@authup/server-auth-console 1.0.0-beta.64 → 1.0.0-beta.65

package/README.md

@@ -0,0 +1,76 @@
+# @authup/server-auth-console
+
+[![npm version](https://badge.fury.io/js/@authup%2Fserver-auth-console.svg)](https://badge.fury.io/js/@authup%2Fserver-auth-console)
+[![main](https://github.com/authup/authup/actions/workflows/main.yml/badge.svg)](https://github.com/authup/authup/actions/workflows/main.yml)
+[![Known Vulnerabilities](https://snyk.io/test/github/authup/authup/badge.svg)](https://snyk.io/test/github/authup/authup)
+
+The service behind authup's hosted auth pages: `/authorize` (login and
+consent), `/register`, `/activate`, `/password-forgot`, `/password-reset` and
+`/logout`. A server-core page GET redirects here carrying the request's own
+query, so the authorization request is what identifies the flow.
+
+It renders `@authup/client-auth-console` through that package's own render
+contract, resolved out of `node_modules`: the SSR bundle per request with the
+hydration payload spliced into the template, the bundle's client assets under
+its own `/assets`, plus the operator theme and the security headers a login
+page needs.
+
+It hydrates ANONYMOUSLY over HTTP and holds no credential, no database and no
+loopback: `/authorize` from `GET /authorize/info`, the four workflow pages from
+`GET /` plus their own query, and `/logout` from nothing at all, since that page
+drives the end-session call itself. Substituting a package that fulfills the
+render contract is the supported way to replace the hosted auth UI.
+
+## Usage
+
+`authup start console auth` is the supported route: the `authup` CLI reads
+`authup.yml` and hands this service its own section. `authup start` composes it
+onto server-core's own listener instead, which is the single-origin deployment.
+
+The `authup-auth-console` bin is the standalone escape hatch, for a deployment
+that runs a console without the CLI. It reads the environment alone.
+
+```bash
+PUBLIC_URL=https://example.com AUTH_CONSOLE_PORT=3020 authup-auth-console
+```
+
+```typescript
+import { createApplication } from '@authup/server-auth-console';
+
+const application = createApplication();
+
+await application.setup();
+```
+
+`createApplication()` builds this console's own module graph, resolves its
+configuration and listens. Pass `{ listen: false }` to be mounted on someone
+else's listener, or `{ config }` to hand over a configuration.
+
+## Configuration
+
+Keys are declared once in `@authup/server-config`; this service selects the ones
+it reads. Its own section is `authConsole`, and it carries no `enabled` key:
+the hosted login, consent and workflow pages are the issuance surface.
+
+| Key | Environment variable | Default |
+|---|---|---|
+| `url` | `AUTH_CONSOLE_URL` | derived from `publicUrl` |
+| `path` | `AUTH_CONSOLE_PATH` | resolve the bundle from `node_modules` |
+| `port` | `AUTH_CONSOLE_PORT` | `3020` |
+| `host` | `AUTH_CONSOLE_HOST` | inherits the deployment-wide `host` |
+
+It is the one console that fetches server-side, so the API address is two keys:
+`publicUrl` (`PUBLIC_URL`) is the browser's and reaches the hydration payload,
+`internalUrl` (`INTERNAL_URL`) is the one this service dispatches against and
+falls back to `publicUrl`. It also reads `theme.directoryPath`
+(`THEME_DIRECTORY_PATH`) and `theme.fragmentsEnabled`
+(`THEME_FRAGMENTS_ENABLED`). `resolveConfig()` and `readConfigFromEnv()` both
+return a `Promise`.
+
+## License
+
+Made with 💚
+
+Published under the [AGPL-3.0-only License](./LICENSE).
+A commercial license is available for organizations that cannot meet the AGPL's conditions.
+See [LICENSING.md](../../LICENSING.md) or contact **contact@tada5hi.net**.

package/dist/{server-Brhsp_x-.mjs → application-YmicGt26.mjs}

@@ -1,6 +1,7 @@
-import { THEME_ASSET_MOUNT_PATH, applyTheme, applyUIPageHeaders, createThemeAssetsHandler, createThemeProvider, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, stampHtmlAttributes } from "@authup/server-console-kit";
+import { THEME_ASSET_MOUNT_PATH, applyTheme, applyUIPageHeaders, createApplication, createThemeAssetsHandler, createThemeProvider, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, stampHtmlAttributes } from "@authup/server-console-kit";
 import { AUTH_CONSOLE_SCHEMA, CORE_SCHEMA, ROOT_SCHEMA, SECTION_KEY, THEME_SCHEMA } from "@authup/server-config";
-import { buildSchemaDefaults, defineSchema, mergeSchemaData, readSchemaFromEnv, resolveSchemaData } from "@authup/server-config-kit";
+import { buildSchemaDefaults, defineSchema, mergeSchemaData, mountSchema, readSchemaFromEnv, resolveSchemaData } from "@authup/server-config-kit";
+import { Container } from "validup";
 import { createHandler } from "@routup/assets";
 import { basic } from "@routup/basic";
 import path from "node:path";
@@ -36,17 +37,20 @@ const CONFIG_SCHEMA = defineSchema({
 	})
 });
 /**
-* Turn the configuration namespace into the service's own shape: fill the
-* defaults, derive the one key that is derived rather than configured, and
-* rename. An empty `url` means the console sits on server-core's own origin
+* Turn the configuration namespace into the service's own shape: validate the
+* input against the declared zod types, fill the defaults, derive the one key
+* that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin
 * under the default segment, which is the single-origin deployment.
 *
 * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
 * would let an input carrying one key of a section replace the whole section
 * and take every other key's default with it.
 */
-function resolveConfig(input) {
-	const values = resolveSchemaData(CONFIG_SCHEMA, mergeSchemaData(CONFIG_SCHEMA, buildSchemaDefaults(CONFIG_SCHEMA), input));
+async function resolveConfig(input) {
+	const validator = new Container();
+	mountSchema(validator, CONFIG_SCHEMA);
+	const parsed = await validator.run(input);
+	const values = resolveSchemaData(CONFIG_SCHEMA, mergeSchemaData(CONFIG_SCHEMA, buildSchemaDefaults(CONFIG_SCHEMA), parsed));
 	return {
 		url: values.url,
 		apiUrl: values.publicUrl,
@@ -62,12 +66,17 @@ function resolveConfig(input) {
 * `authup.yml` reaches this service through the CLI roles, which compose this
 * very registry into the one document loader.
 */
-function readConfigFromEnv() {
+async function readConfigFromEnv() {
 	return resolveConfig(readSchemaFromEnv(CONFIG_SCHEMA));
 }
 //#endregion
 //#region src/constants.ts
 /**
+* The render contract this service compiles against. The literal type fails
+* the build the moment the bundle's constant moves without this one.
+*/
+const CONTRACT_VERSION = 3;
+/**
 * The vite base the auth console bundle is built with. Asset hrefs in the
 * shell are emitted against it, so the service mounts its assets there and
 * rebases them only when the deployment carries a sub-path.
@@ -243,90 +252,81 @@ const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_PATH = path.join(CODE_PATH, "..");
 //#endregion
 //#region src/resolve.ts
-let cachedPackagePath;
-let cachedDistPath;
-let overridePackagePath;
-/**
-* Point the resolution at a substituted package (config `distPath`)
-* instead of the node_modules walk. Called once at boot.
-*/
-function setPackagePath(value) {
-	overridePackagePath = value || void 0;
-	cachedPackagePath = void 0;
-	cachedDistPath = void 0;
-}
 /**
-* Locate the auth console package. The SSR auth workflow UI ships as
-* `@authup/client-auth-console` (a dependency of THIS service), so the
+* Locate the auth console package: a substituted one (config `distPath`)
+* first, else the SSR auth workflow UI shipped as
+* `@authup/client-auth-console` (a dependency of THIS service), which the
 * node_modules ancestor walk from this package's own root (locter's
-* `locateUp`) finds it for the workspace (symlink onto
-* apps/client-auth-console) and for a published install alike. Only a
-* positive result is cached.
+* `locateUp`) finds for the workspace (symlink onto
+* apps/client-auth-console) and for a published install alike.
 *
 * The `cwd` anchor is behavioural, not incidental: it decides which
 * node_modules tree is walked, so it stays pinned to this package rather
 * than to the process cwd.
 */
-function resolvePackagePath() {
-	if (cachedPackagePath) return cachedPackagePath;
-	if (overridePackagePath) {
-		cachedPackagePath = overridePackagePath;
-		return cachedPackagePath;
-	}
-	const manifest = locateUpSync("node_modules/@authup/client-auth-console/package.json", { cwd: PACKAGE_PATH });
-	if (manifest) cachedPackagePath = manifest.directory;
-	return cachedPackagePath;
+function resolvePackagePath(distPath) {
+	return distPath || locateUpSync("node_modules/@authup/client-auth-console/package.json", { cwd: PACKAGE_PATH })?.directory;
 }
 /**
 * Locate the BUILT auth console bundle (`dist/client` template + assets,
-* `dist/server/server.js` render entry). Only a positive result is cached,
-* so a dev building the package after boot is picked up on the next
-* request.
+* `dist/server/server.js` render entry). A half-built package is no bundle:
+* without the render entry there is nothing to render with.
 */
-function resolveDistPath() {
-	if (cachedDistPath) return cachedDistPath;
-	const packagePath = resolvePackagePath();
-	if (packagePath) {
-		const distPath = path.join(packagePath, "dist");
-		if (fs.existsSync(path.join(distPath, "client", "index.html"))) cachedDistPath = distPath;
-	}
-	return cachedDistPath;
+function resolveDistPath(distPath) {
+	const packagePath = resolvePackagePath(distPath);
+	if (!packagePath) return;
+	const candidate = path.join(packagePath, "dist");
+	if (fs.existsSync(path.join(candidate, "client", "index.html")) && fs.existsSync(path.join(candidate, "server", "server.js"))) return candidate;
 }
 //#endregion
 //#region src/render.ts
-let cachedHtml;
-let cachedManifest;
-let cachedRender;
-const renderPage = async (event, config, ctx) => {
-	const distPath = resolveDistPath();
-	if (!distPath) throw new InternalError("The auth console bundle (@authup/client-auth-console) is not built or installed.");
-	const html = cachedHtml ??= await fs.promises.readFile(path.join(distPath, "client", "index.html"), "utf-8");
-	const manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(distPath, "client", ".vite", "ssr-manifest.json"), "utf-8"));
-	const render = cachedRender ??= (await read(path.join(distPath, "server", "server.js"))).render;
-	const preferences = readUIClientPreferences(event);
-	const basePath = getURLBasePath(config.url);
-	const payload = {
-		config: {
-			baseURL: config.apiUrl,
-			basePath,
-			colorMode: preferences.colorMode,
-			locale: preferences.locale
-		},
-		data: ctx.data
+/**
+* Refuse a bundle built against another render contract at boot, naming the
+* entry and both versions, instead of failing per request on `/authorize`.
+* A bundle predating the export is version 1. Reads the module itself, which
+* Node's ESM cache then hands the render for free.
+*/
+async function assertRenderContract(distPath) {
+	const entry = path.join(distPath, "server", "server.js");
+	const version = (await read(entry)).CONTRACT_VERSION ?? 1;
+	if (version !== 3) throw new InternalError(`The auth console bundle "${entry}" implements render-contract version ${version}, but this service requires 3. Rebuild it against the current @authup/client-auth-console contract.`);
+}
+function createRenderPage(distPath) {
+	let cachedDistPath;
+	let cachedHtml;
+	let cachedManifest;
+	let cachedRender;
+	return async (event, config, ctx) => {
+		const resolved = cachedDistPath ??= resolveDistPath(distPath);
+		if (!resolved) throw new InternalError("The auth console bundle (@authup/client-auth-console) is not built or installed.");
+		const html = cachedHtml ??= await fs.promises.readFile(path.join(resolved, "client", "index.html"), "utf-8");
+		const manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(resolved, "client", ".vite", "ssr-manifest.json"), "utf-8"));
+		const render = cachedRender ??= (await read(path.join(resolved, "server", "server.js"))).render;
+		const preferences = readUIClientPreferences(event);
+		const basePath = getURLBasePath(config.url);
+		const payload = {
+			config: {
+				baseURL: config.apiUrl,
+				basePath,
+				colorMode: preferences.colorMode,
+				locale: preferences.locale
+			},
+			data: ctx.data
+		};
+		const [appHtml, preloadLinks] = await render({
+			url: ctx.url,
+			manifest,
+			payload
+		});
+		let body = replaceTemplateMarker(html, "<!--preload-links-->", preloadLinks);
+		body = replaceTemplateMarker(body, "<!--app-html-->", appHtml);
+		body = stampHtmlAttributes(body, preferences);
+		body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);
+		body = await applyTheme(body, ctx.theme, basePath);
+		applyUIPageHeaders(event);
+		return body;
 	};
-	const [appHtml, preloadLinks] = await render({
-		url: ctx.url,
-		manifest,
-		payload
-	});
-	let body = replaceTemplateMarker(html, "<!--preload-links-->", preloadLinks);
-	body = replaceTemplateMarker(body, "<!--app-html-->", appHtml);
-	body = stampHtmlAttributes(body, preferences);
-	body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);
-	body = await applyTheme(body, ctx.theme, basePath);
-	applyUIPageHeaders(event);
-	return body;
-};
+}
 //#endregion
 //#region src/handler.ts
 const WORKFLOW_PAGES = [
@@ -357,8 +357,8 @@ const WORKFLOW_PAGES = [
 * proxy, so a service published at `<origin>/console/auth` receives
 * `/authorize`, exactly as server-core received it before the split.
 */
-async function createHandler$1(config, themeProvider, render = renderPage) {
-	setPackagePath(config.distPath);
+async function createHandler$1(config, themeProvider, render) {
+	const renderPage = render ?? createRenderPage(config.distPath);
 	const app = new App();
 	const client = createAPIClient(config);
 	const readFeatures = createFeaturesReader(client);
@@ -376,7 +376,7 @@ async function createHandler$1(config, themeProvider, render = renderPage) {
 	app.use(defineCoreHandler({
 		method: "get",
 		path: "/authorize",
-		fn: async (event) => render(event, config, {
+		fn: async (event) => renderPage(event, config, {
 			url: "/authorize",
 			data: await readAuthorizeInfo(client, event),
 			theme
@@ -387,7 +387,7 @@ async function createHandler$1(config, themeProvider, render = renderPage) {
 		path: page.url,
 		fn: async (event) => {
 			const features = await readFeatures();
-			return render(event, config, {
+			return renderPage(event, config, {
 				url: page.url,
 				data: buildWorkflowPageData(event, features, page),
 				theme
@@ -397,31 +397,46 @@ async function createHandler$1(config, themeProvider, render = renderPage) {
 	app.use(defineCoreHandler({
 		method: "get",
 		path: "/logout",
-		fn: async (event) => render(event, config, {
+		fn: async (event) => renderPage(event, config, {
 			url: "/logout",
 			data: {},
 			theme
 		})
 	}));
-	const distPath = resolveDistPath();
-	if (distPath) app.use(ASSETS_PATH, createHandler(path.posix.join(distPath, "client", "assets"), {
-		fallthrough: false,
-		scan: false
-	}));
+	const distPath = resolveDistPath(config.distPath);
+	if (distPath) {
+		if (!render) await assertRenderContract(distPath);
+		app.use(ASSETS_PATH, createHandler(path.posix.join(distPath, "client", "assets"), {
+			fallthrough: false,
+			scan: false,
+			cacheMaxAge: 31536e3,
+			cacheImmutable: true
+		}));
+	}
 	return app;
 }
 //#endregion
-//#region src/server.ts
+//#region src/application.ts
 /**
-* The standalone service: the same handler the CLI mounts in process,
-* behind a listener of its own.
+* This console as a runnable service: its own module graph, its own
+* container, its own lifecycle, and nothing of server-core's. It is what
+* `authup start console` starts, what the `authup-auth-console` bin starts, and what
+* `authup start` composes onto its own listener, so no caller reaches past
+* the graph for a bare handler.
+*
+* `config` defaults to a FACTORY, not a value: resolving it reads the
+* document, and a console started alongside others must not do that at
+* construction time, before the caller has said where to look. Pass
+* `listen: false` to be mounted on someone else's listener.
 */
-async function createServer(config) {
-	const app = new App();
-	app.use(await createHandler$1(config));
-	return app;
+function createApplication$1(context = {}) {
+	return createApplication({
+		listen: context.listen,
+		config: context.config ?? readConfigFromEnv,
+		createHandler: (resolved, theme) => createHandler$1(resolved, theme)
+	});
 }
 //#endregion
-export { CONFIG_SCHEMA as _, resolvePackagePath as a, createAPIClient as c, sanitizeRelativeRedirect as d, ASSETS_PATH as f, VITE_BASE as g, PAGES as h, resolveDistPath as i, createFeaturesReader as l, HEALTH_PATH as m, createHandler$1 as n, setPackagePath as o, BASE_PATH as p, renderPage as r, buildWorkflowPageData as s, createServer as t, readAuthorizeInfo as u, readConfigFromEnv as v, resolveConfig as y };
+export { VITE_BASE as _, resolveDistPath as a, resolveConfig as b, createAPIClient as c, sanitizeRelativeRedirect as d, ASSETS_PATH as f, PAGES as g, HEALTH_PATH as h, createRenderPage as i, createFeaturesReader as l, CONTRACT_VERSION as m, createHandler$1 as n, resolvePackagePath as o, BASE_PATH as p, assertRenderContract as r, buildWorkflowPageData as s, createApplication$1 as t, readAuthorizeInfo as u, CONFIG_SCHEMA as v, readConfigFromEnv as y };
 
