@authup/server-auth-console 1.0.0-beta.64 → 1.0.0-beta.66

package/README.md

@@ -0,0 +1,78 @@
+# @authup/server-auth-console
+
+[![npm version](https://badge.fury.io/js/@authup%2Fserver-auth-console.svg)](https://badge.fury.io/js/@authup%2Fserver-auth-console)
+[![main](https://github.com/authup/authup/actions/workflows/main.yml/badge.svg)](https://github.com/authup/authup/actions/workflows/main.yml)
+[![Known Vulnerabilities](https://snyk.io/test/github/authup/authup/badge.svg)](https://snyk.io/test/github/authup/authup)
+
+The service behind authup's hosted auth pages: `/authorize` (login and
+consent), `/register`, `/activate`, `/password-forgot`, `/password-reset`,
+`/device` (device verification, RFC 8628) and `/logout`. A server-core page GET
+redirects here carrying the request's own query, so the authorization request
+is what identifies the flow.
+
+It renders `@authup/client-auth-console` through that package's own render
+contract, resolved out of `node_modules`: the SSR bundle per request with the
+hydration payload spliced into the template, the bundle's client assets under
+its own `/assets`, plus the operator theme and the security headers a login
+page needs.
+
+It hydrates ANONYMOUSLY over HTTP and holds no credential, no database and no
+loopback: `/authorize` from `GET /authorize/info`, the four workflow pages and
+`/device` from `GET /` plus their own query (`/device` pre-fills the `user_code`
+it was called with), and `/logout` from nothing at all, since that page drives
+the end-session call itself. Substituting a package that fulfills the
+render contract is the supported way to replace the hosted auth UI.
+
+## Usage
+
+`authup start console auth` is the supported route: the `authup` CLI reads
+`authup.yml` and hands this service its own section. `authup start` composes it
+onto server-core's own listener instead, which is the single-origin deployment.
+
+The `authup-auth-console` bin is the standalone escape hatch, for a deployment
+that runs a console without the CLI. It reads the environment alone.
+
+```bash
+PUBLIC_URL=https://example.com AUTH_CONSOLE_PORT=3020 authup-auth-console
+```
+
+```typescript
+import { createApplication } from '@authup/server-auth-console';
+
+const application = createApplication();
+
+await application.setup();
+```
+
+`createApplication()` builds this console's own module graph, resolves its
+configuration and listens. Pass `{ listen: false }` to be mounted on someone
+else's listener, or `{ config }` to hand over a configuration.
+
+## Configuration
+
+Keys are declared once in `@authup/server-config`; this service selects the ones
+it reads. Its own section is `authConsole`, and it carries no `enabled` key:
+the hosted login, consent and workflow pages are the issuance surface.
+
+| Key | Environment variable | Default |
+|---|---|---|
+| `url` | `AUTH_CONSOLE_URL` | derived from `publicUrl` |
+| `path` | `AUTH_CONSOLE_PATH` | resolve the bundle from `node_modules` |
+| `port` | `AUTH_CONSOLE_PORT` | `3020` |
+| `host` | `AUTH_CONSOLE_HOST` | inherits the deployment-wide `host` |
+
+It is the one console that fetches server-side, so the API address is two keys:
+`publicUrl` (`PUBLIC_URL`) is the browser's and reaches the hydration payload,
+`internalUrl` (`INTERNAL_URL`) is the one this service dispatches against and
+falls back to `publicUrl`. It also reads `theme.directoryPath`
+(`THEME_DIRECTORY_PATH`) and `theme.fragmentsEnabled`
+(`THEME_FRAGMENTS_ENABLED`). `resolveConfig()` and `readConfigFromEnv()` both
+return a `Promise`.
+
+## License
+
+Made with 💚
+
+Published under the [AGPL-3.0-only License](./LICENSE).
+A commercial license is available for organizations that cannot meet the AGPL's conditions.
+See [LICENSING.md](../../LICENSING.md) or contact **contact@tada5hi.net**.

package/dist/{server-Brhsp_x-.mjs → application-h8KbQSdz.mjs}

@@ -1,14 +1,16 @@
-import { THEME_ASSET_MOUNT_PATH, applyTheme, applyUIPageHeaders, createThemeAssetsHandler, createThemeProvider, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, stampHtmlAttributes } from "@authup/server-console-kit";
+import { THEME_ASSET_MOUNT_PATH, applyTheme, applyUIPageHeaders, createApplication, createThemeAssetsHandler, createThemeProvider, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, stampHtmlAttributes } from "@authup/server-console-kit";
 import { AUTH_CONSOLE_SCHEMA, CORE_SCHEMA, ROOT_SCHEMA, SECTION_KEY, THEME_SCHEMA } from "@authup/server-config";
-import { buildSchemaDefaults, defineSchema, mergeSchemaData, readSchemaFromEnv, resolveSchemaData } from "@authup/server-config-kit";
+import { buildSchemaDefaults, defineSchema, mergeSchemaData, mountSchema, readSchemaFromEnv, resolveSchemaData } from "@authup/server-config-kit";
+import { Container } from "validup";
 import { createHandler } from "@routup/assets";
 import { basic } from "@routup/basic";
 import path from "node:path";
 import { App, defineCoreHandler } from "routup";
 import { Client } from "@authup/core-http-kit";
+import { getURLBasePath, isUUID } from "@authup/kit";
+import { OAuth2UIColorMode } from "@authup/specs";
 import { useRequestQuery } from "@routup/basic/query";
 import { InternalError } from "@authup/errors";
-import { getURLBasePath } from "@authup/kit";
 import { locateUpSync, read } from "locter";
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -36,17 +38,20 @@ const CONFIG_SCHEMA = defineSchema({
 	})
 });
 /**
-* Turn the configuration namespace into the service's own shape: fill the
-* defaults, derive the one key that is derived rather than configured, and
-* rename. An empty `url` means the console sits on server-core's own origin
+* Turn the configuration namespace into the service's own shape: validate the
+* input against the declared zod types, fill the defaults, derive the one key
+* that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin
 * under the default segment, which is the single-origin deployment.
 *
 * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
 * would let an input carrying one key of a section replace the whole section
 * and take every other key's default with it.
 */
-function resolveConfig(input) {
-	const values = resolveSchemaData(CONFIG_SCHEMA, mergeSchemaData(CONFIG_SCHEMA, buildSchemaDefaults(CONFIG_SCHEMA), input));
+async function resolveConfig(input) {
+	const validator = new Container();
+	mountSchema(validator, CONFIG_SCHEMA);
+	const parsed = await validator.run(input);
+	const values = resolveSchemaData(CONFIG_SCHEMA, mergeSchemaData(CONFIG_SCHEMA, buildSchemaDefaults(CONFIG_SCHEMA), parsed));
 	return {
 		url: values.url,
 		apiUrl: values.publicUrl,
@@ -62,12 +67,17 @@ function resolveConfig(input) {
 * `authup.yml` reaches this service through the CLI roles, which compose this
 * very registry into the one document loader.
 */
-function readConfigFromEnv() {
+async function readConfigFromEnv() {
 	return resolveConfig(readSchemaFromEnv(CONFIG_SCHEMA));
 }
 //#endregion
 //#region src/constants.ts
 /**
+* The render contract this service compiles against. The literal type fails
+* the build the moment the bundle's constant moves without this one.
+*/
+const CONTRACT_VERSION = 5;
+/**
 * The vite base the auth console bundle is built with. Asset hrefs in the
 * shell are emitted against it, so the service mounts its assets there and
 * rebases them only when the deployment carries a sub-path.
@@ -89,7 +99,8 @@ const PAGES = [
 	"/activate",
 	"/password-forgot",
 	"/password-reset",
-	"/logout"
+	"/logout",
+	"/device"
 ];
 /**
 * Where this service mounts the bundle's `assets/` directory. The public
@@ -237,96 +248,147 @@ function buildWorkflowPageData(event, features, options = {}) {
 	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
 	return data;
 }
+/**
+* The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`
+* parameter: a space-separated list of BCP47 tags in preference order.
