSetupInFile = (path) => {
   const text = readFileOrNull(path);
-  if (text === null || !text.includes(AUTH_PACKAGE))
+  if (text === null || !text.includes(AUTH_PACKAGE2))
     return null;
-  const sourceFile = ts5.createSourceFile(path, text, ts5.ScriptTarget.Latest, true);
+  const sourceFile = ts6.createSourceFile(path, text, ts6.ScriptTarget.Latest, true);
   const bindings = authBindings(sourceFile);
   if (bindings.size === 0)
     return null;
@@ -32191,11 +32528,11 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
   const visit2 = (node) => {
     if (match)
       return;
-    if (ts5.isCallExpression(node) && isAuthCall(node, bindings)) {
+    if (ts6.isCallExpression(node) && isAuthCall(node, bindings)) {
       match = matchFromCall(node);
       return;
     }
-    ts5.forEachChild(node, visit2);
+    ts6.forEachChild(node, visit2);
   };
   visit2(sourceFile);
   return match;
@@ -32205,10 +32542,11 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
   configured: keys.has(feature.configKey),
   id: feature.id,
   kind: feature.kind,
-  label: feature.label
+  label: feature.label,
+  scaffoldable: isScaffoldableFeature(feature.id)
 })), resolveAuthState = (cwd) => {
   const installedVersion = installedVersionFor(cwd);
-  const root = existsSync10(join2(cwd, "src")) ? join2(cwd, "src") : cwd;
+  const root = existsSync11(join2(cwd, "src")) ? join2(cwd, "src") : cwd;
   let match = null;
   let setupPath = null;
   for (const file of candidateFiles(root)) {
@@ -32216,7 +32554,7 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
     if (found === null)
       continue;
     match = found;
-    setupPath = relative(cwd, resolve9(file));
+    setupPath = relative(cwd, resolve10(file));
     break;
   }
   const keys = match?.keys ?? new Set;
@@ -32229,6 +32567,7 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
     npmUrl: NPM_URL,
     providerCount: match?.providerCount ?? null,
     repoUrl: REPO_URL,
+    settings: resolveAuthSettingsState(cwd),
     setupPath,
     usesSpread: match?.usesSpread ?? false
   };
@@ -32236,6 +32575,8 @@ var AUTH_PACKAGE = "@absolutejs/auth", REPO_URL = "https://github.com/absolutejs
 };
 var init_resolveAuthState = __esm(() => {
   init_authCatalog();
+  init_authScaffolds();
+  init_resolveAuthSettings();
   SKIP_DIRS = new Set([
     "node_modules",
     ".git",
@@ -32249,6 +32590,87 @@ var init_resolveAuthState = __esm(() => {
   SOURCE_FILE = /\.(ts|tsx|mts|cts|js|mjs)$/;
 });
 
+// src/cli/config/auth/editAuthConfig.ts
+var exports_editAuthConfig = {};
+__export(exports_editAuthConfig, {
+  applyAuthConfigEdit: () => applyAuthConfigEdit
+});
+import ts7 from "typescript";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+var lineStartOffset2 = (text, position) => {
+  let index = position;
+  while (index > 0 && text[index - 1] !== `
+`)
+    index -= 1;
+  return index;
+}, indentBefore2 = (text, position) => text.slice(lineStartOffset2(text, position), position), findProperty3 = (object, name) => object.properties.find((property) => ts7.isPropertyAssignment(property) && (ts7.isIdentifier(property.name) || ts7.isStringLiteral(property.name)) && property.name.text === name), applyAuthConfigEdit = (configPath, request) => {
+  try {
+    const text = readFileSync16(configPath, "utf-8");
+    const sourceFile = ts7.createSourceFile(configPath, text, ts7.ScriptTarget.Latest, true);
+    const object = findAuthSettingsObject(sourceFile);
+    if (!object) {
+      return {
+        message: "Could not find defineAuthSettings({ ... }) in auth.config.ts.",
+        ok: false
+      };
+    }
+    const existing = findProperty3(object, request.name);
+    if (request.remove) {
+      if (!existing)
+        return { message: `${request.name} is not set`, ok: true };
+      const start = lineStartOffset2(text, existing.getStart(sourceFile));
+      let end = existing.getEnd();
+      if (text[end] === ",")
+        end += 1;
+      if (text[end] === `
+`)
+        end += 1;
+      writeFileSync7(configPath, text.slice(0, start) + text.slice(end), "utf-8");
+      return { message: `Removed ${request.name}`, ok: true };
+    }
+    const valueText = serializeValue2(request.value);
+    if (existing) {
+      const start = existing.initializer.getStart(sourceFile);
+      const end = existing.initializer.getEnd();
+      writeFileSync7(configPath, text.slice(0, start) + valueText + text.slice(end), "utf-8");
+      return { message: `Updated ${request.name}`, ok: true };
+    }