-//# sourceMappingURL=server-Brhsp_x-.mjs.map
+//# sourceMappingURL=application-YmicGt26.mjs.map

package/dist/application-YmicGt26.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-YmicGt26.mjs","names":["createHandler","createAssetsHandler","createApplication","createConsoleApplication","createHandler"],"sources":["../src/config.ts","../src/constants.ts","../src/redirect.ts","../src/payload.ts","../src/path.ts","../src/resolve.ts","../src/render.ts","../src/handler.ts","../src/application.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AUTH_CONSOLE_SCHEMA,\n    CORE_SCHEMA,\n    ROOT_SCHEMA,\n    SECTION_KEY,\n    THEME_SCHEMA,\n} from '@authup/server-config';\nimport {\n    buildSchemaDefaults,\n    defineSchema,\n    mergeSchemaData,\n    mountSchema,\n    readSchemaFromEnv,\n    resolveSchemaData,\n} from '@authup/server-config-kit';\nimport { Container } from 'validup';\nimport type { CoreConfig, EnvironmentVariable } from '@authup/server-config';\nimport type { Config, ConfigInput } from './types';\n\n/**\n * The keys this service reads, SELECTED out of the document schema by name.\n *\n * Nothing is declared here: every key of `authup.yml` is declared once in\n * `@authup/server-config`, so this service cannot spell a path, an\n * environment variable, a default or a reader differently from server-core,\n * which reads several of the same keys. Neither package depends on the other;\n * both depend on the declaration.\n *\n * Its own section is spread, so this service reads it in its own vocabulary\n * (`url`, `port`, `host`); every other section stays under the key the\n * document nests it at.\n */\nexport const CONFIG_SCHEMA = defineSchema<ConfigInput, 'publicUrl' | 'internalUrl' | 'db'>({\n    ...AUTH_CONSOLE_SCHEMA,\n    ...ROOT_SCHEMA,\n    [SECTION_KEY.THEME]: THEME_SCHEMA,\n    // Two keys of core, never the section. `publicUrl` derives from\n    // the core listener address, which is what a console needs; selecting the\n    // whole section also selects its INVARIANTS, and `resolveSchemaData` runs\n    // every resolver in a registry -- so a console would refuse to start on a\n    // short SECRETS_ENCRYPTION_KEY, or on mfaRequired without mfaEnabled, for\n    // keys it has no database, key store or MFA to use.\n    [SECTION_KEY.CORE]: defineSchema<Pick<CoreConfig, 'host' | 'port'>, never, EnvironmentVariable>({\n        host: CORE_SCHEMA.host,\n        port: CORE_SCHEMA.port,\n    }),\n});\n\n/**\n * Turn the configuration namespace into the service's own shape: validate the\n * input against the declared zod types, fill the defaults, derive the one key\n * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin\n * under the default segment, which is the single-origin deployment.\n *\n * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread\n * would let an input carrying one key of a section replace the whole section\n * and take every other key's default with it.\n */\nexport async function resolveConfig(\n    input: Partial<ConfigInput>,\n) : Promise<Config> {\n    const validator = new Container<ConfigInput>();\n    mountSchema(validator, CONFIG_SCHEMA);\n\n    const parsed = await validator.run(input);\n\n    const values = resolveSchemaData<ConfigInput>(\n        CONFIG_SCHEMA,\n        mergeSchemaData<ConfigInput>(\n            CONFIG_SCHEMA,\n            buildSchemaDefaults<ConfigInput>(CONFIG_SCHEMA),\n            parsed,\n        ),\n    ) as ConfigInput;\n\n    return {\n        url: values.url,\n        apiUrl: values.publicUrl,\n        // `internalUrl` falls back to `publicUrl`, so an operator who has one\n        // address for both sides configures nothing. The composed `authup\n        // start` overrides this with its own listen address unless the\n        // document named one.\n        apiInternalUrl: values.internalUrl,\n        port: values.port,\n        host: values.host,\n        distPath: values.path,\n        theme: values.theme,\n    };\n}\n\n/**\n * The standalone entry's configuration, read from the environment alone.\n * `authup.yml` reaches this service through the CLI roles, which compose this\n * very registry into the one document loader.\n */\nexport async function readConfigFromEnv() : Promise<Config> {\n    // The explicit type argument is load-bearing: inferred from the schema\n    // object, a key declared without a default (the derived publicUrl) comes\n    // back as unknown.\n    const input : Partial<ConfigInput> = readSchemaFromEnv<ConfigInput>(CONFIG_SCHEMA);\n\n    return resolveConfig(input);\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { CONTRACT_VERSION as BundleContractVersion } from '@authup/client-auth-console';\n\n/**\n * The render contract this service compiles against. The literal type fails\n * the build the moment the bundle's constant moves without this one.\n */\nexport const CONTRACT_VERSION : typeof BundleContractVersion = 3;\n\n/**\n * The vite base the auth console bundle is built with. Asset hrefs in the\n * shell are emitted against it, so the service mounts its assets there and\n * rebases them only when the deployment carries a sub-path.\n */\nexport const VITE_BASE = '/console/auth/';\n\n/**\n * The path the service is served under by default, i.e. the path component\n * of `authConsole.url`. It is the same segment server-core mounted\n * the assets at before the split, so a built bundle needs no rebuild.\n */\nexport const BASE_PATH = '/console/auth';\n\n/**\n * The pages the service renders. Each is a route of the console bundle's\n * own router, and each is what a server-core page GET now redirects to.\n */\nexport const PAGES = [\n    '/authorize',\n    '/register',\n    '/activate',\n    '/password-forgot',\n    '/password-reset',\n    '/logout',\n] as const;\n\n/**\n * Where this service mounts the bundle's `assets/` directory. The public\n * asset URL is the service's own public path plus this route, which is what\n * the bundle's fixed vite base is rebased onto.\n */\nexport const ASSETS_PATH = '/assets';\n\nexport const HEALTH_PATH = '/healthy';\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { AuthorizeInfo, StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport { Client } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from './redirect';\nimport type { Config } from './types';\n\n/**\n * The service hydrates ANONYMOUSLY. It holds no credential of its own and\n * asks server-core only for what an unauthenticated visitor may see, which\n * is the whole of what these pages render.\n *\n * It dispatches against `apiInternalUrl`, never the browser-facing `apiUrl`:\n * this is a server-side call, so it must not depend on the public address\n * resolving from inside the deployment. Unlike server-core's own internal\n * client the swap is on `baseURL` rather than at the transport layer,\n * because nothing derived from it reaches a caller -- there is no\n * `redirect_uri` here to be compared byte for byte later.\n */\nexport function createAPIClient(config: Config) : Client {\n    return new Client({ baseURL: config.apiInternalUrl });\n}\n\n/**\n * Report an outbound failure to the operator and raise one the visitor may\n * see, which is deliberately not the same error.\n *\n * hapic embeds the resolved request URL in its message, and this service has\n * no error middleware: routup answers with `event.error.message` verbatim, on\n * the public login page. That URL is `apiInternalUrl`, which on a split\n * deployment names a service on the operator's own network, so an API that is\n * merely down would publish its internal address to every anonymous visitor.\n * It was harmless while the value was `publicUrl`, an address the browser\n * already had.\n *\n * The rule and the remedy are server-core's own (`sanitizeError` /\n * `describeError`): the caller gets a message it can act on, the detail goes\n * to the log. `console.error` rather than a logger because a console handler\n * is built from a config alone and is given none -- and because this line is\n * the only trace such a failure leaves, which is how #3550 was diagnosed in\n * the first place.\n */\nfunction failWithoutAddress(error: unknown) : never {\n    // eslint-disable-next-line no-console\n    console.error('[authup] the auth console could not reach the API:', error);\n\n    throw new Error('The identity provider could not be reached.');\n}\n\n/**\n * The feature flags every workflow page gates its form on. A page that\n * cannot reach them must not silently claim a workflow is disabled, so the\n * failure propagates rather than defaulting to false.\n *\n * Read ONCE and held for the reader's lifetime, the same shape render.ts\n * keeps for the dist template, manifest and render entry: `GET /` reports\n * the version and the boot-config feature flags, none of which changes\n * without a restart, so a TTL would be a number with nothing behind it.\n * Without it every workflow page render is an API call, and under the\n * composed `authup start` those all arrive over loopback on one shared\n * rate-limit key. Only a SUCCESS is held, so an API that was down at the\n * first render is retried rather than remembered as broken.\n *\n * The cache is instance-scoped rather than module-scoped (098 C4): the\n * answer depends on which API the client was built against, so two handlers\n * in one process must not share one, and a module slot would additionally\n * leak between test cases.\n */\nexport function createFeaturesReader(client: Client) : () => Promise<StatusResponseFeatures> {\n    let cached : StatusResponseFeatures | undefined;\n    let pending : Promise<StatusResponseFeatures> | undefined;\n\n    return () => {\n        if (cached) {\n            return Promise.resolve(cached);\n        }\n\n        if (pending) {\n            return pending;\n        }\n\n        pending = client.status.get()\n            .then((status: StatusResponse) => {\n                cached = status.features;\n\n                return cached;\n            })\n            .catch((e) => failWithoutAddress(e));\n\n        const clear = () => {\n            pending = undefined;\n        };\n        pending.then(clear, clear);\n\n        return pending;\n    };\n}\n\n/**\n * The `/authorize` render input, resolved by server-core (plan 101 D2-1).\n * The browser's query is forwarded verbatim: the answer is derived from all\n * of it, the `provider` hint and the closed `error` marker set included.\n */\nexport async function readAuthorizeInfo(client: Client, event: IAppEvent) : Promise<AuthorizeInfo> {\n    const { search } = new URL(event.request.url);\n\n    try {\n        return await client.authorize.getInfo(search);\n    } catch (e) {\n        return failWithoutAddress(e);\n    }\n}\n\nexport type WorkflowPageOptions = {\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * The payload the four workflow pages render from: the feature flags plus\n * the handful of query params each one declares. Unchanged from the\n * assembly server-core did before the split, including the open-redirect\n * guard on `redirect`.\n */\nexport function buildWorkflowPageData(\n    event: IAppEvent,\n    features: StatusResponseFeatures,\n    options: WorkflowPageOptions = {},\n) : Record<string, any> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return data;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from './path';\n\n/**\n * Locate the auth console package: a substituted one (config `distPath`)\n * first, else the SSR auth workflow UI shipped as\n * `@authup/client-auth-console` (a dependency of THIS service), which the\n * node_modules ancestor walk from this package's own root (locter's\n * `locateUp`) finds for the workspace (symlink onto\n * apps/client-auth-console) and for a published install alike.\n *\n * The `cwd` anchor is behavioural, not incidental: it decides which\n * node_modules tree is walked, so it stays pinned to this package rather\n * than to the process cwd.\n */\nexport function resolvePackagePath(distPath?: string) : string | undefined {\n    return distPath || locateUpSync(\n        'node_modules/@authup/client-auth-console/package.json',\n        { cwd: PACKAGE_PATH },\n    )?.directory;\n}\n\n/**\n * Locate the BUILT auth console bundle (`dist/client` template + assets,\n * `dist/server/server.js` render entry). A half-built package is no bundle:\n * without the render entry there is nothing to render with.\n */\nexport function resolveDistPath(distPath?: string) : string | undefined {\n    const packagePath = resolvePackagePath(distPath);\n    if (!packagePath) {\n        return undefined;\n    }\n\n    const candidate = path.join(packagePath, 'dist');\n    if (\n        fs.existsSync(path.join(candidate, 'client', 'index.html')) &&\n        fs.existsSync(path.join(candidate, 'server', 'server.js'))\n    ) {\n        return candidate;\n    }\n\n    return undefined;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { HydrationPayload, RenderFunction } from '@authup/client-auth-console';\nimport { InternalError } from '@authup/errors';\nimport { getURLBasePath } from '@authup/kit';\nimport {\n    applyTheme,\n    applyUIPageHeaders,\n    readUIClientPreferences,\n    rebaseAssetURLs,\n    replaceTemplateMarker,\n    stampHtmlAttributes,\n} from '@authup/server-console-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { CONTRACT_VERSION, VITE_BASE } from './constants';\nimport { resolveDistPath } from './resolve';\nimport type { RenderPage } from './types';\n\n/**\n * Refuse a bundle built against another render contract at boot, naming the\n * entry and both versions, instead of failing per request on `/authorize`.\n * A bundle predating the export is version 1. Reads the module itself, which\n * Node's ESM cache then hands the render for free.\n */\nexport async function assertRenderContract(distPath: string) : Promise<void> {\n    const entry = path.join(distPath, 'server', 'server.js');\n    const bundle = await read(entry) as Record<string, any>;\n    const version = bundle.CONTRACT_VERSION ?? 1;\n\n    if (version !== CONTRACT_VERSION) {\n        throw new InternalError(\n            `The auth console bundle \"${entry}\" implements render-contract version ${version}, ` +\n            `but this service requires ${CONTRACT_VERSION}. ` +\n            'Rebuild it against the current @authup/client-auth-console contract.',\n        );\n    }\n}\n\nexport function createRenderPage(distPath?: string) : RenderPage {\n    // Per-handler caches for the immutable production SSR assets: the dist\n    // template, manifest and server bundle do not change after boot, so read\n    // them once instead of per request (the auth/login routes are hot paths).\n    // Held in this closure rather than at module scope so a second handler in\n    // the process, with a substituted package, never renders another's\n    // template. Only a resolved dist is kept, so a bundle built after boot is\n    // picked up on the next request.