+*
+* It rides the authorization request, so it survives the page GET's hop and
+* the rebuild a federated round-trip makes from the stored code request. The
+* four workflow pages take it straight from their own query, since an RP
+* linking to one can say the same thing there.
+*/
+function readUILocalesHint(event) {
+	const { ui_locales: uiLocales } = useRequestQuery(event);
+	if (typeof uiLocales !== "string") return;
+	return uiLocales.split(" ").find((tag) => /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(tag));
+}
+/**
+* The color mode the RP renders in, from authup's own `ui_color_mode`. One
+* value rather than a list, since there is nothing to negotiate.
+*
+* Checked against the enum rather than local literals because the realm's
+* discovery document ADVERTISES that same set as
+* `ui_color_modes_supported`: a second spelling here would let the pages and
+* the document disagree about what the deployment accepts.
+*/
+function readUIColorModeHint(event) {
+	const { ui_color_mode: uiColorMode } = useRequestQuery(event);
+	return typeof uiColorMode === "string" && Object.values(OAuth2UIColorMode).includes(uiColorMode) ? uiColorMode : void 0;
+}
+/**
+* The `user_code` the device page prefills (RFC 8628 section 3.3.1): the
+* query value uppercased and stripped of everything outside `A-Z0-9`, or
+* `undefined` when nothing bounded remains. The page renders it back, so what
+* reaches the payload is at most 16 alphanumeric characters.
+*/
+function readDeviceUserCode(event) {
+	const query = useRequestQuery(event);
+	if (typeof query.user_code !== "string") return;
+	const canonical = query.user_code.toUpperCase().replace(/[^A-Z0-9]/g, "");
+	if (canonical.length === 0 || canonical.length > 16) return;
+	return canonical;
+}
+/**
+* The provider a federated login on the device page came back from (#3589).
+* A routing hint and no secret: the pending login itself rides an HttpOnly
+* cookie. Anything that is not a uuid is dropped, the rule `/authorize`
+* reads its own hint by: the page interpolates the value into the
+* completion request path.
+*/
+function readDeviceFederatedLogin(event) {
+	const { provider } = useRequestQuery(event);
+	return typeof provider === "string" && isUUID(provider) ? { providerId: provider } : void 0;
+}
+/**
+* The refusal marker the federated callback may attach. A closed set of one,
+* so nothing request-derived is rendered.
+*/
+function readDeviceError(event) {
+	return useRequestQuery(event).error === "access_denied" ? "access_denied" : void 0;
+}
 //#endregion
 //#region src/path.ts
 const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_PATH = path.join(CODE_PATH, "..");
 //#endregion
 //#region src/resolve.ts
-let cachedPackagePath;
-let cachedDistPath;
-let overridePackagePath;
 /**
-* Point the resolution at a substituted package (config `distPath`)
-* instead of the node_modules walk. Called once at boot.
-*/
-function setPackagePath(value) {
-	overridePackagePath = value || void 0;
-	cachedPackagePath = void 0;
-	cachedDistPath = void 0;
-}
-/**
-* Locate the auth console package. The SSR auth workflow UI ships as
-* `@authup/client-auth-console` (a dependency of THIS service), so the
+* Locate the auth console package: a substituted one (config `distPath`)
+* first, else the SSR auth workflow UI shipped as
+* `@authup/client-auth-console` (a dependency of THIS service), which the
 * node_modules ancestor walk from this package's own root (locter's
-* `locateUp`) finds it for the workspace (symlink onto
-* apps/client-auth-console) and for a published install alike. Only a
-* positive result is cached.
+* `locateUp`) finds for the workspace (symlink onto
+* apps/client-auth-console) and for a published install alike.
 *
 * The `cwd` anchor is behavioural, not incidental: it decides which
 * node_modules tree is walked, so it stays pinned to this package rather
 * than to the process cwd.
 */
-function resolvePackagePath() {
-	if (cachedPackagePath) return cachedPackagePath;
-	if (overridePackagePath) {
-		cachedPackagePath = overridePackagePath;
-		return cachedPackagePath;
-	}
-	const manifest = locateUpSync("node_modules/@authup/client-auth-console/package.json", { cwd: PACKAGE_PATH });
-	if (manifest) cachedPackagePath = manifest.directory;
-	return cachedPackagePath;
+function resolvePackagePath(distPath) {
+	return distPath || locateUpSync("node_modules/@authup/client-auth-console/package.json", { cwd: PACKAGE_PATH })?.directory;
 }
 /**
 * Locate the BUILT auth console bundle (`dist/client` template + assets,
-* `dist/server/server.js` render entry). Only a positive result is cached,
-* so a dev building the package after boot is picked up on the next
-* request.
+* `dist/server/server.js` render entry). A half-built package is no bundle:
+* without the render entry there is nothing to render with.
 */
-function resolveDistPath() {
-	if (cachedDistPath) return cachedDistPath;
-	const packagePath = resolvePackagePath();
-	if (packagePath) {
-		const distPath = path.join(packagePath, "dist");
-		if (fs.existsSync(path.join(distPath, "client", "index.html"))) cachedDistPath = distPath;
-	}
-	return cachedDistPath;
+function resolveDistPath(distPath) {
+	const packagePath = resolvePackagePath(distPath);
+	if (!packagePath) return;
+	const candidate = path.join(packagePath, "dist");
+	if (fs.existsSync(path.join(candidate, "client", "index.html")) && fs.existsSync(path.join(candidate, "server", "server.js"))) return candidate;
 }
 //#endregion
 //#region src/render.ts
-let cachedHtml;
-let cachedManifest;
-let cachedRender;
-const renderPage = async (event, config, ctx) => {
-	const distPath = resolveDistPath();
-	if (!distPath) throw new InternalError("The auth console bundle (@authup/client-auth-console) is not built or installed.");
-	const html = cachedHtml ??= await fs.promises.readFile(path.join(distPath, "client", "index.html"), "utf-8");
-	const manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(distPath, "client", ".vite", "ssr-manifest.json"), "utf-8"));
-	const render = cachedRender ??= (await read(path.join(distPath, "server", "server.js"))).render;
-	const preferences = readUIClientPreferences(event);
-	const basePath = getURLBasePath(config.url);
-	const payload = {
-		config: {
-			baseURL: config.apiUrl,
-			basePath,
-			colorMode: preferences.colorMode,
-			locale: preferences.locale
-		},
-		data: ctx.data
+/**
+* Refuse a bundle built against another render contract at boot, naming the
+* entry and both versions, instead of failing per request on `/authorize`.
+* A bundle predating the export is version 1. Reads the module itself, which
+* Node's ESM cache then hands the render for free.
+*/
+async function assertRenderContract(distPath) {
+	const entry = path.join(distPath, "server", "server.js");
+	const version = (await read(entry)).CONTRACT_VERSION ?? 1;
+	if (version !== 5) throw new InternalError(`The auth console bundle "${entry}" implements render-contract version ${version}, but this service requires 5. Rebuild it against the current @authup/client-auth-console contract.`);
+}
+function createRenderPage(distPath) {
+	let cachedDistPath;
+	let cachedHtml;
+	let cachedManifest;
+	let cachedRender;
+	return async (event, config, ctx) => {
+		const resolved = cachedDistPath ??= resolveDistPath(distPath);
+		if (!resolved) throw new InternalError("The auth console bundle (@authup/client-auth-console) is not built or installed.");
+		const html = cachedHtml ??= await fs.promises.readFile(path.join(resolved, "client", "index.html"), "utf-8");
+		const manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(resolved, "client", ".vite", "ssr-manifest.json"), "utf-8"));
+		const render = cachedRender ??= (await read(path.join(resolved, "server", "server.js"))).render;
+		const preferences = readUIClientPreferences(event);
+		if (!preferences.locale || preferences.locale === "auto") preferences.locale = readUILocalesHint(event) || preferences.locale;
+		if (!preferences.colorMode || preferences.colorMode === "system") preferences.colorMode = readUIColorModeHint(event) || preferences.colorMode;
+		const basePath = getURLBasePath(config.url);
+		const payload = {
+			config: {
+				baseURL: config.apiUrl,
+				basePath,
+				colorMode: preferences.colorMode,
+				locale: preferences.locale
+			},
+			data: ctx.data
+		};
+		const [appHtml, preloadLinks] = await render({
+			url: ctx.url,
+			manifest,
+			payload
+		});
+		let body = replaceTemplateMarker(html, "<!--preload-links-->", preloadLinks);
+		body = replaceTemplateMarker(body, "<!--app-html-->", appHtml);
+		body = stampHtmlAttributes(body, preferences);
+		body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);
+		body = await applyTheme(body, ctx.theme, basePath);
+		applyUIPageHeaders(event);
+		return body;
 	};
-	const [appHtml, preloadLinks] = await render({
-		url: ctx.url,
-		manifest,
-		payload
-	});
-	let body = replaceTemplateMarker(html, "<!--preload-links-->", preloadLinks);
-	body = replaceTemplateMarker(body, "<!--app-html-->", appHtml);
-	body = stampHtmlAttributes(body, preferences);
-	body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);
-	body = await applyTheme(body, ctx.theme, basePath);
-	applyUIPageHeaders(event);
-	return body;
-};
+}
 //#endregion
 //#region src/handler.ts
 const WORKFLOW_PAGES = [
@@ -357,8 +419,8 @@ const WORKFLOW_PAGES = [
 * proxy, so a service published at `<origin>/console/auth` receives
 * `/authorize`, exactly as server-core received it before the split.