+    const { properties } = object;
+    const entry = `${request.name}: ${valueText}`;
+    if (properties.length > 0) {
+      const last = properties[properties.length - 1];
+      if (!last) {
+        return {
+          message: "Could not locate insertion point.",
+          ok: false
+        };
+      }
+      const indent = indentBefore2(text, last.getStart(sourceFile));
+      let insertAt = last.getEnd();
+      const hasComma = text[insertAt] === ",";
+      if (hasComma)
+        insertAt += 1;
+      const insertion = `${hasComma ? "" : ","}
+${indent}${entry}`;
+      writeFileSync7(configPath, text.slice(0, insertAt) + insertion + text.slice(insertAt), "utf-8");
+    } else {
+      const insertAt = object.getStart(sourceFile) + 1;
+      const indent = `${indentBefore2(text, object.getStart(sourceFile))}	`;
+      const insertion = `
+${indent}${entry}
+${indentBefore2(text, object.getStart(sourceFile))}`;
+      writeFileSync7(configPath, text.slice(0, insertAt) + insertion + text.slice(insertAt), "utf-8");
+    }
+    return { message: `Updated ${request.name}`, ok: true };
+  } catch (error) {
+    return { message: String(error), ok: false };
+  }
+};
+var init_editAuthConfig = __esm(() => {
+  init_resolveAuthSettings();
+  init_serialize();
+});
+
 // src/cli/add/dependencies.ts
 var runBunAdd = (cwd, specs, dev) => {
   if (specs.length === 0)
@@ -32263,6 +32685,80 @@ var runBunAdd = (cwd, specs, dev) => {
 }, installPackages = (cwd, specs, dev = false) => runBunAdd(cwd, specs, dev);
 var init_dependencies = () => {};
 
+// src/cli/config/auth/scaffoldAuthFeature.ts
+var exports_scaffoldAuthFeature = {};
+__export(exports_scaffoldAuthFeature, {
+  scaffoldAuthFeature: () => scaffoldAuthFeature
+});
+import { existsSync as existsSync12, writeFileSync as writeFileSync8 } from "fs";
+import { dirname, join as join3, relative as relative2, resolve as resolve11 } from "path";
+var renderScaffold = (scaffold) => {
+  const importNames = [...scaffold.imports, `type ${scaffold.typeName}`];
+  const importLine = `import { ${importNames.join(", ")} } from '@absolutejs/auth';`;
+  const userType = scaffold.generic ? `
+// TODO: replace with your app's user type (the one you pass to auth<User>()).
+type User = {
+	sub: string;
+};
+` : "";
+  const note = scaffold.note ? `
+// ${scaffold.note}
+` : `
+`;
+  const generic = scaffold.generic ? "<User>" : "";
+  const body = scaffold.fields.map((field) => `	${field.name}: ${field.value}`).join(`,
+`);
+  return `${importLine}
+${userType}${note}export const ${scaffold.exportName}: ${scaffold.typeName}${generic} = {
+${body}
+};
+`;
+}, targetDir = (cwd) => {
+  const { setupPath } = resolveAuthState(cwd);
+  if (setupPath)
+    return dirname(resolve11(cwd, setupPath));
+  const src = join3(cwd, "src");
+  return existsSync12(src) ? src : cwd;
+}, spreadFor = (scaffold) => `import { ${scaffold.exportName} } from './${scaffold.exportName}';
+// add to your auth() call:
+${scaffold.configKey}: ${scaffold.exportName}`, failure2 = (message) => ({
+  created: null,
+  installed: false,
+  message,
+  ok: false,
+  spreadSnippet: null
+}), scaffoldAuthFeature = (cwd, id, options = {}) => {
+  const scaffold = AUTH_SCAFFOLDS[id];
+  if (!scaffold)
+    return failure2(`Unknown auth feature "${id}".`);
+  const filePath = join3(targetDir(cwd), `${scaffold.exportName}.ts`);
+  const relPath = relative2(cwd, filePath);
+  if (existsSync12(filePath)) {
+    return {
+      created: null,
+      installed: false,
+      message: `${relPath} already exists \u2014 left untouched.`,
+      ok: true,
+      spreadSnippet: spreadFor(scaffold)
+    };
+  }
+  const install = options.install ?? true;
+  const installOk = install && scaffold.packages.length > 0 ? installPackages(cwd, scaffold.packages) : true;
+  writeFileSync8(filePath, renderScaffold(scaffold));
+  return {
+    created: relPath,
+    installed: installOk,
+    message: `Scaffolded ${relPath}.`,
+    ok: true,
+    spreadSnippet: spreadFor(scaffold)
+  };
+};
+var init_scaffoldAuthFeature = __esm(() => {
+  init_dependencies();
+  init_authScaffolds();
+  init_resolveAuthState();
+});
+
 // src/cli/integrations/catalog.ts
 var INTEGRATIONS, findIntegration = (id) => INTEGRATIONS.find((integration) => integration.id === id) ?? null;
 var init_catalog = __esm(() => {
@@ -32324,14 +32820,14 @@ __export(exports_addPlugin, {
   resolveIntegrationsState: () => resolveIntegrationsState,
   addIntegration: () => addIntegration
 });