\n    let cachedDistPath: string | undefined;\n    let cachedHtml: string | undefined;\n    let cachedManifest: Record<string, any> | undefined;\n    let cachedRender: RenderFunction | undefined;\n\n    return async (event, config, ctx) => {\n        const resolved = (cachedDistPath ??= resolveDistPath(distPath));\n        if (!resolved) {\n            throw new InternalError(\n                'The auth console bundle (@authup/client-auth-console) is not built or installed.',\n            );\n        }\n\n        const html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(resolved, 'client', 'index.html'),\n            'utf-8',\n        ));\n        const manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(resolved, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        const render = (cachedRender ??= (await read(\n            path.join(resolved, 'server', 'server.js'),\n        )).render as RenderFunction);\n\n        // The client app hydrates locale + color-mode from the payload, so it\n        // adopts the same values the HTML shell is stamped with below.\n        const preferences = readUIClientPreferences(event);\n\n        // `baseURL` is server-core's public URL: the console derives its HTTP\n        // client and its cookie path from it. `basePath` is where THIS service\n        // is served, which is what the router and every inter-page href need.\n        // Before the split the two were the same value; they are not any more,\n        // so the console reads them separately.\n        const basePath = getURLBasePath(config.url);\n\n        const payload : HydrationPayload = {\n            config: {\n                baseURL: config.apiUrl,\n                basePath,\n                colorMode: preferences.colorMode,\n                locale: preferences.locale,\n            },\n            data: ctx.data,\n        };\n\n        const [appHtml, preloadLinks] = await render({\n            url: ctx.url,\n            manifest,\n            payload,\n        });\n\n        let body = replaceTemplateMarker(html, '<!--preload-links-->', preloadLinks);\n        body = replaceTemplateMarker(body, '<!--app-html-->', appHtml);\n\n        body = stampHtmlAttributes(body, preferences);\n\n        // This service mounts the bundle's assets at its own /assets, so the\n        // fixed vite base in every href is replaced by this service's public\n        // path. The vite base was decided when the bundle was built and says\n        // nothing about where the service is published.\n        body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);\n\n        // The theme's own asset urls are built from the same base, and the\n        // service mounts them under it, so a themed deployment needs no rule of\n        // its own at the reverse proxy beyond the one that reaches this service.\n        body = await applyTheme(body, ctx.theme, basePath);\n\n        applyUIPageHeaders(event);\n\n        return body;\n    };\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IThemeProvider } from '@authup/server-console-kit';\nimport {\n    THEME_ASSET_MOUNT_PATH,\n    createThemeAssetsHandler,\n    createThemeProvider,\n} from '@authup/server-console-kit';\nimport { createHandler as createAssetsHandler } from '@routup/assets';\nimport { basic } from '@routup/basic';\nimport path from 'node:path';\nimport type { IApp } from 'routup';\nimport { App, defineCoreHandler } from 'routup';\nimport { ASSETS_PATH, HEALTH_PATH } from './constants';\nimport {\n    buildWorkflowPageData,\n    createAPIClient,\n    createFeaturesReader,\n    readAuthorizeInfo,\n} from './payload';\nimport { assertRenderContract, createRenderPage } from './render';\nimport { resolveDistPath } from './resolve';\nimport type { Config, RenderPage } from './types';\n\nconst WORKFLOW_PAGES : {\n    url: string,\n    realmAware?: boolean,\n    tokenAware?: boolean\n}[] = [\n    { url: '/register', realmAware: true },\n    { url: '/activate', tokenAware: true },\n    { url: '/password-forgot', realmAware: true },\n    {\n        url: '/password-reset',\n        realmAware: true,\n        tokenAware: true,\n    },\n];\n\n/**\n * The service as a mountable routup handler, so the CLI can compose it onto\n * server-core's own listener for the single-container deployment while a\n * split deployment runs it behind its own server.\n *\n * The paths are prefix-free. authup assumes a prefix-stripping reverse\n * proxy, so a service published at `<origin>/console/auth` receives\n * `/authorize`, exactly as server-core received it before the split.\n */\nexport async function createHandler(\n    config: Config,\n    themeProvider?: IThemeProvider,\n    render?: RenderPage,\n) : Promise<IApp> {\n    const renderPage = render ?? createRenderPage(config.distPath);\n\n    const app = new App();\n    const client = createAPIClient(config);\n    const readFeatures = createFeaturesReader(client);\n\n    // The shell is stamped from the vc-locale / vc-color-mode cookies, and\n    // without the plugin every cookie read answers undefined, which is a\n    // silent flash of the wrong color mode on every full load. server-core\n    // registers it globally, so a mounted handler inherits one; a standalone\n    // service has nothing above it.\n    app.use(basic({ cookie: true, query: true }));\n\n    // A missing directory disables theming entirely: no provider is created\n    // and the rendered pages are byte-identical to the un-themed ones, so the\n    // default configuration pays nothing. An invalid manifest throws here and\n    // fails the boot rather than surfacing per request.\n    // Injected by the theme module when this runs inside the console\n    // application; built here for a caller holding only a config.\n    const theme = themeProvider ?? await createThemeProvider(config);\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: HEALTH_PATH,\n        fn: () => ({ status: 'ok' }),\n    }));\n\n    if (theme) {\n        app.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(theme));\n    }\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/authorize',\n        fn: async (event) => renderPage(event, config, {\n            url: '/authorize',\n            data: await readAuthorizeInfo(client, event),\n            theme,\n        }),\n    }));\n\n    for (const page of WORKFLOW_PAGES) {\n        app.use(defineCoreHandler({\n            method: 'get',\n            path: page.url,\n            fn: async (event) => {\n                const features = await readFeatures();\n\n                return renderPage(event, config, {\n                    url: page.url,\n                    data: buildWorkflowPageData(event, features, page),\n                    theme,\n                });\n            },\n        }));\n    }\n\n    // The logout page needs nothing resolved up front: it drives the\n    // end-session call itself and renders from the answer, so the render\n    // stays a pure shell and no request reaches server-core here.\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/logout',\n        fn: async (event) => renderPage(event, config, {\n            url: '/logout',\n            data: {},\n            theme,\n        }),\n    }));\n\n    // Only the assets directory is mounted, never dist/client itself: the\n    // template and the ssr manifest are inputs of the render, not files to\n    // serve. A missing bundle only disables the mount; the page routes\n    // report the actionable error. A resolved one is checked against the\n    // render contract here, unless a substituted render never reads it.\n    const distPath = resolveDistPath(config.distPath);\n    if (distPath) {\n        if (!render) {\n            await assertRenderContract(distPath);\n        }\n\n        // Every name carries a content hash, so a new build means new names.\n        app.use(ASSETS_PATH, createAssetsHandler(\n            path.posix.join(distPath, 'client', 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n                cacheMaxAge: 60 * 60 * 24 * 365,\n                cacheImmutable: true,\n            },\n        ));\n    }\n\n    return app;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createApplication as createConsoleApplication } from '@authup/server-console-kit';\nimport type { CreateApplicationContext } from '@authup/server-console-kit';\nimport type { Application } from 'orkos';\nimport { readConfigFromEnv } from './config';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * This console as a runnable service: its own module graph, its own\n * container, its own lifecycle, and nothing of server-core's. It is what\n * `authup start console` starts, what the `authup-auth-console` bin starts, and what\n * `authup start` composes onto its own listener, so no caller reaches past\n * the graph for a bare handler.\n *\n * `config` defaults to a FACTORY, not a value: resolving it reads the\n * document, and a console started alongside others must not do that at\n * construction time, before the caller has said where to look. Pass\n * `listen: false` to be mounted on someone else's listener.\n */\nexport function createApplication(\n    context: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>> = {},\n) : Application {\n    return createConsoleApplication<Config>({\n        listen: context.listen,\n        config: context.config ?? readConfigFromEnv,\n        createHandler: (resolved, theme) => createHandler(resolved, theme),\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,MAAa,gBAAgB,aAA8D;CACvF,GAAG;CACH,GAAG;EACF,YAAY,QAAQ;EAOpB,YAAY,OAAO,aAA4E;EAC5F,MAAM,YAAY;EAClB,MAAM,YAAY;CACtB,CAAC;AACL,CAAC;;;;;;;;;;;AAYD,eAAsB,cAClB,OACgB;CAChB,MAAM,YAAY,IAAI,UAAuB;CAC7C,YAAY,WAAW,aAAa;CAEpC,MAAM,SAAS,MAAM,UAAU,IAAI,KAAK;CAExC,MAAM,SAAS,kBACX,eACA,gBACI,eACA,oBAAiC,aAAa,GAC9C,MACJ,CACJ;CAEA,OAAO;EACH,KAAK,OAAO;EACZ,QAAQ,OAAO;EAKf,gBAAgB,OAAO;EACvB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,OAAO,OAAO;CAClB;AACJ;;;;;;AAOA,eAAsB,oBAAsC;CAMxD,OAAO,cAF8B,kBAA+B,aAE3C,CAAC;AAC9B;;;;;;;AChGA,MAAa,mBAAkD;;;;;;AAO/D,MAAa,YAAY;;;;;;AAOzB,MAAa,YAAY;;;;;AAMzB,MAAa,QAAQ;CACjB;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;AAOA,MAAa,cAAc;AAE3B,MAAa,cAAc;;;;;;;;;;;;;;;AC9B3B,SAAgB,yBAAyB,OAAoC;CACzE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAC9C;CAMJ,IAAI,wBAAwB,KAAK,KAAK,GAClC;CAGJ,IAAI;CACJ,IAAI;EACA,UAAU,mBAAmB,KAAK;CACtC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwB,KAAK,OAAO,GACpC;CAGJ,KAAK,MAAM,aAAa,CAAC,OAAO,OAAO,GAAG;EACtC,IAAI,CAAC,UAAU,WAAW,GAAG,GACzB;EAEJ,IAAI,UAAU,SAAS,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,OAClE;EAEJ,IAAI,UAAU,SAAS,IAAI,GACvB;CAER;CAEA,OAAO;AACX;;;;;;;;;;;;;;;ACjCA,SAAgB,gBAAgB,QAAyB;CACrD,OAAO,IAAI,OAAO,EAAE,SAAS,OAAO,eAAe,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,mBAAmB,OAAwB;CAEhD,QAAQ,MAAM,sDAAsD,KAAK;CAEzE,MAAM,IAAI,MAAM,6CAA6C;AACjE;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,qBAAqB,QAAwD;CACzF,IAAI;CACJ,IAAI;CAEJ,aAAa;EACT,IAAI,QACA,OAAO,QAAQ,QAAQ,MAAM;EAGjC,IAAI,SACA,OAAO;EAGX,UAAU,OAAO,OAAO,IAAI,CAAC,CACxB,MAAM,WAA2B;GAC9B,SAAS,OAAO;GAEhB,OAAO;EACX,CAAC,CAAC,CACD,OAAO,MAAM,mBAAmB,CAAC,CAAC;EAEvC,MAAM,cAAc;GAChB,UAAU,KAAA;EACd;EACA,QAAQ,KAAK,OAAO,KAAK;EAEzB,OAAO;CACX;AACJ;;;;;;AAOA,eAAsB,kBAAkB,QAAgB,OAA2C;CAC/F,MAAM,EAAE,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;CAE5C,IAAI;EACA,OAAO,MAAM,OAAO,UAAU,QAAQ,MAAM;CAChD,SAAS,GAAG;EACR,OAAO,mBAAmB,CAAC;CAC/B;AACJ;;;;;;;AAgBA,SAAgB,sBACZ,OACA,UACA,UAA+B,CAAC,GACZ;CACpB,MAAM,QAAQ,gBAAgB,KAAK;CAEnC,MAAM,OAA4B;EAC9B;EACA,UAAU,yBAAyB,MAAM,QAAQ;CACrD;CAEA,IAAI,QAAQ,YAAY;EACpB,MAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,MAAM;EAC1E,KAAK,UAAU,OAAO,YAAY,WAAW,UAAU,KAAA;CAC3D;CAEA,IAAI,QAAQ,YACR,KAAK,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,KAAA;CAGjE,OAAO;AACX;;;AClJA,MAAa,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AACpE,MAAa,eAAe,KAAK,KAAK,WAAW,IAAI;;;;;;;;;;;;;;;ACarD,SAAgB,mBAAmB,UAAwC;CACvE,OAAO,YAAY,aACf,yDACA,EAAE,KAAK,aAAa,CACxB,CAAC,EAAE;AACP;;;;;;AAOA,SAAgB,gBAAgB,UAAwC;CACpE,MAAM,cAAc,mBAAmB,QAAQ;CAC/C,IAAI,CAAC,aACD;CAGJ,MAAM,YAAY,KAAK,KAAK,aAAa,MAAM;CAC/C,IACI,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,YAAY,CAAC,KAC1D,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,WAAW,CAAC,GAEzD,OAAO;AAIf;;;;;;;;;ACpBA,eAAsB,qBAAqB,UAAkC;CACzE,MAAM,QAAQ,KAAK,KAAK,UAAU,UAAU,WAAW;CAEvD,MAAM,WAAU,MADK,KAAK,KAAK,EAAA,CACR,oBAAoB;CAE3C,IAAI,YAAA,GACA,MAAM,IAAI,cACN,4BAA4B,MAAM,uCAAuC,QAAQ,oGAGrF;AAER;AAEA,SAAgB,iBAAiB,UAAgC;CAQ7D,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,OAAO,OAAO,OAAO,QAAQ,QAAQ;EACjC,MAAM,WAAY,mBAAmB,gBAAgB,QAAQ;EAC7D,IAAI,CAAC,UACD,MAAM,IAAI,cACN,kFACJ;EAGJ,MAAM,OAAQ,eAAe,MAAM,GAAG,SAAS,SAC3C,KAAK,KAAK,UAAU,UAAU,YAAY,GAC1C,OACJ;EACA,MAAM,WAAY,mBAAmB,KAAK,MAAM,MAAM,GAAG,SAAS,SAC9D,KAAK,KAAK,UAAU,UAAU,SAAS,mBAAmB,GAC1D,OACJ,CAAC;EACD,MAAM,SAAU,kBAAkB,MAAM,KACpC,KAAK,KAAK,UAAU,UAAU,WAAW,CAC7C,EAAA,CAAG;EAIH,MAAM,cAAc,wBAAwB,KAAK;EAOjD,MAAM,WAAW,eAAe,OAAO,GAAG;EAE1C,MAAM,UAA6B;GAC/B,QAAQ;IACJ,SAAS,OAAO;IAChB;IACA,WAAW,YAAY;IACvB,QAAQ,YAAY;GACxB;GACA,MAAM,IAAI;EACd;EAEA,MAAM,CAAC,SAAS,gBAAgB,MAAM,OAAO;GACzC,KAAK,IAAI;GACT;GACA;EACJ,CAAC;EAED,IAAI,OAAO,sBAAsB,MAAM,wBAAwB,YAAY;EAC3E,OAAO,sBAAsB,MAAM,mBAAmB,OAAO;EAE7D,OAAO,oBAAoB,MAAM,WAAW;EAM5C,OAAO,gBAAgB,MAAM,WAAW,GAAG,SAAS,EAAE;EAKtD,OAAO,MAAM,WAAW,MAAM,IAAI,OAAO,QAAQ;EAEjD,mBAAmB,KAAK;EAExB,OAAO;CACX;AACJ;;;AChGA,MAAM,iBAIA;CACF;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAoB,YAAY;CAAK;CAC5C;EACI,KAAK;EACL,YAAY;EACZ,YAAY;CAChB;AACJ;;;;;;;;;;AAWA,eAAsBA,gBAClB,QACA,eACA,QACc;CACd,MAAM,aAAa,UAAU,iBAAiB,OAAO,QAAQ;CAE7D,MAAM,MAAM,IAAI,IAAI;CACpB,MAAM,SAAS,gBAAgB,MAAM;CACrC,MAAM,eAAe,qBAAqB,MAAM;CAOhD,IAAI,IAAI,MAAM;EAAE,QAAQ;EAAM,OAAO;CAAK,CAAC,CAAC;CAQ5C,MAAM,QAAQ,iBAAiB,MAAM,oBAAoB,MAAM;CAE/D,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,WAAW,EAAE,QAAQ,KAAK;CAC9B,CAAC,CAAC;CAEF,IAAI,OACA,IAAI,IAAI,wBAAwB,yBAAyB,KAAK,CAAC;CAGnE,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,MAAM,kBAAkB,QAAQ,KAAK;GAC3C;EACJ,CAAC;CACL,CAAC,CAAC;CAEF,KAAK,MAAM,QAAQ,gBACf,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM,KAAK;EACX,IAAI,OAAO,UAAU;GACjB,MAAM,WAAW,MAAM,aAAa;GAEpC,OAAO,WAAW,OAAO,QAAQ;IAC7B,KAAK,KAAK;IACV,MAAM,sBAAsB,OAAO,UAAU,IAAI;IACjD;GACJ,CAAC;EACL;CACJ,CAAC,CAAC;CAMN,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,CAAC;GACP;EACJ,CAAC;CACL,CAAC,CAAC;CAOF,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,UAAU;EACV,IAAI,CAAC,QACD,MAAM,qBAAqB,QAAQ;EAIvC,IAAI,IAAI,aAAaC,cACjB,KAAK,MAAM,KAAK,UAAU,UAAU,QAAQ,GAC5C;GACI,aAAa;GACb,MAAM;GACN,aAAa;GACb,gBAAgB;EACpB,CACJ,CAAC;CACL;CAEA,OAAO;AACX;;;;;;;;;;;;;;;AC9HA,SAAgBC,oBACZ,UAA4E,CAAC,GACjE;CACZ,OAAOC,kBAAiC;EACpC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,UAAU;EAC1B,gBAAgB,UAAU,UAAUC,gBAAc,UAAU,KAAK;CACrE,CAAC;AACL"}