 */
-async function createHandler$1(config, themeProvider, render = renderPage) {
-	setPackagePath(config.distPath);
+async function createHandler$1(config, themeProvider, render) {
+	const renderPage = render ?? createRenderPage(config.distPath);
 	const app = new App();
 	const client = createAPIClient(config);
 	const readFeatures = createFeaturesReader(client);
@@ -376,7 +438,7 @@ async function createHandler$1(config, themeProvider, render = renderPage) {
 	app.use(defineCoreHandler({
 		method: "get",
 		path: "/authorize",
-		fn: async (event) => render(event, config, {
+		fn: async (event) => renderPage(event, config, {
 			url: "/authorize",
 			data: await readAuthorizeInfo(client, event),
 			theme
@@ -387,7 +449,7 @@ async function createHandler$1(config, themeProvider, render = renderPage) {
 		path: page.url,
 		fn: async (event) => {
 			const features = await readFeatures();
-			return render(event, config, {
+			return renderPage(event, config, {
 				url: page.url,
 				data: buildWorkflowPageData(event, features, page),
 				theme
@@ -397,31 +459,60 @@ async function createHandler$1(config, themeProvider, render = renderPage) {
 	app.use(defineCoreHandler({
 		method: "get",
 		path: "/logout",
-		fn: async (event) => render(event, config, {
+		fn: async (event) => renderPage(event, config, {
 			url: "/logout",
 			data: {},
 			theme
 		})
 	}));
-	const distPath = resolveDistPath();
-	if (distPath) app.use(ASSETS_PATH, createHandler(path.posix.join(distPath, "client", "assets"), {
-		fallthrough: false,
-		scan: false
+	app.use(defineCoreHandler({
+		method: "get",
+		path: "/device",
+		fn: async (event) => renderPage(event, config, {
+			url: "/device",
+			data: {
+				features: await readFeatures(),
+				userCode: readDeviceUserCode(event),
+				federatedLogin: readDeviceFederatedLogin(event),
+				error: readDeviceError(event)
+			},
+			theme
+		})
 	}));
+	const distPath = resolveDistPath(config.distPath);
+	if (distPath) {
+		if (!render) await assertRenderContract(distPath);
+		app.use(ASSETS_PATH, createHandler(path.posix.join(distPath, "client", "assets"), {
+			fallthrough: false,
+			scan: false,
+			cacheMaxAge: 31536e3,
+			cacheImmutable: true
+		}));
+	}
 	return app;
 }
 //#endregion
-//#region src/server.ts
+//#region src/application.ts
 /**
-* The standalone service: the same handler the CLI mounts in process,
-* behind a listener of its own.
+* This console as a runnable service: its own module graph, its own
+* container, its own lifecycle, and nothing of server-core's. It is what
+* `authup start console` starts, what the `authup-auth-console` bin starts, and what
+* `authup start` composes onto its own listener, so no caller reaches past
+* the graph for a bare handler.
+*
+* `config` defaults to a FACTORY, not a value: resolving it reads the
+* document, and a console started alongside others must not do that at
+* construction time, before the caller has said where to look. Pass
+* `listen: false` to be mounted on someone else's listener.
 */
-async function createServer(config) {
-	const app = new App();
-	app.use(await createHandler$1(config));
-	return app;
+function createApplication$1(context = {}) {
+	return createApplication({
+		listen: context.listen,
+		config: context.config ?? readConfigFromEnv,
+		createHandler: (resolved, theme) => createHandler$1(resolved, theme)
+	});
 }
 //#endregion
-export { CONFIG_SCHEMA as _, resolvePackagePath as a, createAPIClient as c, sanitizeRelativeRedirect as d, ASSETS_PATH as f, VITE_BASE as g, PAGES as h, resolveDistPath as i, createFeaturesReader as l, HEALTH_PATH as m, createHandler$1 as n, setPackagePath as o, BASE_PATH as p, renderPage as r, buildWorkflowPageData as s, createServer as t, readAuthorizeInfo as u, readConfigFromEnv as v, resolveConfig as y };
+export { CONFIG_SCHEMA as C, VITE_BASE as S, resolveConfig as T, ASSETS_PATH as _, resolveDistPath as a, HEALTH_PATH as b, createAPIClient as c, readDeviceError as d, readDeviceFederatedLogin as f, sanitizeRelativeRedirect as g, readUILocalesHint as h, createRenderPage as i, createFeaturesReader as l, readUIColorModeHint as m, createHandler$1 as n, resolvePackagePath as o, readDeviceUserCode as p, assertRenderContract as r, buildWorkflowPageData as s, createApplication$1 as t, readAuthorizeInfo as u, BASE_PATH as v, readConfigFromEnv as w, PAGES as x, CONTRACT_VERSION as y };
 
-//# sourceMappingURL=server-Brhsp_x-.mjs.map
+//# sourceMappingURL=application-h8KbQSdz.mjs.map

package/dist/application-h8KbQSdz.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-h8KbQSdz.mjs","names":["createHandler","createAssetsHandler","createApplication","createConsoleApplication","createHandler"],"sources":["../src/config.ts","../src/constants.ts","../src/redirect.ts","../src/payload.ts","../src/path.ts","../src/resolve.ts","../src/render.ts","../src/handler.ts","../src/application.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AUTH_CONSOLE_SCHEMA,\n    CORE_SCHEMA,\n    ROOT_SCHEMA,\n    SECTION_KEY,\n    THEME_SCHEMA,\n} from '@authup/server-config';\nimport {\n    buildSchemaDefaults,\n    defineSchema,\n    mergeSchemaData,\n    mountSchema,\n    readSchemaFromEnv,\n    resolveSchemaData,\n} from '@authup/server-config-kit';\nimport { Container } from 'validup';\nimport type { CoreConfig, EnvironmentVariable } from '@authup/server-config';\nimport type { Config, ConfigInput } from './types';\n\n/**\n * The keys this service reads, SELECTED out of the document schema by name.\n *\n * Nothing is declared here: every key of `authup.yml` is declared once in\n * `@authup/server-config`, so this service cannot spell a path, an\n * environment variable, a default or a reader differently from server-core,\n * which reads several of the same keys. Neither package depends on the other;\n * both depend on the declaration.\n *\n * Its own section is spread, so this service reads it in its own vocabulary\n * (`url`, `port`, `host`); every other section stays under the key the\n * document nests it at.\n */\nexport const CONFIG_SCHEMA = defineSchema<ConfigInput, 'publicUrl' | 'internalUrl' | 'db'>({\n    ...AUTH_CONSOLE_SCHEMA,\n    ...ROOT_SCHEMA,\n    [SECTION_KEY.THEME]: THEME_SCHEMA,\n    // Two keys of core, never the section. `publicUrl` derives from\n    // the core listener address, which is what a console needs; selecting the\n    // whole section also selects its INVARIANTS, and `resolveSchemaData` runs\n    // every resolver in a registry -- so a console would refuse to start on a\n    // short SECRETS_ENCRYPTION_KEY, or on mfaRequired without mfaEnabled, for\n    // keys it has no database, key store or MFA to use.\n    [SECTION_KEY.CORE]: defineSchema<Pick<CoreConfig, 'host' | 'port'>, never, EnvironmentVariable>({\n        host: CORE_SCHEMA.host,\n        port: CORE_SCHEMA.port,\n    }),\n});\n\n/**\n * Turn the configuration namespace into the service's own shape: validate the\n * input against the declared zod types, fill the defaults, derive the one key\n * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin\n * under the default segment, which is the single-origin deployment.\n *\n * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread\n * would let an input carrying one key of a section replace the whole section\n * and take every other key's default with it.