-import { existsSync as existsSync11, readFileSync as readFileSync15 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync17 } from "fs";
+import { join as join4 } from "path";
 var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), readPackageJson = (cwd) => {
-  const path = join3(cwd, "package.json");
-  if (!existsSync11(path))
+  const path = join4(cwd, "package.json");
+  if (!existsSync13(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync15(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync17(path, "utf-8"));
     return isRecord4(parsed) ? parsed : null;
   } catch {
     return null;
@@ -32382,7 +32878,7 @@ ${wiring.useLine}` : null, toItem = (meta, deps, current2) => {
     return `Skipped install (--no-install) for ${meta.label}.`;
   }
   return `${meta.label} is built in \u2014 no install needed.`;
-}, failure2 = (message) => ({
+}, failure3 = (message) => ({
   installed: false,
   item: null,
   message,
@@ -32392,7 +32888,7 @@ ${wiring.useLine}` : null, toItem = (meta, deps, current2) => {
 }), addIntegration = (cwd, id, options = {}) => {
   const meta = findIntegration(id);
   if (!meta)
-    return failure2(`Unknown integration "${id}".`);
+    return failure3(`Unknown integration "${id}".`);
   const install = options.install ?? true;
   const willInstall = install && meta.packages.length > 0;
   const installOk = willInstall ? installPackages(cwd, meta.packages) : true;
@@ -32401,7 +32897,7 @@ ${wiring.useLine}` : null, toItem = (meta, deps, current2) => {
   let message = baseMessage(meta, willInstall, installOk);
   if (meta.wiring.kind === "config") {
     if (!configPath)
-      return failure2("No absolute.config.ts found.");
+      return failure3("No absolute.config.ts found.");
     const edit = applyAbsoluteConfigEdit(configPath, {
       name: meta.wiring.field,
       value: true
@@ -32429,11 +32925,11 @@ var init_addPlugin = __esm(() => {
 
 // src/cli/config/server.ts
 import { Elysia as Elysia2 } from "elysia";
-import { existsSync as existsSync12, readFileSync as readFileSync16 } from "fs";
-import { resolve as resolve10 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync18 } from "fs";
+import { resolve as resolve12 } from "path";
 
 // src/cli/config/page/PanelHost.tsx
-var import_react8 = __toESM(require_react(), 1);
+var import_react9 = __toESM(require_react(), 1);
 
 // src/cli/config/eslint/EslintPanel.tsx
 var import_react2 = __toESM(require_react(), 1);
@@ -34765,40 +35261,113 @@ var IntegrationsPanel = ({
 
 // src/cli/config/auth/AuthPanel.tsx
 init_authCatalog();
+var import_react7 = __toESM(require_react(), 1);
 var jsx_dev_runtime7 = __toESM(require_jsx_dev_runtime(), 1);
-var FeatureCard = ({ blurb, configKey, configured, kind, label }) => /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
-  className: "rule",
-  children: /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
-    className: "rule-main",
+var SettingRow = ({ busy, field, isSet, onSave, value }) => {
+  const [draft, setDraft] = import_react7.useState(value);
+  return /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+    className: "rule fe-block",
     children: [
       /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
-        className: "rule-name-row",
+        className: "rule-main",
         children: [
-          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
-            className: "rule-name",
-            children: label
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
-            className: "badge dep",
-            children: configKey
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
-            className: "badge",
-            children: kind
+          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+            className: "rule-name-row",
+            children: [
+              /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
+                className: "rule-name",
+                children: field.name
+              }, undefined, false, undefined, this),
+              isSet && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
+                className: "badge src",
+                children: "set"
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this),
+          field.description !== "" && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("p", {
+            className: "rule-desc",
+            children: field.description
           }, undefined, false, undefined, this),
-          configured && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
-            className: "badge src",