package/dist/bin.mjs

@@ -1,20 +1,18 @@
 #!/usr/bin/env node
-import { t as createServer, v as readConfigFromEnv } from "./server-Brhsp_x-.mjs";
-import { serve } from "routup/node";
+import { t as createApplication } from "./application-YmicGt26.mjs";
+import process from "node:process";
 //#region src/bin.ts
 /**
-* The standalone entry. It reads the keys this service declares from the
-* environment; `authup.yml` reaches the service through the CLI roles
-* (`authup start console auth`), which hand each factory its own section, and that
-* is also how it is started in practice.
+* The standalone entry: the same application `authup start console auth`
+* starts, configured from the environment alone. `authup.yml` reaches this
+* service through the CLI roles, which hand each factory its own section, and
+* that is also how it is started in practice.
 */
-const config = readConfigFromEnv();
-const app = await createServer(config);
-await serve(app, {
-	port: config.port,
-	hostname: config.host,
-	silent: true
-}).ready();
+const application = createApplication();
+await application.setup();
+const shutdown = () => application.teardown().then(() => process.exit(0), () => process.exit(1));
+process.once("SIGINT", shutdown);
+process.once("SIGTERM", shutdown);
 //#endregion
 export {};
 

package/dist/bin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bin.mjs","names":[],"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\n/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { serve } from 'routup/node';\nimport { readConfigFromEnv } from './config';\nimport { createServer } from './server';\n\n/**\n * The standalone entry. It reads the keys this service declares from the\n * environment; `authup.yml` reaches the service through the CLI roles\n * (`authup start console auth`), which hand each factory its own section, and that\n * is also how it is started in practice.\n */\nconst config = readConfigFromEnv();\nconst app = await createServer(config);\n\nconst server = serve(app, {\n    port: config.port,\n    hostname: config.host,\n    silent: true,\n});\n\nawait server.ready();\n"],"mappings":";;;;;;;;;;AAkBA,MAAM,SAAS,kBAAkB;AACjC,MAAM,MAAM,MAAM,aAAa,MAAM;AAQrC,MANe,MAAM,KAAK;CACtB,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ;AACZ,CAEW,CAAC,CAAC,MAAM"}
+{"version":3,"file":"bin.mjs","names":[],"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\n/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport process from 'node:process';\nimport { createApplication } from './application';\n\n/**\n * The standalone entry: the same application `authup start console auth`\n * starts, configured from the environment alone. `authup.yml` reaches this\n * service through the CLI roles, which hand each factory its own section, and\n * that is also how it is started in practice.\n */\nconst application = createApplication();\nawait application.setup();\n\nconst shutdown = () => application.teardown()\n    .then(() => process.exit(0), () => process.exit(1));\nprocess.once('SIGINT', shutdown);\nprocess.once('SIGTERM', shutdown);\n"],"mappings":";;;;;;;;;;AAiBA,MAAM,cAAc,kBAAkB;AACtC,MAAM,YAAY,MAAM;AAExB,MAAM,iBAAiB,YAAY,SAAS,CAAC,CACxC,WAAW,QAAQ,KAAK,CAAC,SAAS,QAAQ,KAAK,CAAC,CAAC;AACtD,QAAQ,KAAK,UAAU,QAAQ;AAC/B,QAAQ,KAAK,WAAW,QAAQ"}

package/dist/config.d.ts

@@ -18,20 +18,20 @@ export declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<i
     core: Pick<CoreConfig, "host" | "port">;
 } & import("@authup/server-config").AuthConsoleConfig>, "publicUrl" | "internalUrl" | "db", string>;
 /**
- * Turn the configuration namespace into the service's own shape: fill the
- * defaults, derive the one key that is derived rather than configured, and
- * rename. An empty `url` means the console sits on server-core's own origin
+ * Turn the configuration namespace into the service's own shape: validate the
+ * input against the declared zod types, fill the defaults, derive the one key
+ * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin
  * under the default segment, which is the single-origin deployment.
  *
  * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
  * would let an input carrying one key of a section replace the whole section
  * and take every other key's default with it.
  */
-export declare function resolveConfig(input: Partial<ConfigInput>): Config;
+export declare function resolveConfig(input: Partial<ConfigInput>): Promise<Config>;
 /**
  * The standalone entry's configuration, read from the environment alone.
  * `authup.yml` reaches this service through the CLI roles, which compose this
  * very registry into the one document loader.
  */
-export declare function readConfigFromEnv(): Config;
+export declare function readConfigFromEnv(): Promise<Config>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;mGAcxB,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CACzB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAC3B,MAAM,CAuBT;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAK,MAAM,CAO3C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;mGAcxB,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAC/B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAK,OAAO,CAAC,MAAM,CAAC,CAO1D"}

package/dist/constants.d.ts

@@ -1,3 +1,9 @@
+import type { CONTRACT_VERSION as BundleContractVersion } from '@authup/client-auth-console';
+/**
+ * The render contract this service compiles against. The literal type fails
+ * the build the moment the bundle's constant moves without this one.
+ */
+export declare const CONTRACT_VERSION: typeof BundleContractVersion;
 /**
  * The vite base the auth console bundle is built with. Asset hrefs in the
  * shell are emitted against it, so the service mounts its assets there and