\n */\nexport async function resolveConfig(\n    input: Partial<ConfigInput>,\n) : Promise<Config> {\n    const validator = new Container<ConfigInput>();\n    mountSchema(validator, CONFIG_SCHEMA);\n\n    const parsed = await validator.run(input);\n\n    const values = resolveSchemaData<ConfigInput>(\n        CONFIG_SCHEMA,\n        mergeSchemaData<ConfigInput>(\n            CONFIG_SCHEMA,\n            buildSchemaDefaults<ConfigInput>(CONFIG_SCHEMA),\n            parsed,\n        ),\n    ) as ConfigInput;\n\n    return {\n        url: values.url,\n        apiUrl: values.publicUrl,\n        // `internalUrl` falls back to `publicUrl`, so an operator who has one\n        // address for both sides configures nothing. The composed `authup\n        // start` overrides this with its own listen address unless the\n        // document named one.\n        apiInternalUrl: values.internalUrl,\n        port: values.port,\n        host: values.host,\n        distPath: values.path,\n        theme: values.theme,\n    };\n}\n\n/**\n * The standalone entry's configuration, read from the environment alone.\n * `authup.yml` reaches this service through the CLI roles, which compose this\n * very registry into the one document loader.\n */\nexport async function readConfigFromEnv() : Promise<Config> {\n    // The explicit type argument is load-bearing: inferred from the schema\n    // object, a key declared without a default (the derived publicUrl) comes\n    // back as unknown.\n    const input : Partial<ConfigInput> = readSchemaFromEnv<ConfigInput>(CONFIG_SCHEMA);\n\n    return resolveConfig(input);\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { CONTRACT_VERSION as BundleContractVersion } from '@authup/client-auth-console';\n\n/**\n * The render contract this service compiles against. The literal type fails\n * the build the moment the bundle's constant moves without this one.\n */\nexport const CONTRACT_VERSION : typeof BundleContractVersion = 5;\n\n/**\n * The vite base the auth console bundle is built with. Asset hrefs in the\n * shell are emitted against it, so the service mounts its assets there and\n * rebases them only when the deployment carries a sub-path.\n */\nexport const VITE_BASE = '/console/auth/';\n\n/**\n * The path the service is served under by default, i.e. the path component\n * of `authConsole.url`. It is the same segment server-core mounted\n * the assets at before the split, so a built bundle needs no rebuild.\n */\nexport const BASE_PATH = '/console/auth';\n\n/**\n * The pages the service renders. Each is a route of the console bundle's\n * own router, and each is what a server-core page GET now redirects to.\n */\nexport const PAGES = [\n    '/authorize',\n    '/register',\n    '/activate',\n    '/password-forgot',\n    '/password-reset',\n    '/logout',\n    '/device',\n] as const;\n\n/**\n * Where this service mounts the bundle's `assets/` directory. The public\n * asset URL is the service's own public path plus this route, which is what\n * the bundle's fixed vite base is rebased onto.\n */\nexport const ASSETS_PATH = '/assets';\n\nexport const HEALTH_PATH = '/healthy';\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { AuthorizeInfo, StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport { Client } from '@authup/core-http-kit';\nimport { isUUID } from '@authup/kit';\nimport { OAuth2UIColorMode } from '@authup/specs';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from './redirect';\nimport type { Config } from './types';\n\n/**\n * The service hydrates ANONYMOUSLY. It holds no credential of its own and\n * asks server-core only for what an unauthenticated visitor may see, which\n * is the whole of what these pages render.\n *\n * It dispatches against `apiInternalUrl`, never the browser-facing `apiUrl`:\n * this is a server-side call, so it must not depend on the public address\n * resolving from inside the deployment. Unlike server-core's own internal\n * client the swap is on `baseURL` rather than at the transport layer,\n * because nothing derived from it reaches a caller -- there is no\n * `redirect_uri` here to be compared byte for byte later.\n */\nexport function createAPIClient(config: Config) : Client {\n    return new Client({ baseURL: config.apiInternalUrl });\n}\n\n/**\n * Report an outbound failure to the operator and raise one the visitor may\n * see, which is deliberately not the same error.\n *\n * hapic embeds the resolved request URL in its message, and this service has\n * no error middleware: routup answers with `event.error.message` verbatim, on\n * the public login page. That URL is `apiInternalUrl`, which on a split\n * deployment names a service on the operator's own network, so an API that is\n * merely down would publish its internal address to every anonymous visitor.\n * It was harmless while the value was `publicUrl`, an address the browser\n * already had.\n *\n * The rule and the remedy are server-core's own (`sanitizeError` /\n * `describeError`): the caller gets a message it can act on, the detail goes\n * to the log. `console.error` rather than a logger because a console handler\n * is built from a config alone and is given none -- and because this line is\n * the only trace such a failure leaves, which is how #3550 was diagnosed in\n * the first place.\n */\nfunction failWithoutAddress(error: unknown) : never {\n    // eslint-disable-next-line no-console\n    console.error('[authup] the auth console could not reach the API:', error);\n\n    throw new Error('The identity provider could not be reached.');\n}\n\n/**\n * The feature flags every workflow page gates its form on. A page that\n * cannot reach them must not silently claim a workflow is disabled, so the\n * failure propagates rather than defaulting to false.\n *\n * Read ONCE and held for the reader's lifetime, the same shape render.ts\n * keeps for the dist template, manifest and render entry: `GET /` reports\n * the version and the boot-config feature flags, none of which changes\n * without a restart, so a TTL would be a number with nothing behind it.\n * Without it every workflow page render is an API call, and under the\n * composed `authup start` those all arrive over loopback on one shared\n * rate-limit key. Only a SUCCESS is held, so an API that was down at the\n * first render is retried rather than remembered as broken.\n *\n * The cache is instance-scoped rather than module-scoped (098 C4): the\n * answer depends on which API the client was built against, so two handlers\n * in one process must not share one, and a module slot would additionally\n * leak between test cases.\n */\nexport function createFeaturesReader(client: Client) : () => Promise<StatusResponseFeatures> {\n    let cached : StatusResponseFeatures | undefined;\n    let pending : Promise<StatusResponseFeatures> | undefined;\n\n    return () => {\n        if (cached) {\n            return Promise.resolve(cached);\n        }\n\n        if (pending) {\n            return pending;\n        }\n\n        pending = client.status.get()\n            .then((status: StatusResponse) => {\n                cached = status.features;\n\n                return cached;\n            })\n            .catch((e) => failWithoutAddress(e));\n\n        const clear = () => {\n            pending = undefined;\n        };\n        pending.then(clear, clear);\n\n        return pending;\n    };\n}\n\n/**\n * The `/authorize` render input, resolved by server-core (plan 101 D2-1).