-            children: "configured"
+          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+            className: "fe-root",
+            children: /* @__PURE__ */ jsx_dev_runtime7.jsxDEV(FieldEditor, {
+              onChange: setDraft,
+              schema: field.schema,
+              value: draft
+            }, undefined, false, undefined, this)
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("p", {
-        className: "rule-desc",
-        children: blurb
-      }, undefined, false, undefined, this)
+      /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+        className: "rule-controls fe-actions",
+        children: [
+          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("button", {
+            className: "ts-btn",
+            disabled: busy,
+            onClick: () => onSave(draft),
+            type: "button",
+            children: "save"
+          }, undefined, false, undefined, this),
+          isSet && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("button", {
+            className: "ts-clear",
+            onClick: () => onSave(undefined, true),
+            type: "button",
+            children: "unset"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this)
     ]
-  }, undefined, true, undefined, this)
-}, undefined, false, undefined, this);
+  }, undefined, true, undefined, this);
+};
+var FeatureCard = ({ busy, feature, onScaffold, result }) => /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+  className: "rule",
+  children: [
+    /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+      className: "rule-main",
+      children: [
+        /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+          className: "rule-name-row",
+          children: [
+            /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
+              className: "rule-name",
+              children: feature.label
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
+              className: "badge dep",
+              children: feature.configKey
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
+              className: "badge",
+              children: feature.kind
+            }, undefined, false, undefined, this),
+            feature.configured && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
+              className: "badge src",
+              children: "configured"
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("p", {
+          className: "rule-desc",
+          children: feature.blurb
+        }, undefined, false, undefined, this),
+        result?.spreadSnippet && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("pre", {
+          className: "intg-code",
+          children: result.spreadSnippet
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this),
+    !feature.configured && feature.scaffoldable && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+      className: "rule-controls fe-actions",
+      children: /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("button", {
+        className: "ts-btn",
+        disabled: busy,
+        onClick: onScaffold,
+        type: "button",
+        children: result?.created ? "scaffolded" : "scaffold wiring"
+      }, undefined, false, undefined, this)
+    }, undefined, false, undefined, this)
+  ]
+}, undefined, true, undefined, this);
 var NotInstalled = ({ npmUrl, repoUrl }) => /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
   className: "shell",
   children: [
@@ -34864,13 +35433,59 @@ var NotInstalled = ({ npmUrl, repoUrl }) => /* @__PURE__ */ jsx_dev_runtime7.jsx
     }, undefined, false, undefined, this)
   ]
 }, undefined, true, undefined, this);
-var AuthPanel = ({ state }) => {
+var AuthPanel = ({ state: initial }) => {
+  const [state, setState] = import_react7.useState(initial);
+  const [busy, setBusy] = import_react7.useState(null);
+  const [notice, setNotice] = import_react7.useState(null);
+  const [results, setResults] = import_react7.useState({});
+  const saveSetting = (name) => async (value, remove) => {
+    setBusy(`setting:${name}`);
+    setNotice(null);
+    try {
+      const response = await fetch("/api/auth", {
+        body: JSON.stringify({ name, remove, value }),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      });
+      const result = await response.json();
+      if (result.ok && result.state) {
+        setState(result.state);
+        setNotice({ kind: "ok", text: result.message });
+      } else {
+        setNotice({ kind: "err", text: result.message });