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,KAAK,qGAOR,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,eAAO,MAAM,WAAW,aAAa,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE7F;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAG,OAAO,qBAAyB,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,KAAK,qGAOR,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,eAAO,MAAM,WAAW,aAAa,CAAC"}

package/dist/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AASjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAWnC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBlD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,cAAc,EAC9B,MAAM,GAAE,UAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAuFhB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AASjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAWnC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBlD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,cAAc,EAC9B,MAAM,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CA+FhB"}

package/dist/index.d.mts

@@ -3,6 +3,7 @@ import { AuthConsoleConfig, CoreConfig, RootConfig, SECTION_KEY, ThemeConfig, To
 import { App, IApp, IAppEvent } from "routup";
 import { AuthorizeInfo, Client, StatusResponseFeatures } from "@authup/core-http-kit";
 import { Application } from "orkos";
+import { CONTRACT_VERSION as CONTRACT_VERSION$1 } from "@authup/client-auth-console";
 //#region src/types.d.ts
 /**
  * The `authup.yml` NAMESPACE: the sections this service selects keys from.
@@ -13,7 +14,7 @@ import { Application } from "orkos";
  * `distPath` below are this service's names for values the document calls
  * something else, so they belong to {@link Config} alone.
  */
-type ConfigInput = ToObjectLiteral<RootConfig & {
+export type ConfigInput = ToObjectLiteral<RootConfig & {
   [SECTION_KEY.THEME]: ThemeConfig;
   [SECTION_KEY.CORE]: Pick<CoreConfig, 'host' | 'port'>;
 } & AuthConsoleConfig>;
@@ -22,7 +23,7 @@ type ConfigInput = ToObjectLiteral<RootConfig & {
  * and server-core is the external thing it calls, hence `url` for its own
  * address and `apiUrl` for the API's.
  */
-type Config = {
+export type Config = {
   /**
    * The public URL this service is reachable at, e.g.
    * `https://example.com/console/auth`. Its path component becomes the
@@ -67,10 +68,10 @@ type Config = {
 };
 /**
  * How a page becomes a document. The default is this service's own
- * `renderPage`, reading the built bundle; a caller serving the console from
- * source substitutes one that reads through a vite dev server instead.
+ * `createRenderPage`, reading the built bundle; a caller serving the console
+ * from source substitutes one that reads through a vite dev server instead.
  */
-type RenderPage = (event: IAppEvent, config: Config, ctx: {
+export type RenderPage = (event: IAppEvent, config: Config, ctx: {
   url: string;
   data: Record<string, any>;
   theme?: IThemeProvider;
@@ -89,7 +90,7 @@ type RenderPage = (event: IAppEvent, config: Config, ctx: {
  * construction time, before the caller has said where to look. Pass
  * `listen: false` to be mounted on someone else's listener.
  */
-declare function createApplication(context?: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>>): Application;
+export declare function createApplication(context?: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>>): Application;
 //#endregion
 //#region src/config.d.ts
 /**
@@ -105,53 +106,58 @@ declare function createApplication(context?: Partial<Omit<CreateApplicationConte
  * (`url`, `port`, `host`); every other section stays under the key the
  * document nests it at.
  */
-declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<import("@authup/server-config").ToObjectLiteral<import("@authup/server-config").RootConfig & {
+export declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<import("@authup/server-config").ToObjectLiteral<import("@authup/server-config").RootConfig & {
   theme: import("@authup/server-config").ThemeConfig;
   core: Pick<CoreConfig, "host" | "port">;
 } & import("@authup/server-config").AuthConsoleConfig>, "publicUrl" | "internalUrl" | "db", string>;
 /**
- * Turn the configuration namespace into the service's own shape: fill the
- * defaults, derive the one key that is derived rather than configured, and
- * rename. An empty `url` means the console sits on server-core's own origin
+ * Turn the configuration namespace into the service's own shape: validate the
+ * input against the declared zod types, fill the defaults, derive the one key
+ * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin
  * under the default segment, which is the single-origin deployment.
  *
  * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
  * would let an input carrying one key of a section replace the whole section
  * and take every other key's default with it.
  */
-declare function resolveConfig(input: Partial<ConfigInput>): Config;
+export declare function resolveConfig(input: Partial<ConfigInput>): Promise<Config>;
 /**
  * The standalone entry's configuration, read from the environment alone.
  * `authup.yml` reaches this service through the CLI roles, which compose this
  * very registry into the one document loader.
  */
-declare function readConfigFromEnv(): Config;
+export declare function readConfigFromEnv(): Promise<Config>;
 //#endregion
 //#region src/constants.d.ts
+/**
+ * The render contract this service compiles against. The literal type fails
+ * the build the moment the bundle's constant moves without this one.
+ */
+export declare const CONTRACT_VERSION: typeof CONTRACT_VERSION$1;
 /**
  * The vite base the auth console bundle is built with. Asset hrefs in the
  * shell are emitted against it, so the service mounts its assets there and
  * rebases them only when the deployment carries a sub-path.
  */
-declare const VITE_BASE = "/console/auth/";
+export declare const VITE_BASE = "/console/auth/";
 /**
  * The path the service is served under by default, i.e. the path component
  * of `authConsole.url`. It is the same segment server-core mounted
  * the assets at before the split, so a built bundle needs no rebuild.
  */
-declare const BASE_PATH = "/console/auth";
+export declare const BASE_PATH = "/console/auth";
 /**
  * The pages the service renders. Each is a route of the console bundle's
  * own router, and each is what a server-core page GET now redirects to.
  */
-declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
+export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
 /**
  * Where this service mounts the bundle's `assets/` directory. The public
  * asset URL is the service's own public path plus this route, which is what
  * the bundle's fixed vite base is rebased onto.
  */
-declare const ASSETS_PATH = "/assets";
-declare const HEALTH_PATH = "/healthy";
+export declare const ASSETS_PATH = "/assets";
+export declare const HEALTH_PATH = "/healthy";
 //#endregion
 //#region src/handler.d.ts
 /**
@@ -163,7 +169,7 @@ declare const HEALTH_PATH = "/healthy";
  * proxy, so a service published at `<origin>/console/auth` receives
  * `/authorize`, exactly as server-core received it before the split.
  */
-declare function createHandler(config: Config, themeProvider?: IThemeProvider, render?: RenderPage): Promise<IApp>;
+export declare function createHandler(config: Config, themeProvider?: IThemeProvider, render?: RenderPage): Promise<IApp>;
 //#endregion
 //#region src/payload.d.ts
 /**
@@ -178,7 +184,7 @@ declare function createHandler(config: Config, themeProvider?: IThemeProvider, r
  * because nothing derived from it reaches a caller -- there is no
  * `redirect_uri` here to be compared byte for byte later.
  */
-declare function createAPIClient(config: Config): Client;
+export declare function createAPIClient(config: Config): Client;
 /**
  * The feature flags every workflow page gates its form on. A page that
  * cannot reach them must not silently claim a workflow is disabled, so the
@@ -198,14 +204,14 @@ declare function createAPIClient(config: Config): Client;
  * in one process must not share one, and a module slot would additionally
  * leak between test cases.
  */
-declare function createFeaturesReader(client: Client): () => Promise<StatusResponseFeatures>;
+export declare function createFeaturesReader(client: Client): () => Promise<StatusResponseFeatures>;
 /**
  * The `/authorize` render input, resolved by server-core (plan 101 D2-1).
  * The browser's query is forwarded verbatim: the answer is derived from all
  * of it, the `provider` hint and the closed `error` marker set included.
  */
-declare function readAuthorizeInfo(client: Client, event: IAppEvent): Promise<AuthorizeInfo>;
-type WorkflowPageOptions = {
+export declare function readAuthorizeInfo(client: Client, event: IAppEvent): Promise<AuthorizeInfo>;
+export type WorkflowPageOptions = {
   realmAware?: boolean;
   tokenAware?: boolean;
 };
@@ -215,7 +221,7 @@ type WorkflowPageOptions = {
  * assembly server-core did before the split, including the open-redirect
  * guard on `redirect`.
  */
-declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+export declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
 //#endregion
 //#region src/redirect.d.ts
 /**
@@ -230,44 +236,44 @@ declare function buildWorkflowPageData(event: IAppEvent, features: StatusRespons
  * (`javascript:`, `http:`) — both on the raw and once-decoded form so a
  * percent-encoded separator (`%2f`, `%5c`) can't slip past.
  */
-declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
+export declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
 //#endregion
 //#region src/render.d.ts
-declare const renderPage: RenderPage;
-//#endregion
-//#region src/resolve.d.ts
 /**
- * Point the resolution at a substituted package (config `distPath`)
- * instead of the node_modules walk. Called once at boot.
+ * Refuse a bundle built against another render contract at boot, naming the
+ * entry and both versions, instead of failing per request on `/authorize`.
+ * A bundle predating the export is version 1. Reads the module itself, which
+ * Node's ESM cache then hands the render for free.
  */
-declare function setPackagePath(value: string | undefined): void;
+export declare function assertRenderContract(distPath: string): Promise<void>;
+export declare function createRenderPage(distPath?: string): RenderPage;
+//#endregion
+//#region src/resolve.d.ts
 /**
- * Locate the auth console package. The SSR auth workflow UI ships as
- * `@authup/client-auth-console` (a dependency of THIS service), so the
+ * Locate the auth console package: a substituted one (config `distPath`)
+ * first, else the SSR auth workflow UI shipped as
+ * `@authup/client-auth-console` (a dependency of THIS service), which the
  * node_modules ancestor walk from this package's own root (locter's
- * `locateUp`) finds it for the workspace (symlink onto
- * apps/client-auth-console) and for a published install alike. Only a
- * positive result is cached.
+ * `locateUp`) finds for the workspace (symlink onto
+ * apps/client-auth-console) and for a published install alike.
  *
  * The `cwd` anchor is behavioural, not incidental: it decides which
  * node_modules tree is walked, so it stays pinned to this package rather
  * than to the process cwd.
  */
-declare function resolvePackagePath(): string | undefined;
+export declare function resolvePackagePath(distPath?: string): string | undefined;
 /**
  * Locate the BUILT auth console bundle (`dist/client` template + assets,
- * `dist/server/server.js` render entry). Only a positive result is cached,
- * so a dev building the package after boot is picked up on the next
- * request.
+ * `dist/server/server.js` render entry). A half-built package is no bundle:
+ * without the render entry there is nothing to render with.
  */
-declare function resolveDistPath(): string | undefined;
+export declare function resolveDistPath(distPath?: string): string | undefined;
 //#endregion
 //#region src/server.d.ts
 /**
  * The standalone service: the same handler the CLI mounts in process,
  * behind a listener of its own.
  */
-declare function createServer(config: Config): Promise<App>;
+export declare function createServer(config: Config): Promise<App>;
 //#endregion
-export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, Config, ConfigInput, HEALTH_PATH, PAGES, RenderPage, VITE_BASE, WorkflowPageOptions, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createServer, readAuthorizeInfo, readConfigFromEnv, renderPage, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect, setPackagePath };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/application.ts","../src/config.ts","../src/constants.ts","../src/handler.ts","../src/payload.ts","../src/redirect.ts","../src/render.ts","../src/resolve.ts","../src/server.ts"],"mappings":";;;;;;;;;;;;;;;KA2BY,cAAc,gBACtB;GAEK,YAAY,QAAQ;GAEpB,YAAY,OAAO,KAAK;IAE7B;;;;;;KAQQ;;;;;;EAMR;;;;;;;;EAQA;;;;;;;;;;;;;;;EAeA;;;;;EAKA;EACA;;;;;EAKA;EAEA,OAAO;;;;;;;KAQC,cACR,OAAO,WACP,QAAQ,QACR;EACI;EACA,MAAM;EACN,QAAQ;MAEX;;;;;;;;;;;;;;;iBC1EW,kBACZ,UAAS,QAAQ,KAAK,yBAAyB,6BAC/C;;;;;;;;;;;;;;;;cCSS,mDAAa,uCAAA,gDAAA;;QAAb,KAAA;oCAcX;;;;;;;;;;;iBAYc,cACZ,OAAO,QAAQ,eACf;;;;;;iBA8BY,qBAAsB;;;;;;;;cCnFzB;;;;;;cAOA;;;;;cAMA;;;;;;cAcA;cAEA;;;;;;;;;;;;iBCYS,cAClB,QAAQ,QACR,gBAAgB,gBAChB,SAAQ,aACR,QAAQ;;;;;;;;;;;;;;;iBC/BI,gBAAgB,QAAQ,SAAU;;;;;;;;;;;;;;;;;;;;iBAiDlC,qBAAqB,QAAQ,eAAgB,QAAQ;;;;;;iBAmC/C,kBAAkB,QAAQ,QAAQ,OAAO,YAAa,QAAQ;KAUxE;EAIR;EACA;;;;;;;;iBASY,sBACZ,OAAO,WACP,UAAU,wBACV,UAAS,sBACT;;;;;;;;;;;;;;;iBCvHY,yBAAyB;;;cCa5B,YAAa;;;;;;;iBCZV,eAAe;;;;;;;;;;;;;iBAkBf;;;;;;;iBA4BA;;;;;;;iBCnDM,aAAa,QAAQ,SAAU,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/application.ts","../src/config.ts","../src/constants.ts","../src/handler.ts","../src/payload.ts","../src/redirect.ts","../src/render.ts","../src/resolve.ts","../src/server.ts"],"mappings":";;;;;;;;;;;;;;;;YA2BY,cAAc,gBACtB;GAEK,YAAY,QAAQ;GAEpB,YAAY,OAAO,KAAK;IAE7B;;;;;;YAQQ;;;;;;EAMR;;;;;;;;EAQA;;;;;;;;;;;;;;;EAeA;;;;;EAKA;EACA;;;;;EAKA;EAEA,OAAO;;;;;;;YAQC,cACR,OAAO,WACP,QAAQ,QACR;EACI;EACA,MAAM;EACN,QAAQ;MAEX;;;;;;;;;;;;;;;wBC1EW,kBACZ,UAAS,QAAQ,KAAK,yBAAyB,6BAC/C;;;;;;;;;;;;;;;;qBCWS,mDAAa,uCAAA,gDAAA;;QAAb,KAAA;oCAcX;;;;;;;;;;;wBAYoB,cAClB,OAAO,QAAQ,eACf,QAAQ;;;;;;wBAmCU,qBAAsB,QAAQ;;;;;;;qBCzFvC,yBAA0B;;;;;;qBAO1B;;;;;;qBAOA;;;;;qBAMA;;;;;;qBAcA;qBAEA;;;;;;;;;;;;wBCIS,cAClB,QAAQ,QACR,gBAAgB,gBAChB,SAAS,aACT,QAAQ;;;;;;;;;;;;;;;wBC/BI,gBAAgB,QAAQ,SAAU;;;;;;;;;;;;;;;;;;;;wBAiDlC,qBAAqB,QAAQ,eAAgB,QAAQ;;;;;;wBAmC/C,kBAAkB,QAAQ,QAAQ,OAAO,YAAa,QAAQ;YAUxE;EAIR;EACA;;;;;;;;wBASY,sBACZ,OAAO,WACP,UAAU,wBACV,UAAS,sBACT;;;;;;;;;;;;;;;wBCvHY,yBAAyB;;;;;;;;;wBCYnB,qBAAqB,mBAAoB;wBAc/C,iBAAiB,oBAAqB;;;;;;;;;;;;;;;wBCrBtC,mBAAmB;;;;;;wBAYnB,gBAAgB;;;;;;;wBCrBV,aAAa,QAAQ,SAAU,QAAQ"}