\n * The browser's query is forwarded verbatim: the answer is derived from all\n * of it, the `provider` hint and the closed `error` marker set included.\n */\nexport async function readAuthorizeInfo(client: Client, event: IAppEvent) : Promise<AuthorizeInfo> {\n    const { search } = new URL(event.request.url);\n\n    try {\n        return await client.authorize.getInfo(search);\n    } catch (e) {\n        return failWithoutAddress(e);\n    }\n}\n\nexport type WorkflowPageOptions = {\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * The payload the four workflow pages render from: the feature flags plus\n * the handful of query params each one declares. Unchanged from the\n * assembly server-core did before the split, including the open-redirect\n * guard on `redirect`.\n */\nexport function buildWorkflowPageData(\n    event: IAppEvent,\n    features: StatusResponseFeatures,\n    options: WorkflowPageOptions = {},\n) : Record<string, any> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return data;\n}\n\n/**\n * The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`\n * parameter: a space-separated list of BCP47 tags in preference order.\n *\n * It rides the authorization request, so it survives the page GET's hop and\n * the rebuild a federated round-trip makes from the stored code request. The\n * four workflow pages take it straight from their own query, since an RP\n * linking to one can say the same thing there.\n */\nexport function readUILocalesHint(event: IAppEvent) : string | undefined {\n    const { ui_locales: uiLocales } = useRequestQuery(event);\n    if (typeof uiLocales !== 'string') {\n        return undefined;\n    }\n\n    // ponytail: the first well-formed tag wins, and it is NOT narrowed to a\n    // locale authup has a catalog for. That is the latitude the navigator\n    // path already takes -- a `de-CH` visitor is stamped `lang=\"de-CH\"` and\n    // reads the `de` catalog. Narrow here (matchLocale over LOCALES) if the\n    // lang attribute ever has to name only an authored locale, which costs\n    // this service a dependency on @authup/i18n.\n    return uiLocales\n        .split(' ')\n        .find((tag) => /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(tag));\n}\n\n/**\n * The color mode the RP renders in, from authup's own `ui_color_mode`. One\n * value rather than a list, since there is nothing to negotiate.\n *\n * Checked against the enum rather than local literals because the realm's\n * discovery document ADVERTISES that same set as\n * `ui_color_modes_supported`: a second spelling here would let the pages and\n * the document disagree about what the deployment accepts.\n */\nexport function readUIColorModeHint(event: IAppEvent) : string | undefined {\n    const { ui_color_mode: uiColorMode } = useRequestQuery(event);\n\n    return typeof uiColorMode === 'string' &&\n        (Object.values(OAuth2UIColorMode) as string[]).includes(uiColorMode) ?\n        uiColorMode :\n        undefined;\n}\n\n/**\n * The `user_code` the device page prefills (RFC 8628 section 3.3.1): the\n * query value uppercased and stripped of everything outside `A-Z0-9`, or\n * `undefined` when nothing bounded remains. The page renders it back, so what\n * reaches the payload is at most 16 alphanumeric characters.\n */\nexport function readDeviceUserCode(event: IAppEvent) : string | undefined {\n    const query = useRequestQuery(event);\n    if (typeof query.user_code !== 'string') {\n        return undefined;\n    }\n\n    const canonical = query.user_code.toUpperCase().replace(/[^A-Z0-9]/g, '');\n    if (canonical.length === 0 || canonical.length > 16) {\n        return undefined;\n    }\n\n    return canonical;\n}\n\n/**\n * The provider a federated login on the device page came back from (#3589).\n * A routing hint and no secret: the pending login itself rides an HttpOnly\n * cookie. Anything that is not a uuid is dropped, the rule `/authorize`\n * reads its own hint by: the page interpolates the value into the\n * completion request path.\n */\nexport function readDeviceFederatedLogin(event: IAppEvent) : { providerId: string } | undefined {\n    const { provider } = useRequestQuery(event);\n\n    return typeof provider === 'string' && isUUID(provider) ?\n        { providerId: provider } :\n        undefined;\n}\n\n/**\n * The refusal marker the federated callback may attach. A closed set of one,\n * so nothing request-derived is rendered.\n */\nexport function readDeviceError(event: IAppEvent) : 'access_denied' | undefined {\n    return useRequestQuery(event).error === 'access_denied' ? 'access_denied' : undefined;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from './path';\n\n/**\n * Locate the auth console package: a substituted one (config `distPath`)\n * first, else the SSR auth workflow UI shipped as\n * `@authup/client-auth-console` (a dependency of THIS service), which the\n * node_modules ancestor walk from this package's own root (locter's\n * `locateUp`) finds for the workspace (symlink onto\n * apps/client-auth-console) and for a published install alike.\n *\n * The `cwd` anchor is behavioural, not incidental: it decides which\n * node_modules tree is walked, so it stays pinned to this package rather\n * than to the process cwd.\n */\nexport function resolvePackagePath(distPath?: string) : string | undefined {\n    return distPath || locateUpSync(\n        'node_modules/@authup/client-auth-console/package.json',\n        { cwd: PACKAGE_PATH },\n    )?.directory;\n}\n\n/**\n * Locate the BUILT auth console bundle (`dist/client` template + assets,\n * `dist/server/server.js` render entry). A half-built package is no bundle:\n * without the render entry there is nothing to render with.\n */\nexport function resolveDistPath(distPath?: string) : string | undefined {\n    const packagePath = resolvePackagePath(distPath);\n    if (!packagePath) {\n        return undefined;\n    }\n\n    const candidate = path.join(packagePath, 'dist');\n    if (\n        fs.existsSync(path.join(candidate, 'client', 'index.html')) &&\n        fs.existsSync(path.join(candidate, 'server', 'server.js'))\n    ) {\n        return candidate;\n    }\n\n    return undefined;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { HydrationPayload, RenderFunction } from '@authup/client-auth-console';\nimport { InternalError } from '@authup/errors';\nimport { getURLBasePath } from '@authup/kit';\nimport {\n    applyTheme,\n    applyUIPageHeaders,\n    readUIClientPreferences,\n    rebaseAssetURLs,\n    replaceTemplateMarker,\n    stampHtmlAttributes,\n} from '@authup/server-console-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { CONTRACT_VERSION, VITE_BASE } from './constants';\nimport { readUIColorModeHint, readUILocalesHint } from './payload';\nimport { resolveDistPath } from './resolve';\nimport type { RenderPage } from './types';\n\n/**\n * Refuse a bundle built against another render contract at boot, naming the\n * entry and both versions, instead of failing per request on `/authorize`.\n * A bundle predating the export is version 1. Reads the module itself, which\n * Node's ESM cache then hands the render for free.