+      }
+    } catch (error) {
+      setNotice({ kind: "err", text: String(error) });
+    } finally {
+      setBusy(null);
+    }
+  };
+  const scaffold = (id) => async () => {
+    setBusy(id);
+    setNotice(null);
+    try {
+      const response = await fetch("/api/auth/scaffold", {
+        body: JSON.stringify({ id }),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      });
+      const result = await response.json();
+      setResults((prev) => ({ ...prev, [id]: result }));
+      setNotice({ kind: result.ok ? "ok" : "err", text: result.message });
+    } catch (error) {
+      setNotice({ kind: "err", text: String(error) });
+    } finally {
+      setBusy(null);
+    }
+  };
   if (!state.installed)
     return /* @__PURE__ */ jsx_dev_runtime7.jsxDEV(NotInstalled, {
       ...state
     }, undefined, false, undefined, this);
   const configuredCount = state.features.filter((feature) => feature.configured).length;
   const version = state.installedVersion ?? state.declaredVersion ?? "\u2014";
+  const { settings } = state;
+  const canEditSettings = settings.available && settings.configPath !== null;
   return /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
     className: "shell",
     children: [
@@ -35005,10 +35620,71 @@ var AuthPanel = ({ state }) => {
                 ]
               }, undefined, true, undefined, this),
               state.features.map((feature) => /* @__PURE__ */ jsx_dev_runtime7.jsxDEV(FeatureCard, {
-                ...feature
+                busy: busy === feature.id,
+                feature,
+                onScaffold: scaffold(feature.id),
+                result: results[feature.id] ?? null
               }, feature.id, false, undefined, this))
             ]
           }, undefined, true, undefined, this),
+          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("section", {
+            className: "section",
+            children: [
+              /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+                className: "section-head",
+                children: [
+                  /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("h2", {
+                    className: "section-title",
+                    children: "Settings"
+                  }, undefined, false, undefined, this),
+                  /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("span", {
+                    className: "section-files",
+                    children: settings.configPath ?? "auth.config.ts"
+                  }, undefined, false, undefined, this)
+                ]
+              }, undefined, true, undefined, this),
+              !settings.available && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("p", {
+                className: "rule-desc",
+                children: [
+                  "Upgrade ",
+                  /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("code", {
+                    children: "@absolutejs/auth"
+                  }, undefined, false, undefined, this),
+                  " to a version that exports ",
+                  /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("code", {
+                    children: "AuthSettings"
+                  }, undefined, false, undefined, this),
+                  " to edit settings here."
+                ]
+              }, undefined, true, undefined, this),
+              settings.available && settings.configPath === null && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("p", {
+                className: "rule-desc",
+                children: [
+                  "Create an ",
+                  /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("code", {
+                    children: "auth.config.ts"
+                  }, undefined, false, undefined, this),
+                  " exporting",
+                  " ",
+                  /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("code", {
+                    children: "defineAuthSettings({})"
+                  }, undefined, false, undefined, this),
+                  " and spread it into your ",
+                  /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("code", {
+                    children: "auth()"
+                  }, undefined, false, undefined, this),
+                  " call, then edit the route paths, durations, and limits here."
+                ]
+              }, undefined, true, undefined, this),
+              canEditSettings && settings.fields.map((field) => /* @__PURE__ */ jsx_dev_runtime7.jsxDEV(SettingRow, {