package/dist/index.mjs

@@ -1,26 +1,16 @@
-import { _ as CONFIG_SCHEMA, a as resolvePackagePath, c as createAPIClient, d as sanitizeRelativeRedirect, f as ASSETS_PATH, g as VITE_BASE, h as PAGES, i as resolveDistPath, l as createFeaturesReader, m as HEALTH_PATH, n as createHandler, o as setPackagePath, p as BASE_PATH, r as renderPage, s as buildWorkflowPageData, t as createServer, u as readAuthorizeInfo, v as readConfigFromEnv, y as resolveConfig } from "./server-Brhsp_x-.mjs";
-import { createApplication as createApplication$1 } from "@authup/server-console-kit";
-//#region src/application.ts
+import { _ as VITE_BASE, a as resolveDistPath, b as resolveConfig, c as createAPIClient, d as sanitizeRelativeRedirect, f as ASSETS_PATH, g as PAGES, h as HEALTH_PATH, i as createRenderPage, l as createFeaturesReader, m as CONTRACT_VERSION, n as createHandler, o as resolvePackagePath, p as BASE_PATH, r as assertRenderContract, s as buildWorkflowPageData, t as createApplication, u as readAuthorizeInfo, v as CONFIG_SCHEMA, y as readConfigFromEnv } from "./application-YmicGt26.mjs";
+import { App } from "routup";
+//#region src/server.ts
 /**
-* This console as a runnable service: its own module graph, its own
-* container, its own lifecycle, and nothing of server-core's. It is what
-* `authup start console` starts, what the `authup-auth-console` bin starts, and what
-* `authup start` composes onto its own listener, so no caller reaches past
-* the graph for a bare handler.
-*
-* `config` defaults to a FACTORY, not a value: resolving it reads the
-* document, and a console started alongside others must not do that at
-* construction time, before the caller has said where to look. Pass
-* `listen: false` to be mounted on someone else's listener.
+* The standalone service: the same handler the CLI mounts in process,
+* behind a listener of its own.
 */
-function createApplication(context = {}) {
-	return createApplication$1({
-		listen: context.listen,
-		config: context.config ?? readConfigFromEnv,
-		createHandler: (resolved, theme) => createHandler(resolved, theme)
-	});
+async function createServer(config) {
+	const app = new App();
+	app.use(await createHandler(config));
+	return app;
 }
 //#endregion
-export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, HEALTH_PATH, PAGES, VITE_BASE, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createServer, readAuthorizeInfo, readConfigFromEnv, renderPage, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect, setPackagePath };
+export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, CONTRACT_VERSION, HEALTH_PATH, PAGES, VITE_BASE, assertRenderContract, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createRenderPage, createServer, readAuthorizeInfo, readConfigFromEnv, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["createConsoleApplication"],"sources":["../src/application.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createApplication as createConsoleApplication } from '@authup/server-console-kit';\nimport type { CreateApplicationContext } from '@authup/server-console-kit';\nimport type { Application } from 'orkos';\nimport { readConfigFromEnv } from './config';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * This console as a runnable service: its own module graph, its own\n * container, its own lifecycle, and nothing of server-core's. It is what\n * `authup start console` starts, what the `authup-auth-console` bin starts, and what\n * `authup start` composes onto its own listener, so no caller reaches past\n * the graph for a bare handler.\n *\n * `config` defaults to a FACTORY, not a value: resolving it reads the\n * document, and a console started alongside others must not do that at\n * construction time, before the caller has said where to look. Pass\n * `listen: false` to be mounted on someone else's listener.\n */\nexport function createApplication(\n    context: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>> = {},\n) : Application {\n    return createConsoleApplication<Config>({\n        listen: context.listen,\n        config: context.config ?? readConfigFromEnv,\n        createHandler: (resolved, theme) => createHandler(resolved, theme),\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;AA0BA,SAAgB,kBACZ,UAA4E,CAAC,GACjE;CACZ,OAAOA,oBAAiC;EACpC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,UAAU;EAC1B,gBAAgB,UAAU,UAAU,cAAc,UAAU,KAAK;CACrE,CAAC;AACL"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/server.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { App } from 'routup';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * The standalone service: the same handler the CLI mounts in process,\n * behind a listener of its own.\n */\nexport async function createServer(config: Config) : Promise<App> {\n    const app = new App();\n\n    app.use(await createHandler(config));\n\n    return app;\n}\n"],"mappings":";;;;;;;AAeA,eAAsB,aAAa,QAA+B;CAC9D,MAAM,MAAM,IAAI,IAAI;CAEpB,IAAI,IAAI,MAAM,cAAc,MAAM,CAAC;CAEnC,OAAO;AACX"}

package/dist/render.d.ts

@@ -1,3 +1,10 @@
 import type { RenderPage } from './types';
-export declare const renderPage: RenderPage;
+/**
+ * Refuse a bundle built against another render contract at boot, naming the
+ * entry and both versions, instead of failing per request on `/authorize`.
+ * A bundle predating the export is version 1. Reads the module itself, which
+ * Node's ESM cache then hands the render for free.
+ */
+export declare function assertRenderContract(distPath: string): Promise<void>;
+export declare function createRenderPage(distPath?: string): RenderPage;
 //# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAS1C,eAAO,MAAM,UAAU,EAAG,UAkEzB,CAAC"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAY3E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,UAAU,CAgF/D"}

package/dist/resolve.d.ts

@@ -1,26 +1,20 @@
 /**
- * Point the resolution at a substituted package (config `distPath`)
- * instead of the node_modules walk. Called once at boot.
- */
-export declare function setPackagePath(value: string | undefined): void;
-/**
- * Locate the auth console package. The SSR auth workflow UI ships as
- * `@authup/client-auth-console` (a dependency of THIS service), so the
+ * Locate the auth console package: a substituted one (config `distPath`)
+ * first, else the SSR auth workflow UI shipped as
+ * `@authup/client-auth-console` (a dependency of THIS service), which the
  * node_modules ancestor walk from this package's own root (locter's
- * `locateUp`) finds it for the workspace (symlink onto
- * apps/client-auth-console) and for a published install alike. Only a
- * positive result is cached.
+ * `locateUp`) finds for the workspace (symlink onto
+ * apps/client-auth-console) and for a published install alike.
  *
  * The `cwd` anchor is behavioural, not incidental: it decides which
  * node_modules tree is walked, so it stays pinned to this package rather
  * than to the process cwd.
  */
-export declare function resolvePackagePath(): string | undefined;
+export declare function resolvePackagePath(distPath?: string): string | undefined;
 /**
  * Locate the BUILT auth console bundle (`dist/client` template + assets,
- * `dist/server/server.js` render entry). Only a positive result is cached,
- * so a dev building the package after boot is picked up on the next
- * request.
+ * `dist/server/server.js` render entry). A half-built package is no bundle:
+ * without the render entry there is nothing to render with.
  */
-export declare function resolveDistPath(): string | undefined;
+export declare function resolveDistPath(distPath?: string): string | undefined;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAI,IAAI,CAI/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,IAAK,MAAM,GAAG,SAAS,CAoBxD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAK,MAAM,GAAG,SAAS,CAerD"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS,CAKzE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS,CAetE"}

package/dist/types.d.ts

@@ -64,8 +64,8 @@ export type Config = {
 };
 /**
  * How a page becomes a document. The default is this service's own
- * `renderPage`, reading the built bundle; a caller serving the console from
- * source substitutes one that reads through a vite dev server instead.
+ * `createRenderPage`, reading the built bundle; a caller serving the console
+ * from source substitutes one that reads through a vite dev server instead.
  */
 export type RenderPage = (event: IAppEvent, config: Config, ctx: {
     url: string;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/server-auth-console",
     "type": "module",
-    "version": "1.0.0-beta.64",
+    "version": "1.0.0-beta.65",
     "description": "The SSR service behind authup's hosted auth pages: it renders the auth console bundle and hydrates it anonymously over HTTP.",
     "license": "AGPL-3.0-only",
     "bin": {
@@ -51,21 +51,23 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/client-auth-console": "^1.0.0-beta.64",
-        "@authup/core-http-kit": "^1.0.0-beta.64",
-        "@authup/errors": "^1.0.0-beta.64",
-        "@authup/kit": "^1.0.0-beta.64",
-        "@authup/server-config-kit": "^1.0.0-beta.64",
-        "@authup/server-config": "^1.0.0-beta.64",
-        "@authup/server-console-kit": "^1.0.0-beta.64",
+        "@authup/client-auth-console": "^1.0.0-beta.65",
+        "@authup/core-http-kit": "^1.0.0-beta.65",
+        "@authup/errors": "^1.0.0-beta.65",
+        "@authup/kit": "^1.0.0-beta.65",
+        "@authup/server-config": "^1.0.0-beta.65",
+        "@authup/server-config-kit": "^1.0.0-beta.65",
+        "@authup/server-console-kit": "^1.0.0-beta.65",
         "@routup/assets": "^5.0.0",
         "@routup/basic": "^3.0.0",
         "locter": "^4.1.1",
         "orkos": "^1.1.1",
         "routup": "^6.1.0",
+        "validup": "^2.0.1",
         "zod": "^4.5.4"
     },
     "devDependencies": {
+        "@types/node": "^26.4.1",
         "cross-env": "^10.1.0",
         "vitest": "^4.0.18"
     },