\n */\nexport async function assertRenderContract(distPath: string) : Promise<void> {\n    const entry = path.join(distPath, 'server', 'server.js');\n    const bundle = await read(entry) as Record<string, any>;\n    const version = bundle.CONTRACT_VERSION ?? 1;\n\n    if (version !== CONTRACT_VERSION) {\n        throw new InternalError(\n            `The auth console bundle \"${entry}\" implements render-contract version ${version}, ` +\n            `but this service requires ${CONTRACT_VERSION}. ` +\n            'Rebuild it against the current @authup/client-auth-console contract.',\n        );\n    }\n}\n\nexport function createRenderPage(distPath?: string) : RenderPage {\n    // Per-handler caches for the immutable production SSR assets: the dist\n    // template, manifest and server bundle do not change after boot, so read\n    // them once instead of per request (the auth/login routes are hot paths).\n    // Held in this closure rather than at module scope so a second handler in\n    // the process, with a substituted package, never renders another's\n    // template. Only a resolved dist is kept, so a bundle built after boot is\n    // picked up on the next request.\n    let cachedDistPath: string | undefined;\n    let cachedHtml: string | undefined;\n    let cachedManifest: Record<string, any> | undefined;\n    let cachedRender: RenderFunction | undefined;\n\n    return async (event, config, ctx) => {\n        const resolved = (cachedDistPath ??= resolveDistPath(distPath));\n        if (!resolved) {\n            throw new InternalError(\n                'The auth console bundle (@authup/client-auth-console) is not built or installed.',\n            );\n        }\n\n        const html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(resolved, 'client', 'index.html'),\n            'utf-8',\n        ));\n        const manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(resolved, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        const render = (cachedRender ??= (await read(\n            path.join(resolved, 'server', 'server.js'),\n        )).render as RenderFunction);\n\n        // The client app hydrates locale + color-mode from the payload, so it\n        // adopts the same values the HTML shell is stamped with below.\n        const preferences = readUIClientPreferences(event);\n\n        // `ui_locales` is what the RP says the visitor is reading over there,\n        // which is fresher than anything this origin knows about a visitor\n        // arriving for the first time. It seeds the page only while they have\n        // made no choice HERE: `vc-locale` holds `auto` until the switcher\n        // writes a tag (@vuecs/locale never writes the resolved value back),\n        // so an explicit choice keeps winning and the switcher cannot be\n        // undone by the next authorize request carrying the hint. Seeding is\n        // all it does -- the ref starts there, and nothing writes it back.\n        if (!preferences.locale || preferences.locale === 'auto') {\n            preferences.locale = readUILocalesHint(event) || preferences.locale;\n        }\n\n        // `ui_color_mode` the same way, and `system` is its `auto`: the\n        // switcher is a binary toggle, so it only ever writes `light` or\n        // `dark`, and anything else in the cookie means the visitor never\n        // touched it here.\n        if (!preferences.colorMode || preferences.colorMode === 'system') {\n            preferences.colorMode = readUIColorModeHint(event) || preferences.colorMode;\n        }\n\n        // `baseURL` is server-core's public URL: the console derives its HTTP\n        // client and its cookie path from it. `basePath` is where THIS service\n        // is served, which is what the router and every inter-page href need.\n        // Before the split the two were the same value; they are not any more,\n        // so the console reads them separately.\n        const basePath = getURLBasePath(config.url);\n\n        const payload : HydrationPayload = {\n            config: {\n                baseURL: config.apiUrl,\n                basePath,\n                colorMode: preferences.colorMode,\n                locale: preferences.locale,\n            },\n            data: ctx.data,\n        };\n\n        const [appHtml, preloadLinks] = await render({\n            url: ctx.url,\n            manifest,\n            payload,\n        });\n\n        let body = replaceTemplateMarker(html, '<!--preload-links-->', preloadLinks);\n        body = replaceTemplateMarker(body, '<!--app-html-->', appHtml);\n\n        body = stampHtmlAttributes(body, preferences);\n\n        // This service mounts the bundle's assets at its own /assets, so the\n        // fixed vite base in every href is replaced by this service's public\n        // path. The vite base was decided when the bundle was built and says\n        // nothing about where the service is published.\n        body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);\n\n        // The theme's own asset urls are built from the same base, and the\n        // service mounts them under it, so a themed deployment needs no rule of\n        // its own at the reverse proxy beyond the one that reaches this service.\n        body = await applyTheme(body, ctx.theme, basePath);\n\n        applyUIPageHeaders(event);\n\n        return body;\n    };\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IThemeProvider } from '@authup/server-console-kit';\nimport {\n    THEME_ASSET_MOUNT_PATH,\n    createThemeAssetsHandler,\n    createThemeProvider,\n} from '@authup/server-console-kit';\nimport { createHandler as createAssetsHandler } from '@routup/assets';\nimport { basic } from '@routup/basic';\nimport path from 'node:path';\nimport type { IApp } from 'routup';\nimport { App, defineCoreHandler } from 'routup';\nimport { ASSETS_PATH, HEALTH_PATH } from './constants';\nimport {\n    buildWorkflowPageData,\n    createAPIClient,\n    createFeaturesReader,\n    readAuthorizeInfo,\n    readDeviceError,\n    readDeviceFederatedLogin,\n    readDeviceUserCode,\n} from './payload';\nimport { assertRenderContract, createRenderPage } from './render';\nimport { resolveDistPath } from './resolve';\nimport type { Config, RenderPage } from './types';\n\nconst WORKFLOW_PAGES : {\n    url: string,\n    realmAware?: boolean,\n    tokenAware?: boolean\n}[] = [\n    { url: '/register', realmAware: true },\n    { url: '/activate', tokenAware: true },\n    { url: '/password-forgot', realmAware: true },\n    {\n        url: '/password-reset',\n        realmAware: true,\n        tokenAware: true,\n    },\n];\n\n/**\n * The service as a mountable routup handler, so the CLI can compose it onto\n * server-core's own listener for the single-container deployment while a\n * split deployment runs it behind its own server.\n *\n * The paths are prefix-free. authup assumes a prefix-stripping reverse\n * proxy, so a service published at `<origin>/console/auth` receives\n * `/authorize`, exactly as server-core received it before the split.