+                busy: busy === `setting:${field.name}`,
+                field,
+                isSet: Object.prototype.hasOwnProperty.call(settings.current, field.name),
+                onSave: saveSetting(field.name),
+                value: settings.current[field.name]
+              }, field.name, false, undefined, this))
+            ]
+          }, undefined, true, undefined, this),
           /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("section", {
             className: "section",
             children: [
@@ -35066,17 +35742,26 @@ var AuthPanel = ({ state }) => {
             ]
           }, undefined, true, undefined, this)
         ]
+      }, undefined, true, undefined, this),
+      notice && /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("div", {
+        className: `toast ${notice.kind}`,
+        children: [
+          /* @__PURE__ */ jsx_dev_runtime7.jsxDEV("b", {
+            children: notice.kind === "ok" ? "\u2713" : "\u2715"
+          }, undefined, false, undefined, this),
+          notice.text
+        ]
       }, undefined, true, undefined, this)
     ]
   }, undefined, true, undefined, this);
 };
 
 // src/cli/config/packageJson/PackageJsonPanel.tsx
-var import_react7 = __toESM(require_react(), 1);
+var import_react8 = __toESM(require_react(), 1);
 var jsx_dev_runtime8 = __toESM(require_jsx_dev_runtime(), 1);
 var matchesQuery5 = (query, text) => query === "" || text.toLowerCase().includes(query.toLowerCase());
 var FieldRow2 = ({ field, isSet, onSave, value }) => {
-  const [draft, setDraft] = import_react7.useState(value);
+  const [draft, setDraft] = import_react8.useState(value);
   return /* @__PURE__ */ jsx_dev_runtime8.jsxDEV("div", {
     className: "rule fe-block",
     children: [
@@ -35127,7 +35812,7 @@ var FieldRow2 = ({ field, isSet, onSave, value }) => {
   }, undefined, true, undefined, this);
 };
 var ScriptRow = ({ onRemove, onSave, script }) => {
-  const [draft, setDraft] = import_react7.useState(script.command);
+  const [draft, setDraft] = import_react8.useState(script.command);
   return /* @__PURE__ */ jsx_dev_runtime8.jsxDEV("div", {
     className: "rule",
     children: /* @__PURE__ */ jsx_dev_runtime8.jsxDEV("div", {
@@ -35172,8 +35857,8 @@ var ScriptRow = ({ onRemove, onSave, script }) => {
   }, undefined, false, undefined, this);
 };
 var AddScript = ({ onAdd }) => {
-  const [name, setName] = import_react7.useState("");
-  const [command, setCommand] = import_react7.useState("");
+  const [name, setName] = import_react8.useState("");
+  const [command, setCommand] = import_react8.useState("");
   const add = () => {
     if (name.trim() === "")
       return;
@@ -35218,9 +35903,9 @@ var AddScript = ({ onAdd }) => {
   }, undefined, false, undefined, this);
 };
 var PackageJsonPanel = ({ state: initial }) => {
-  const [state, setState] = import_react7.useState(initial);
-  const [query, setQuery] = import_react7.useState("");
-  const [notice, setNotice] = import_react7.useState(null);
+  const [state, setState] = import_react8.useState(initial);
+  const [query, setQuery] = import_react8.useState("");
+  const [notice, setNotice] = import_react8.useState(null);
   const post = async (path, body) => {
     setNotice(null);
     try {
@@ -35509,9 +36194,9 @@ var renderPanel = (panel, data) => {
   return null;
 };
 var PanelHost = ({ panel }) => {
-  const [data, setData] = import_react8.useState(null);
-  const [phase, setPhase] = import_react8.useState("loading");
-  import_react8.useEffect(() => {
+  const [data, setData] = import_react9.useState(null);
+  const [phase, setPhase] = import_react9.useState("loading");
+  import_react9.useEffect(() => {
     let active = true;
     setPhase("loading");
     fetch(ENDPOINTS[panel]).then((response) => response.json()).then((result) => {
@@ -37922,15 +38607,20 @@ var packageOps = () => Promise.all([
   Promise.resolve().then(() => (init_resolvePackageJson(), exports_resolvePackageJson))
 ]);
 var authOps = () => Promise.resolve().then(() => (init_resolveAuthState(), exports_resolveAuthState));
+var authEditOps = () => Promise.all([
+  Promise.resolve().then(() => (init_editAuthConfig(), exports_editAuthConfig)),
+  Promise.resolve().then(() => (init_resolveAuthSettings(), exports_resolveAuthSettings))
+]);
+var scaffoldOps = () => Promise.resolve().then(() => (init_scaffoldAuthFeature(), exports_scaffoldAuthFeature));
 var integrationsOps = () => Promise.resolve().then(() => (init_addPlugin(), exports_addPlugin));