package/dist/server-Brhsp_x-.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-Brhsp_x-.mjs","names":["createHandler","createAssetsHandler","createHandler"],"sources":["../src/config.ts","../src/constants.ts","../src/redirect.ts","../src/payload.ts","../src/path.ts","../src/resolve.ts","../src/render.ts","../src/handler.ts","../src/server.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AUTH_CONSOLE_SCHEMA,\n    CORE_SCHEMA,\n    ROOT_SCHEMA,\n    SECTION_KEY,\n    THEME_SCHEMA,\n} from '@authup/server-config';\nimport {\n    buildSchemaDefaults,\n    defineSchema,\n    mergeSchemaData,\n    readSchemaFromEnv,\n    resolveSchemaData,\n} from '@authup/server-config-kit';\nimport type { CoreConfig, EnvironmentVariable } from '@authup/server-config';\nimport type { Config, ConfigInput } from './types';\n\n/**\n * The keys this service reads, SELECTED out of the document schema by name.\n *\n * Nothing is declared here: every key of `authup.yml` is declared once in\n * `@authup/server-config`, so this service cannot spell a path, an\n * environment variable, a default or a reader differently from server-core,\n * which reads several of the same keys. Neither package depends on the other;\n * both depend on the declaration.\n *\n * Its own section is spread, so this service reads it in its own vocabulary\n * (`url`, `port`, `host`); every other section stays under the key the\n * document nests it at.\n */\nexport const CONFIG_SCHEMA = defineSchema<ConfigInput, 'publicUrl' | 'internalUrl' | 'db'>({\n    ...AUTH_CONSOLE_SCHEMA,\n    ...ROOT_SCHEMA,\n    [SECTION_KEY.THEME]: THEME_SCHEMA,\n    // Two keys of core, never the section. `publicUrl` derives from\n    // the core listener address, which is what a console needs; selecting the\n    // whole section also selects its INVARIANTS, and `resolveSchemaData` runs\n    // every resolver in a registry -- so a console would refuse to start on a\n    // short SECRETS_ENCRYPTION_KEY, or on mfaRequired without mfaEnabled, for\n    // keys it has no database, key store or MFA to use.\n    [SECTION_KEY.CORE]: defineSchema<Pick<CoreConfig, 'host' | 'port'>, never, EnvironmentVariable>({\n        host: CORE_SCHEMA.host,\n        port: CORE_SCHEMA.port,\n    }),\n});\n\n/**\n * Turn the configuration namespace into the service's own shape: fill the\n * defaults, derive the one key that is derived rather than configured, and\n * rename. An empty `url` means the console sits on server-core's own origin\n * under the default segment, which is the single-origin deployment.\n *\n * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread\n * would let an input carrying one key of a section replace the whole section\n * and take every other key's default with it.\n */\nexport function resolveConfig(\n    input: Partial<ConfigInput>,\n) : Config {\n    const values = resolveSchemaData<ConfigInput>(\n        CONFIG_SCHEMA,\n        mergeSchemaData<ConfigInput>(\n            CONFIG_SCHEMA,\n            buildSchemaDefaults<ConfigInput>(CONFIG_SCHEMA),\n            input,\n        ),\n    ) as ConfigInput;\n\n    return {\n        url: values.url,\n        apiUrl: values.publicUrl,\n        // `internalUrl` falls back to `publicUrl`, so an operator who has one\n        // address for both sides configures nothing. The composed `authup\n        // start` overrides this with its own listen address unless the\n        // document named one.\n        apiInternalUrl: values.internalUrl,\n        port: values.port,\n        host: values.host,\n        distPath: values.path,\n        theme: values.theme,\n    };\n}\n\n/**\n * The standalone entry's configuration, read from the environment alone.\n * `authup.yml` reaches this service through the CLI roles, which compose this\n * very registry into the one document loader.\n */\nexport function readConfigFromEnv() : Config {\n    // The explicit type argument is load-bearing: inferred from the schema\n    // object, a key declared without a default (the derived publicUrl) comes\n    // back as unknown.\n    const input : Partial<ConfigInput> = readSchemaFromEnv<ConfigInput>(CONFIG_SCHEMA);\n\n    return resolveConfig(input);\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The vite base the auth console bundle is built with. Asset hrefs in the\n * shell are emitted against it, so the service mounts its assets there and\n * rebases them only when the deployment carries a sub-path.\n */\nexport const VITE_BASE = '/console/auth/';\n\n/**\n * The path the service is served under by default, i.e. the path component\n * of `authConsole.url`. It is the same segment server-core mounted\n * the assets at before the split, so a built bundle needs no rebuild.\n */\nexport const BASE_PATH = '/console/auth';\n\n/**\n * The pages the service renders. Each is a route of the console bundle's\n * own router, and each is what a server-core page GET now redirects to.\n */\nexport const PAGES = [\n    '/authorize',\n    '/register',\n    '/activate',\n    '/password-forgot',\n    '/password-reset',\n    '/logout',\n] as const;\n\n/**\n * Where this service mounts the bundle's `assets/` directory. The public\n * asset URL is the service's own public path plus this route, which is what\n * the bundle's fixed vite base is rebased onto.\n */\nexport const ASSETS_PATH = '/assets';\n\nexport const HEALTH_PATH = '/healthy';\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { AuthorizeInfo, StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport { Client } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from './redirect';\nimport type { Config } from './types';\n\n/**\n * The service hydrates ANONYMOUSLY. It holds no credential of its own and\n * asks server-core only for what an unauthenticated visitor may see, which\n * is the whole of what these pages render.\n *\n * It dispatches against `apiInternalUrl`, never the browser-facing `apiUrl`:\n * this is a server-side call, so it must not depend on the public address\n * resolving from inside the deployment. Unlike server-core's own internal\n * client the swap is on `baseURL` rather than at the transport layer,\n * because nothing derived from it reaches a caller -- there is no\n * `redirect_uri` here to be compared byte for byte later.\n */\nexport function createAPIClient(config: Config) : Client {\n    return new Client({ baseURL: config.apiInternalUrl });\n}\n\n/**\n * Report an outbound failure to the operator and raise one the visitor may\n * see, which is deliberately not the same error.\n *\n * hapic embeds the resolved request URL in its message, and this service has\n * no error middleware: routup answers with `event.error.message` verbatim, on\n * the public login page. That URL is `apiInternalUrl`, which on a split\n * deployment names a service on the operator's own network, so an API that is\n * merely down would publish its internal address to every anonymous visitor.\n * It was harmless while the value was `publicUrl`, an address the browser\n * already had.\n *\n * The rule and the remedy are server-core's own (`sanitizeError` /\n * `describeError`): the caller gets a message it can act on, the detail goes\n * to the log. `console.error` rather than a logger because a console handler\n * is built from a config alone and is given none -- and because this line is\n * the only trace such a failure leaves, which is how #3550 was diagnosed in\n * the first place.\n */\nfunction failWithoutAddress(error: unknown) : never {\n    // eslint-disable-next-line no-console\n    console.error('[authup] the auth console could not reach the API:', error);\n\n    throw new Error('The identity provider could not be reached.');\n}\n\n/**\n * The feature flags every workflow page gates its form on. A page that\n * cannot reach them must not silently claim a workflow is disabled, so the\n * failure propagates rather than defaulting to false.\n *\n * Read ONCE and held for the reader's lifetime, the same shape render.ts\n * keeps for the dist template, manifest and render entry: `GET /` reports\n * the version and the boot-config feature flags, none of which changes\n * without a restart, so a TTL would be a number with nothing behind it.\n * Without it every workflow page render is an API call, and under the\n * composed `authup start` those all arrive over loopback on one shared\n * rate-limit key. Only a SUCCESS is held, so an API that was down at the\n * first render is retried rather than remembered as broken.\n *\n * The cache is instance-scoped rather than module-scoped (098 C4): the\n * answer depends on which API the client was built against, so two handlers\n * in one process must not share one, and a module slot would additionally\n * leak between test cases.\n */\nexport function createFeaturesReader(client: Client) : () => Promise<StatusResponseFeatures> {\n    let cached : StatusResponseFeatures | undefined;\n    let pending : Promise<StatusResponseFeatures> | undefined;\n\n    return () => {\n        if (cached) {\n            return Promise.resolve(cached);\n        }\n\n        if (pending) {\n            return pending;\n        }\n\n        pending = client.status.get()\n            .then((status: StatusResponse) => {\n                cached = status.features;\n\n                return cached;\n            })\n            .catch((e) => failWithoutAddress(e));\n\n        const clear = () => {\n            pending = undefined;\n        };\n        pending.then(clear, clear);\n\n        return pending;\n    };\n}\n\n/**\n * The `/authorize` render input, resolved by server-core (plan 101 D2-1).\n * The browser's query is forwarded verbatim: the answer is derived from all\n * of it, the `provider` hint and the closed `error` marker set included.\n */\nexport async function readAuthorizeInfo(client: Client, event: IAppEvent) : Promise<AuthorizeInfo> {\n    const { search } = new URL(event.request.url);\n\n    try {\n        return await client.authorize.getInfo(search);\n    } catch (e) {\n        return failWithoutAddress(e);\n    }\n}\n\nexport type WorkflowPageOptions = {\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * The payload the four workflow pages render from: the feature flags plus\n * the handful of query params each one declares. Unchanged from the\n * assembly server-core did before the split, including the open-redirect\n * guard on `redirect`.\n */\nexport function buildWorkflowPageData(\n    event: IAppEvent,\n    features: StatusResponseFeatures,\n    options: WorkflowPageOptions = {},\n) : Record<string, any> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return data;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from './path';\n\nlet cachedPackagePath: string | undefined;\nlet cachedDistPath: string | undefined;\nlet overridePackagePath: string | undefined;\n\n/**\n * Point the resolution at a substituted package (config `distPath`)\n * instead of the node_modules walk. Called once at boot.\n */\nexport function setPackagePath(value: string | undefined) : void {\n    overridePackagePath = value || undefined;\n    cachedPackagePath = undefined;\n    cachedDistPath = undefined;\n}\n\n/**\n * Locate the auth console package. The SSR auth workflow UI ships as\n * `@authup/client-auth-console` (a dependency of THIS service), so the\n * node_modules ancestor walk from this package's own root (locter's\n * `locateUp`) finds it for the workspace (symlink onto\n * apps/client-auth-console) and for a published install alike. Only a\n * positive result is cached.\n *\n * The `cwd` anchor is behavioural, not incidental: it decides which\n * node_modules tree is walked, so it stays pinned to this package rather\n * than to the process cwd.\n */\nexport function resolvePackagePath() : string | undefined {\n    if (cachedPackagePath) {\n        return cachedPackagePath;\n    }\n\n    if (overridePackagePath) {\n        cachedPackagePath = overridePackagePath;\n\n        return cachedPackagePath;\n    }\n\n    const manifest = locateUpSync(\n        'node_modules/@authup/client-auth-console/package.json',\n        { cwd: PACKAGE_PATH },\n    );\n    if (manifest) {\n        cachedPackagePath = manifest.directory;\n    }\n\n    return cachedPackagePath;\n}\n\n/**\n * Locate the BUILT auth console bundle (`dist/client` template + assets,\n * `dist/server/server.js` render entry). Only a positive result is cached,\n * so a dev building the package after boot is picked up on the next\n * request.\n */\nexport function resolveDistPath() : string | undefined {\n    if (cachedDistPath) {\n        return cachedDistPath;\n    }\n\n    const packagePath = resolvePackagePath();\n    if (packagePath) {\n        const distPath = path.join(packagePath, 'dist');\n\n        if (fs.existsSync(path.join(distPath, 'client', 'index.html'))) {\n            cachedDistPath = distPath;\n        }\n    }\n\n    return cachedDistPath;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { HydrationPayload, RenderFunction } from '@authup/client-auth-console';\nimport { InternalError } from '@authup/errors';\nimport { getURLBasePath } from '@authup/kit';\nimport {\n    applyTheme,\n    applyUIPageHeaders,\n    readUIClientPreferences,\n    rebaseAssetURLs,\n    replaceTemplateMarker,\n    stampHtmlAttributes,\n} from '@authup/server-console-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { VITE_BASE } from './constants';\nimport { resolveDistPath } from './resolve';\nimport type { RenderPage } from './types';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths).\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: RenderFunction | undefined;\n\nexport const renderPage : RenderPage = async (event, config, ctx) => {\n    const distPath = resolveDistPath();\n    if (!distPath) {\n        throw new InternalError(\n            'The auth console bundle (@authup/client-auth-console) is not built or installed.',\n        );\n    }\n\n    const html = (cachedHtml ??= await fs.promises.readFile(\n        path.join(distPath, 'client', 'index.html'),\n        'utf-8',\n    ));\n    const manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n        path.join(distPath, 'client', '.vite', 'ssr-manifest.json'),\n        'utf-8',\n    )));\n    const render = (cachedRender ??= (await read(\n        path.join(distPath, 'server', 'server.js'),\n    )).render as RenderFunction);\n\n    // The client app hydrates locale + color-mode from the payload, so it\n    // adopts the same values the HTML shell is stamped with below.\n    const preferences = readUIClientPreferences(event);\n\n    // `baseURL` is server-core's public URL: the console derives its HTTP\n    // client and its cookie path from it. `basePath` is where THIS service\n    // is served, which is what the router and every inter-page href need.\n    // Before the split the two were the same value; they are not any more,\n    // so the console reads them separately.\n    const basePath = getURLBasePath(config.url);\n\n    const payload : HydrationPayload = {\n        config: {\n            baseURL: config.apiUrl,\n            basePath,\n            colorMode: preferences.colorMode,\n            locale: preferences.locale,\n        },\n        data: ctx.data,\n    };\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload,\n    });\n\n    let body = replaceTemplateMarker(html, '<!--preload-links-->', preloadLinks);\n    body = replaceTemplateMarker(body, '<!--app-html-->', appHtml);\n\n    body = stampHtmlAttributes(body, preferences);\n\n    // This service mounts the bundle's assets at its own /assets, so the\n    // fixed vite base in every href is replaced by this service's public\n    // path. The vite base was decided when the bundle was built and says\n    // nothing about where the service is published.\n    body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);\n\n    // The theme's own asset urls are built from the same base, and the\n    // service mounts them under it, so a themed deployment needs no rule of\n    // its own at the reverse proxy beyond the one that reaches this service.\n    body = await applyTheme(body, ctx.theme, basePath);\n\n    applyUIPageHeaders(event);\n\n    return body;\n};\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IThemeProvider } from '@authup/server-console-kit';\nimport {\n    THEME_ASSET_MOUNT_PATH,\n    createThemeAssetsHandler,\n    createThemeProvider,\n} from '@authup/server-console-kit';\nimport { createHandler as createAssetsHandler } from '@routup/assets';\nimport { basic } from '@routup/basic';\nimport path from 'node:path';\nimport type { IApp } from 'routup';\nimport { App, defineCoreHandler } from 'routup';\nimport { ASSETS_PATH, HEALTH_PATH } from './constants';\nimport {\n    buildWorkflowPageData,\n    createAPIClient,\n    createFeaturesReader,\n    readAuthorizeInfo,\n} from './payload';\nimport { renderPage } from './render';\nimport { resolveDistPath, setPackagePath } from './resolve';\nimport type { Config, RenderPage } from './types';\n\nconst WORKFLOW_PAGES : {\n    url: string,\n    realmAware?: boolean,\n    tokenAware?: boolean\n}[] = [\n    { url: '/register', realmAware: true },\n    { url: '/activate', tokenAware: true },\n    { url: '/password-forgot', realmAware: true },\n    {\n        url: '/password-reset',\n        realmAware: true,\n        tokenAware: true,\n    },\n];\n\n/**\n * The service as a mountable routup handler, so the CLI can compose it onto\n * server-core's own listener for the single-container deployment while a\n * split deployment runs it behind its own server.\n *\n * The paths are prefix-free. authup assumes a prefix-stripping reverse\n * proxy, so a service published at `<origin>/console/auth` receives\n * `/authorize`, exactly as server-core received it before the split.\n */\nexport async function createHandler(\n    config: Config,\n    themeProvider?: IThemeProvider,\n    render: RenderPage = renderPage,\n) : Promise<IApp> {\n    setPackagePath(config.distPath);\n\n    const app = new App();\n    const client = createAPIClient(config);\n    const readFeatures = createFeaturesReader(client);\n\n    // The shell is stamped from the vc-locale / vc-color-mode cookies, and\n    // without the plugin every cookie read answers undefined, which is a\n    // silent flash of the wrong color mode on every full load. server-core\n    // registers it globally, so a mounted handler inherits one; a standalone\n    // service has nothing above it.\n    app.use(basic({ cookie: true, query: true }));\n\n    // A missing directory disables theming entirely: no provider is created\n    // and the rendered pages are byte-identical to the un-themed ones, so the\n    // default configuration pays nothing. An invalid manifest throws here and\n    // fails the boot rather than surfacing per request.\n    // Injected by the theme module when this runs inside the console\n    // application; built here for a caller holding only a config.\n    const theme = themeProvider ?? await createThemeProvider(config);\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: HEALTH_PATH,\n        fn: () => ({ status: 'ok' }),\n    }));\n\n    if (theme) {\n        app.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(theme));\n    }\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/authorize',\n        fn: async (event) => render(event, config, {\n            url: '/authorize',\n            data: await readAuthorizeInfo(client, event),\n            theme,\n        }),\n    }));\n\n    for (const page of WORKFLOW_PAGES) {\n        app.use(defineCoreHandler({\n            method: 'get',\n            path: page.url,\n            fn: async (event) => {\n                const features = await readFeatures();\n\n                return render(event, config, {\n                    url: page.url,\n                    data: buildWorkflowPageData(event, features, page),\n                    theme,\n                });\n            },\n        }));\n    }\n\n    // The logout page needs nothing resolved up front: it drives the\n    // end-session call itself and renders from the answer, so the render\n    // stays a pure shell and no request reaches server-core here.\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/logout',\n        fn: async (event) => render(event, config, {\n            url: '/logout',\n            data: {},\n            theme,\n        }),\n    }));\n\n    // Only the assets directory is mounted, never dist/client itself: the\n    // template and the ssr manifest are inputs of the render, not files to\n    // serve. A missing bundle only disables the mount; the page routes\n    // report the actionable error.\n    const distPath = resolveDistPath();\n    if (distPath) {\n        app.use(ASSETS_PATH, createAssetsHandler(\n            path.posix.join(distPath, 'client', 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n    }\n\n    return app;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { App } from 'routup';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * The standalone service: the same handler the CLI mounts in process,\n * behind a listener of its own.\n */\nexport async function createServer(config: Config) : Promise<App> {\n    const app = new App();\n\n    app.use(await createHandler(config));\n\n    return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAa,gBAAgB,aAA8D;CACvF,GAAG;CACH,GAAG;EACF,YAAY,QAAQ;EAOpB,YAAY,OAAO,aAA4E;EAC5F,MAAM,YAAY;EAClB,MAAM,YAAY;CACtB,CAAC;AACL,CAAC;;;;;;;;;;;AAYD,SAAgB,cACZ,OACO;CACP,MAAM,SAAS,kBACX,eACA,gBACI,eACA,oBAAiC,aAAa,GAC9C,KACJ,CACJ;CAEA,OAAO;EACH,KAAK,OAAO;EACZ,QAAQ,OAAO;EAKf,gBAAgB,OAAO;EACvB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,OAAO,OAAO;CAClB;AACJ;;;;;;AAOA,SAAgB,oBAA6B;CAMzC,OAAO,cAF8B,kBAA+B,aAE3C,CAAC;AAC9B;;;;;;;;AC1FA,MAAa,YAAY;;;;;;AAOzB,MAAa,YAAY;;;;;AAMzB,MAAa,QAAQ;CACjB;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;AAOA,MAAa,cAAc;AAE3B,MAAa,cAAc;;;;;;;;;;;;;;;ACtB3B,SAAgB,yBAAyB,OAAoC;CACzE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAC9C;CAMJ,IAAI,wBAAwB,KAAK,KAAK,GAClC;CAGJ,IAAI;CACJ,IAAI;EACA,UAAU,mBAAmB,KAAK;CACtC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwB,KAAK,OAAO,GACpC;CAGJ,KAAK,MAAM,aAAa,CAAC,OAAO,OAAO,GAAG;EACtC,IAAI,CAAC,UAAU,WAAW,GAAG,GACzB;EAEJ,IAAI,UAAU,SAAS,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,OAClE;EAEJ,IAAI,UAAU,SAAS,IAAI,GACvB;CAER;CAEA,OAAO;AACX;;;;;;;;;;;;;;;ACjCA,SAAgB,gBAAgB,QAAyB;CACrD,OAAO,IAAI,OAAO,EAAE,SAAS,OAAO,eAAe,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,mBAAmB,OAAwB;CAEhD,QAAQ,MAAM,sDAAsD,KAAK;CAEzE,MAAM,IAAI,MAAM,6CAA6C;AACjE;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,qBAAqB,QAAwD;CACzF,IAAI;CACJ,IAAI;CAEJ,aAAa;EACT,IAAI,QACA,OAAO,QAAQ,QAAQ,MAAM;EAGjC,IAAI,SACA,OAAO;EAGX,UAAU,OAAO,OAAO,IAAI,CAAC,CACxB,MAAM,WAA2B;GAC9B,SAAS,OAAO;GAEhB,OAAO;EACX,CAAC,CAAC,CACD,OAAO,MAAM,mBAAmB,CAAC,CAAC;EAEvC,MAAM,cAAc;GAChB,UAAU,KAAA;EACd;EACA,QAAQ,KAAK,OAAO,KAAK;EAEzB,OAAO;CACX;AACJ;;;;;;AAOA,eAAsB,kBAAkB,QAAgB,OAA2C;CAC/F,MAAM,EAAE,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;CAE5C,IAAI;EACA,OAAO,MAAM,OAAO,UAAU,QAAQ,MAAM;CAChD,SAAS,GAAG;EACR,OAAO,mBAAmB,CAAC;CAC/B;AACJ;;;;;;;AAgBA,SAAgB,sBACZ,OACA,UACA,UAA+B,CAAC,GACZ;CACpB,MAAM,QAAQ,gBAAgB,KAAK;CAEnC,MAAM,OAA4B;EAC9B;EACA,UAAU,yBAAyB,MAAM,QAAQ;CACrD;CAEA,IAAI,QAAQ,YAAY;EACpB,MAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,MAAM;EAC1E,KAAK,UAAU,OAAO,YAAY,WAAW,UAAU,KAAA;CAC3D;CAEA,IAAI,QAAQ,YACR,KAAK,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,KAAA;CAGjE,OAAO;AACX;;;AClJA,MAAa,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AACpE,MAAa,eAAe,KAAK,KAAK,WAAW,IAAI;;;ACCrD,IAAI;AACJ,IAAI;AACJ,IAAI;;;;;AAMJ,SAAgB,eAAe,OAAkC;CAC7D,sBAAsB,SAAS,KAAA;CAC/B,oBAAoB,KAAA;CACpB,iBAAiB,KAAA;AACrB;;;;;;;;;;;;;AAcA,SAAgB,qBAA0C;CACtD,IAAI,mBACA,OAAO;CAGX,IAAI,qBAAqB;EACrB,oBAAoB;EAEpB,OAAO;CACX;CAEA,MAAM,WAAW,aACb,yDACA,EAAE,KAAK,aAAa,CACxB;CACA,IAAI,UACA,oBAAoB,SAAS;CAGjC,OAAO;AACX;;;;;;;AAQA,SAAgB,kBAAuC;CACnD,IAAI,gBACA,OAAO;CAGX,MAAM,cAAc,mBAAmB;CACvC,IAAI,aAAa;EACb,MAAM,WAAW,KAAK,KAAK,aAAa,MAAM;EAE9C,IAAI,GAAG,WAAW,KAAK,KAAK,UAAU,UAAU,YAAY,CAAC,GACzD,iBAAiB;CAEzB;CAEA,OAAO;AACX;;;ACrDA,IAAI;AACJ,IAAI;AACJ,IAAI;AAEJ,MAAa,aAA0B,OAAO,OAAO,QAAQ,QAAQ;CACjE,MAAM,WAAW,gBAAgB;CACjC,IAAI,CAAC,UACD,MAAM,IAAI,cACN,kFACJ;CAGJ,MAAM,OAAQ,eAAe,MAAM,GAAG,SAAS,SAC3C,KAAK,KAAK,UAAU,UAAU,YAAY,GAC1C,OACJ;CACA,MAAM,WAAY,mBAAmB,KAAK,MAAM,MAAM,GAAG,SAAS,SAC9D,KAAK,KAAK,UAAU,UAAU,SAAS,mBAAmB,GAC1D,OACJ,CAAC;CACD,MAAM,SAAU,kBAAkB,MAAM,KACpC,KAAK,KAAK,UAAU,UAAU,WAAW,CAC7C,EAAA,CAAG;CAIH,MAAM,cAAc,wBAAwB,KAAK;CAOjD,MAAM,WAAW,eAAe,OAAO,GAAG;CAE1C,MAAM,UAA6B;EAC/B,QAAQ;GACJ,SAAS,OAAO;GAChB;GACA,WAAW,YAAY;GACvB,QAAQ,YAAY;EACxB;EACA,MAAM,IAAI;CACd;CAEA,MAAM,CAAC,SAAS,gBAAgB,MAAM,OAAO;EACzC,KAAK,IAAI;EACT;EACA;CACJ,CAAC;CAED,IAAI,OAAO,sBAAsB,MAAM,wBAAwB,YAAY;CAC3E,OAAO,sBAAsB,MAAM,mBAAmB,OAAO;CAE7D,OAAO,oBAAoB,MAAM,WAAW;CAM5C,OAAO,gBAAgB,MAAM,WAAW,GAAG,SAAS,EAAE;CAKtD,OAAO,MAAM,WAAW,MAAM,IAAI,OAAO,QAAQ;CAEjD,mBAAmB,KAAK;CAExB,OAAO;AACX;;;ACrEA,MAAM,iBAIA;CACF;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAoB,YAAY;CAAK;CAC5C;EACI,KAAK;EACL,YAAY;EACZ,YAAY;CAChB;AACJ;;;;;;;;;;AAWA,eAAsBA,gBAClB,QACA,eACA,SAAqB,YACP;CACd,eAAe,OAAO,QAAQ;CAE9B,MAAM,MAAM,IAAI,IAAI;CACpB,MAAM,SAAS,gBAAgB,MAAM;CACrC,MAAM,eAAe,qBAAqB,MAAM;CAOhD,IAAI,IAAI,MAAM;EAAE,QAAQ;EAAM,OAAO;CAAK,CAAC,CAAC;CAQ5C,MAAM,QAAQ,iBAAiB,MAAM,oBAAoB,MAAM;CAE/D,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,WAAW,EAAE,QAAQ,KAAK;CAC9B,CAAC,CAAC;CAEF,IAAI,OACA,IAAI,IAAI,wBAAwB,yBAAyB,KAAK,CAAC;CAGnE,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,OAAO,OAAO,QAAQ;GACvC,KAAK;GACL,MAAM,MAAM,kBAAkB,QAAQ,KAAK;GAC3C;EACJ,CAAC;CACL,CAAC,CAAC;CAEF,KAAK,MAAM,QAAQ,gBACf,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM,KAAK;EACX,IAAI,OAAO,UAAU;GACjB,MAAM,WAAW,MAAM,aAAa;GAEpC,OAAO,OAAO,OAAO,QAAQ;IACzB,KAAK,KAAK;IACV,MAAM,sBAAsB,OAAO,UAAU,IAAI;IACjD;GACJ,CAAC;EACL;CACJ,CAAC,CAAC;CAMN,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,OAAO,OAAO,QAAQ;GACvC,KAAK;GACL,MAAM,CAAC;GACP;EACJ,CAAC;CACL,CAAC,CAAC;CAMF,MAAM,WAAW,gBAAgB;CACjC,IAAI,UACA,IAAI,IAAI,aAAaC,cACjB,KAAK,MAAM,KAAK,UAAU,UAAU,QAAQ,GAC5C;EACI,aAAa;EACb,MAAM;CACV,CACJ,CAAC;CAGL,OAAO;AACX;;;;;;;ACjIA,eAAsB,aAAa,QAA+B;CAC9D,MAAM,MAAM,IAAI,IAAI;CAEpB,IAAI,IAAI,MAAMC,gBAAc,MAAM,CAAC;CAEnC,OAAO;AACX"}