\n */\nexport async function createHandler(\n    config: Config,\n    themeProvider?: IThemeProvider,\n    render?: RenderPage,\n) : Promise<IApp> {\n    const renderPage = render ?? createRenderPage(config.distPath);\n\n    const app = new App();\n    const client = createAPIClient(config);\n    const readFeatures = createFeaturesReader(client);\n\n    // The shell is stamped from the vc-locale / vc-color-mode cookies, and\n    // without the plugin every cookie read answers undefined, which is a\n    // silent flash of the wrong color mode on every full load. server-core\n    // registers it globally, so a mounted handler inherits one; a standalone\n    // service has nothing above it.\n    app.use(basic({ cookie: true, query: true }));\n\n    // A missing directory disables theming entirely: no provider is created\n    // and the rendered pages are byte-identical to the un-themed ones, so the\n    // default configuration pays nothing. An invalid manifest throws here and\n    // fails the boot rather than surfacing per request.\n    // Injected by the theme module when this runs inside the console\n    // application; built here for a caller holding only a config.\n    const theme = themeProvider ?? await createThemeProvider(config);\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: HEALTH_PATH,\n        fn: () => ({ status: 'ok' }),\n    }));\n\n    if (theme) {\n        app.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(theme));\n    }\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/authorize',\n        fn: async (event) => renderPage(event, config, {\n            url: '/authorize',\n            data: await readAuthorizeInfo(client, event),\n            theme,\n        }),\n    }));\n\n    for (const page of WORKFLOW_PAGES) {\n        app.use(defineCoreHandler({\n            method: 'get',\n            path: page.url,\n            fn: async (event) => {\n                const features = await readFeatures();\n\n                return renderPage(event, config, {\n                    url: page.url,\n                    data: buildWorkflowPageData(event, features, page),\n                    theme,\n                });\n            },\n        }));\n    }\n\n    // The logout page needs nothing resolved up front: it drives the\n    // end-session call itself and renders from the answer, so the render\n    // stays a pure shell and no request reaches server-core here.\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/logout',\n        fn: async (event) => renderPage(event, config, {\n            url: '/logout',\n            data: {},\n            theme,\n        }),\n    }));\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/device',\n        fn: async (event) => renderPage(event, config, {\n            url: '/device',\n            data: {\n                features: await readFeatures(),\n                userCode: readDeviceUserCode(event),\n                federatedLogin: readDeviceFederatedLogin(event),\n                error: readDeviceError(event),\n            },\n            theme,\n        }),\n    }));\n\n    // Only the assets directory is mounted, never dist/client itself: the\n    // template and the ssr manifest are inputs of the render, not files to\n    // serve. A missing bundle only disables the mount; the page routes\n    // report the actionable error. A resolved one is checked against the\n    // render contract here, unless a substituted render never reads it.\n    const distPath = resolveDistPath(config.distPath);\n    if (distPath) {\n        if (!render) {\n            await assertRenderContract(distPath);\n        }\n\n        // Every name carries a content hash, so a new build means new names.\n        app.use(ASSETS_PATH, createAssetsHandler(\n            path.posix.join(distPath, 'client', 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n                cacheMaxAge: 60 * 60 * 24 * 365,\n                cacheImmutable: true,\n            },\n        ));\n    }\n\n    return app;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createApplication as createConsoleApplication } from '@authup/server-console-kit';\nimport type { CreateApplicationContext } from '@authup/server-console-kit';\nimport type { Application } from 'orkos';\nimport { readConfigFromEnv } from './config';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * This console as a runnable service: its own module graph, its own\n * container, its own lifecycle, and nothing of server-core's. It is what\n * `authup start console` starts, what the `authup-auth-console` bin starts, and what\n * `authup start` composes onto its own listener, so no caller reaches past\n * the graph for a bare handler.\n *\n * `config` defaults to a FACTORY, not a value: resolving it reads the\n * document, and a console started alongside others must not do that at\n * construction time, before the caller has said where to look. Pass\n * `listen: false` to be mounted on someone else's listener.\n */\nexport function createApplication(\n    context: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>> = {},\n) : Application {\n    return createConsoleApplication<Config>({\n        listen: context.listen,\n        config: context.config ?? readConfigFromEnv,\n        createHandler: (resolved, theme) => createHandler(resolved, theme),\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,MAAa,gBAAgB,aAA8D;CACvF,GAAG;CACH,GAAG;EACF,YAAY,QAAQ;EAOpB,YAAY,OAAO,aAA4E;EAC5F,MAAM,YAAY;EAClB,MAAM,YAAY;CACtB,CAAC;AACL,CAAC;;;;;;;;;;;AAYD,eAAsB,cAClB,OACgB;CAChB,MAAM,YAAY,IAAI,UAAuB;CAC7C,YAAY,WAAW,aAAa;CAEpC,MAAM,SAAS,MAAM,UAAU,IAAI,KAAK;CAExC,MAAM,SAAS,kBACX,eACA,gBACI,eACA,oBAAiC,aAAa,GAC9C,MACJ,CACJ;CAEA,OAAO;EACH,KAAK,OAAO;EACZ,QAAQ,OAAO;EAKf,gBAAgB,OAAO;EACvB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,OAAO,OAAO;CAClB;AACJ;;;;;;AAOA,eAAsB,oBAAsC;CAMxD,OAAO,cAF8B,kBAA+B,aAE3C,CAAC;AAC9B;;;;;;;AChGA,MAAa,mBAAkD;;;;;;AAO/D,MAAa,YAAY;;;;;;AAOzB,MAAa,YAAY;;;;;AAMzB,MAAa,QAAQ;CACjB;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;AAOA,MAAa,cAAc;AAE3B,MAAa,cAAc;;;;;;;;;;;;;;;AC/B3B,SAAgB,yBAAyB,OAAoC;CACzE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAC9C;CAMJ,IAAI,wBAAwB,KAAK,KAAK,GAClC;CAGJ,IAAI;CACJ,IAAI;EACA,UAAU,mBAAmB,KAAK;CACtC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwB,KAAK,OAAO,GACpC;CAGJ,KAAK,MAAM,aAAa,CAAC,OAAO,OAAO,GAAG;EACtC,IAAI,CAAC,UAAU,WAAW,GAAG,GACzB;EAEJ,IAAI,UAAU,SAAS,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,OAClE;EAEJ,IAAI,UAAU,SAAS,IAAI,GACvB;CAER;CAEA,OAAO;AACX;;;;;;;;;;;;;;;AC/BA,SAAgB,gBAAgB,QAAyB;CACrD,OAAO,IAAI,OAAO,EAAE,SAAS,OAAO,eAAe,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,mBAAmB,OAAwB;CAEhD,QAAQ,MAAM,sDAAsD,KAAK;CAEzE,MAAM,IAAI,MAAM,6CAA6C;AACjE;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,qBAAqB,QAAwD;CACzF,IAAI;CACJ,IAAI;CAEJ,aAAa;EACT,IAAI,QACA,OAAO,QAAQ,QAAQ,MAAM;EAGjC,IAAI,SACA,OAAO;EAGX,UAAU,OAAO,OAAO,IAAI,CAAC,CACxB,MAAM,WAA2B;GAC9B,SAAS,OAAO;GAEhB,OAAO;EACX,CAAC,CAAC,CACD,OAAO,MAAM,mBAAmB,CAAC,CAAC;EAEvC,MAAM,cAAc;GAChB,UAAU,KAAA;EACd;EACA,QAAQ,KAAK,OAAO,KAAK;EAEzB,OAAO;CACX;AACJ;;;;;;AAOA,eAAsB,kBAAkB,QAAgB,OAA2C;CAC/F,MAAM,EAAE,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;CAE5C,IAAI;EACA,OAAO,MAAM,OAAO,UAAU,QAAQ,MAAM;CAChD,SAAS,GAAG;EACR,OAAO,mBAAmB,CAAC;CAC/B;AACJ;;;;;;;AAgBA,SAAgB,sBACZ,OACA,UACA,UAA+B,CAAC,GACZ;CACpB,MAAM,QAAQ,gBAAgB,KAAK;CAEnC,MAAM,OAA4B;EAC9B;EACA,UAAU,yBAAyB,MAAM,QAAQ;CACrD;CAEA,IAAI,QAAQ,YAAY;EACpB,MAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,MAAM;EAC1E,KAAK,UAAU,OAAO,YAAY,WAAW,UAAU,KAAA;CAC3D;CAEA,IAAI,QAAQ,YACR,KAAK,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,KAAA;CAGjE,OAAO;AACX;;;;;;;;;;AAWA,SAAgB,kBAAkB,OAAuC;CACrE,MAAM,EAAE,YAAY,cAAc,gBAAgB,KAAK;CACvD,IAAI,OAAO,cAAc,UACrB;CASJ,OAAO,UACF,MAAM,GAAG,CAAC,CACV,MAAM,QAAQ,kCAAkC,KAAK,GAAG,CAAC;AAClE;;;;;;;;;;AAWA,SAAgB,oBAAoB,OAAuC;CACvE,MAAM,EAAE,eAAe,gBAAgB,gBAAgB,KAAK;CAE5D,OAAO,OAAO,gBAAgB,YACzB,OAAO,OAAO,iBAAiB,CAAC,CAAc,SAAS,WAAW,IACnE,cACA,KAAA;AACR;;;;;;;AAQA,SAAgB,mBAAmB,OAAuC;CACtE,MAAM,QAAQ,gBAAgB,KAAK;CACnC,IAAI,OAAO,MAAM,cAAc,UAC3B;CAGJ,MAAM,YAAY,MAAM,UAAU,YAAY,CAAC,CAAC,QAAQ,cAAc,EAAE;CACxE,IAAI,UAAU,WAAW,KAAK,UAAU,SAAS,IAC7C;CAGJ,OAAO;AACX;;;;;;;;AASA,SAAgB,yBAAyB,OAAuD;CAC5F,MAAM,EAAE,aAAa,gBAAgB,KAAK;CAE1C,OAAO,OAAO,aAAa,YAAY,OAAO,QAAQ,IAClD,EAAE,YAAY,SAAS,IACvB,KAAA;AACR;;;;;AAMA,SAAgB,gBAAgB,OAAgD;CAC5E,OAAO,gBAAgB,KAAK,CAAC,CAAC,UAAU,kBAAkB,kBAAkB,KAAA;AAChF;;;AC3OA,MAAa,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AACpE,MAAa,eAAe,KAAK,KAAK,WAAW,IAAI;;;;;;;;;;;;;;;ACarD,SAAgB,mBAAmB,UAAwC;CACvE,OAAO,YAAY,aACf,yDACA,EAAE,KAAK,aAAa,CACxB,CAAC,EAAE;AACP;;;;;;AAOA,SAAgB,gBAAgB,UAAwC;CACpE,MAAM,cAAc,mBAAmB,QAAQ;CAC/C,IAAI,CAAC,aACD;CAGJ,MAAM,YAAY,KAAK,KAAK,aAAa,MAAM;CAC/C,IACI,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,YAAY,CAAC,KAC1D,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,WAAW,CAAC,GAEzD,OAAO;AAIf;;;;;;;;;ACnBA,eAAsB,qBAAqB,UAAkC;CACzE,MAAM,QAAQ,KAAK,KAAK,UAAU,UAAU,WAAW;CAEvD,MAAM,WAAU,MADK,KAAK,KAAK,EAAA,CACR,oBAAoB;CAE3C,IAAI,YAAA,GACA,MAAM,IAAI,cACN,4BAA4B,MAAM,uCAAuC,QAAQ,oGAGrF;AAER;AAEA,SAAgB,iBAAiB,UAAgC;CAQ7D,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,OAAO,OAAO,OAAO,QAAQ,QAAQ;EACjC,MAAM,WAAY,mBAAmB,gBAAgB,QAAQ;EAC7D,IAAI,CAAC,UACD,MAAM,IAAI,cACN,kFACJ;EAGJ,MAAM,OAAQ,eAAe,MAAM,GAAG,SAAS,SAC3C,KAAK,KAAK,UAAU,UAAU,YAAY,GAC1C,OACJ;EACA,MAAM,WAAY,mBAAmB,KAAK,MAAM,MAAM,GAAG,SAAS,SAC9D,KAAK,KAAK,UAAU,UAAU,SAAS,mBAAmB,GAC1D,OACJ,CAAC;EACD,MAAM,SAAU,kBAAkB,MAAM,KACpC,KAAK,KAAK,UAAU,UAAU,WAAW,CAC7C,EAAA,CAAG;EAIH,MAAM,cAAc,wBAAwB,KAAK;EAUjD,IAAI,CAAC,YAAY,UAAU,YAAY,WAAW,QAC9C,YAAY,SAAS,kBAAkB,KAAK,KAAK,YAAY;EAOjE,IAAI,CAAC,YAAY,aAAa,YAAY,cAAc,UACpD,YAAY,YAAY,oBAAoB,KAAK,KAAK,YAAY;EAQtE,MAAM,WAAW,eAAe,OAAO,GAAG;EAE1C,MAAM,UAA6B;GAC/B,QAAQ;IACJ,SAAS,OAAO;IAChB;IACA,WAAW,YAAY;IACvB,QAAQ,YAAY;GACxB;GACA,MAAM,IAAI;EACd;EAEA,MAAM,CAAC,SAAS,gBAAgB,MAAM,OAAO;GACzC,KAAK,IAAI;GACT;GACA;EACJ,CAAC;EAED,IAAI,OAAO,sBAAsB,MAAM,wBAAwB,YAAY;EAC3E,OAAO,sBAAsB,MAAM,mBAAmB,OAAO;EAE7D,OAAO,oBAAoB,MAAM,WAAW;EAM5C,OAAO,gBAAgB,MAAM,WAAW,GAAG,SAAS,EAAE;EAKtD,OAAO,MAAM,WAAW,MAAM,IAAI,OAAO,QAAQ;EAEjD,mBAAmB,KAAK;EAExB,OAAO;CACX;AACJ;;;AClHA,MAAM,iBAIA;CACF;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAoB,YAAY;CAAK;CAC5C;EACI,KAAK;EACL,YAAY;EACZ,YAAY;CAChB;AACJ;;;;;;;;;;AAWA,eAAsBA,gBAClB,QACA,eACA,QACc;CACd,MAAM,aAAa,UAAU,iBAAiB,OAAO,QAAQ;CAE7D,MAAM,MAAM,IAAI,IAAI;CACpB,MAAM,SAAS,gBAAgB,MAAM;CACrC,MAAM,eAAe,qBAAqB,MAAM;CAOhD,IAAI,IAAI,MAAM;EAAE,QAAQ;EAAM,OAAO;CAAK,CAAC,CAAC;CAQ5C,MAAM,QAAQ,iBAAiB,MAAM,oBAAoB,MAAM;CAE/D,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,WAAW,EAAE,QAAQ,KAAK;CAC9B,CAAC,CAAC;CAEF,IAAI,OACA,IAAI,IAAI,wBAAwB,yBAAyB,KAAK,CAAC;CAGnE,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,MAAM,kBAAkB,QAAQ,KAAK;GAC3C;EACJ,CAAC;CACL,CAAC,CAAC;CAEF,KAAK,MAAM,QAAQ,gBACf,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM,KAAK;EACX,IAAI,OAAO,UAAU;GACjB,MAAM,WAAW,MAAM,aAAa;GAEpC,OAAO,WAAW,OAAO,QAAQ;IAC7B,KAAK,KAAK;IACV,MAAM,sBAAsB,OAAO,UAAU,IAAI;IACjD;GACJ,CAAC;EACL;CACJ,CAAC,CAAC;CAMN,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,CAAC;GACP;EACJ,CAAC;CACL,CAAC,CAAC;CAEF,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM;IACF,UAAU,MAAM,aAAa;IAC7B,UAAU,mBAAmB,KAAK;IAClC,gBAAgB,yBAAyB,KAAK;IAC9C,OAAO,gBAAgB,KAAK;GAChC;GACA;EACJ,CAAC;CACL,CAAC,CAAC;CAOF,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,UAAU;EACV,IAAI,CAAC,QACD,MAAM,qBAAqB,QAAQ;EAIvC,IAAI,IAAI,aAAaC,cACjB,KAAK,MAAM,KAAK,UAAU,UAAU,QAAQ,GAC5C;GACI,aAAa;GACb,MAAM;GACN,aAAa;GACb,gBAAgB;EACpB,CACJ,CAAC;CACL;CAEA,OAAO;AACX;;;;;;;;;;;;;;;AChJA,SAAgBC,oBACZ,UAA4E,CAAC,GACjE;CACZ,OAAOC,kBAAiC;EACpC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,UAAU;EAC1B,gBAAgB,UAAU,UAAUC,gBAAc,UAAU,KAAK;CACrE,CAAC;AACL"}

package/dist/bin.mjs

@@ -1,20 +1,18 @@
 #!/usr/bin/env node
-import { t as createServer, v as readConfigFromEnv } from "./server-Brhsp_x-.mjs";
-import { serve } from "routup/node";
+import { t as createApplication } from "./application-h8KbQSdz.mjs";
+import process from "node:process";
 //#region src/bin.ts
 /**
-* The standalone entry. It reads the keys this service declares from the
-* environment; `authup.yml` reaches the service through the CLI roles
-* (`authup start console auth`), which hand each factory its own section, and that
-* is also how it is started in practice.
+* The standalone entry: the same application `authup start console auth`
+* starts, configured from the environment alone. `authup.yml` reaches this
+* service through the CLI roles, which hand each factory its own section, and
+* that is also how it is started in practice.
 */
-const config = readConfigFromEnv();
-const app = await createServer(config);
-await serve(app, {
-	port: config.port,
-	hostname: config.host,
-	silent: true
-}).ready();
+const application = createApplication();
+await application.setup();
+const shutdown = () => application.teardown().then(() => process.exit(0), () => process.exit(1));
+process.once("SIGINT", shutdown);
+process.once("SIGTERM", shutdown);
 //#endregion
 export {};
 

package/dist/bin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bin.mjs","names":[],"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\n/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { serve } from 'routup/node';\nimport { readConfigFromEnv } from './config';\nimport { createServer } from './server';\n\n/**\n * The standalone entry. It reads the keys this service declares from the\n * environment; `authup.yml` reaches the service through the CLI roles\n * (`authup start console auth`), which hand each factory its own section, and that\n * is also how it is started in practice.\n */\nconst config = readConfigFromEnv();\nconst app = await createServer(config);\n\nconst server = serve(app, {\n    port: config.port,\n    hostname: config.host,\n    silent: true,\n});\n\nawait server.ready();\n"],"mappings":";;;;;;;;;;AAkBA,MAAM,SAAS,kBAAkB;AACjC,MAAM,MAAM,MAAM,aAAa,MAAM;AAQrC,MANe,MAAM,KAAK;CACtB,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ;AACZ,CAEW,CAAC,CAAC,MAAM"}
+{"version":3,"file":"bin.mjs","names":[],"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\n/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport process from 'node:process';\nimport { createApplication } from './application';\n\n/**\n * The standalone entry: the same application `authup start console auth`\n * starts, configured from the environment alone. `authup.yml` reaches this\n * service through the CLI roles, which hand each factory its own section, and\n * that is also how it is started in practice.\n */\nconst application = createApplication();\nawait application.setup();\n\nconst shutdown = () => application.teardown()\n    .then(() => process.exit(0), () => process.exit(1));\nprocess.once('SIGINT', shutdown);\nprocess.once('SIGTERM', shutdown);\n"],"mappings":";;;;;;;;;;AAiBA,MAAM,cAAc,kBAAkB;AACtC,MAAM,YAAY,MAAM;AAExB,MAAM,iBAAiB,YAAY,SAAS,CAAC,CACxC,WAAW,QAAQ,KAAK,CAAC,SAAS,QAAQ,KAAK,CAAC,CAAC;AACtD,QAAQ,KAAK,UAAU,QAAQ;AAC/B,QAAQ,KAAK,WAAW,QAAQ"}