 var CLIENT_ROUTE = "/config-client.js";
 var readVersion = () => {
   for (const candidate of [
-    resolve10(import.meta.dir, "..", "..", "..", "package.json"),
-    resolve10(import.meta.dir, "..", "..", "..", "..", "package.json")
+    resolve12(import.meta.dir, "..", "..", "..", "package.json"),
+    resolve12(import.meta.dir, "..", "..", "..", "..", "package.json")
   ]) {
     try {
-      const pkg = JSON.parse(readFileSync16(candidate, "utf-8"));
+      const pkg = JSON.parse(readFileSync18(candidate, "utf-8"));
       if (typeof pkg?.version === "string")
         return pkg.version;
     } catch {}
@@ -37952,8 +38642,8 @@ var resolvePort = (args) => {
 };
 var resolveHost = (args) => flagValue(args, "--host") || process.env.ABSOLUTE_CONFIG_HOST || CONFIG_DEFAULT_HOST;
 var fileScopeOf = (query) => typeof query.file === "string" ? query.file : undefined;
-var distClientBundle = resolve10(import.meta.dir, "client.js");
-var sourceClientEntry = resolve10(import.meta.dir, "client.tsx");
+var distClientBundle = resolve12(import.meta.dir, "client.js");
+var sourceClientEntry = resolve12(import.meta.dir, "client.tsx");
 var cachedClientBundle = null;
 var buildClientBundle = async () => {
   const built = await Bun.build({
@@ -37974,7 +38664,7 @@ var buildClientBundle = async () => {
 var getClientBundle = async () => {
   if (cachedClientBundle !== null)
     return cachedClientBundle;
-  cachedClientBundle = existsSync12(distClientBundle) ? readFileSync16(distClientBundle, "utf-8") : await buildClientBundle();
+  cachedClientBundle = existsSync14(distClientBundle) ? readFileSync18(distClientBundle, "utf-8") : await buildClientBundle();
   return cachedClientBundle;
 };
 var renderShell = (panel) => handleReactPageRequest({
@@ -38139,6 +38829,54 @@ var handleIntegrationAdd = async (cwd, body, override) => {
   }
   return addIntegration2(cwd, body.id, { install: true, override });
 };
+var parseAuthEdit = (body) => {
+  if (!isRecord(body) || typeof body.name !== "string")
+    return null;
+  const request = {
+    name: body.name,
+    remove: body.remove === true,
+    value: body.value
+  };
+  return request;
+};
+var handleAuthEdit = async (cwd, body) => {
+  const [{ applyAuthConfigEdit: applyAuthConfigEdit2 }, { findAuthSettingsPath: findAuthSettingsPath2 }] = await authEditOps();
+  const { resolveAuthState: resolveAuthState2 } = await authOps();
+  const request = parseAuthEdit(body);
+  const configPath = findAuthSettingsPath2(cwd);
+  if (!request || !configPath) {
+    const invalid = {
+      message: configPath ? "Invalid edit request." : "No auth.config.ts found \u2014 create one with defineAuthSettings({}).",
+      ok: false,
+      state: null
+    };
+    return new Response(JSON.stringify(invalid), {
+      headers: { "Content-Type": "application/json" },
+      status: HTTP_STATUS_BAD_REQUEST
+    });
+  }
+  const outcome = applyAuthConfigEdit2(configPath, request);
+  const result = {
+    message: outcome.message,
+    ok: outcome.ok,
+    state: outcome.ok ? resolveAuthState2(cwd) : null
+  };
+  return result;
+};
+var handleAuthScaffold = async (cwd, body) => {
+  const { scaffoldAuthFeature: scaffoldAuthFeature2 } = await scaffoldOps();
+  if (!isRecord(body) || typeof body.id !== "string") {
+    const invalid = {
+      created: null,
+      installed: false,
+      message: "Missing auth feature id.",
+      ok: false,
+      spreadSnippet: null
+    };
+    return invalid;
+  }
+  return scaffoldAuthFeature2(cwd, body.id, { install: true });
+};
 var packageError = (message) => {
   const invalid = { message, ok: false, state: null };
   return new Response(JSON.stringify(invalid), {
@@ -38223,7 +38961,7 @@ var launchConfig = async (args, cwd = process.cwd()) => {
   }).post("/api/integrations/add", ({ body }) => handleIntegrationAdd(cwd, body, configOverride)).get("/api/auth", async () => {
     const { resolveAuthState: resolveAuthState2 } = await authOps();
     return resolveAuthState2(cwd);
-  }).get("/api/package", async () => {
+  }).post("/api/auth", ({ body }) => handleAuthEdit(cwd, body)).post("/api/auth/scaffold", ({ body }) => handleAuthScaffold(cwd, body)).get("/api/package", async () => {
     const [, { resolvePackageJsonState: resolvePackageJsonState2 }] = await packageOps();
     return resolvePackageJsonState2(cwd);
   }).post("/api/package/script", ({ body }) => handleScriptEdit(cwd, body)).post("/api/package/field", ({ body }) => handleFieldEdit(cwd, body)).listen(listenOptions(port, cert));