@authup/server-auth-console 1.0.0-beta.64 → 1.0.0-beta.66

package/dist/config.d.ts

@@ -18,20 +18,20 @@ export declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<i
     core: Pick<CoreConfig, "host" | "port">;
 } & import("@authup/server-config").AuthConsoleConfig>, "publicUrl" | "internalUrl" | "db", string>;
 /**
- * Turn the configuration namespace into the service's own shape: fill the
- * defaults, derive the one key that is derived rather than configured, and
- * rename. An empty `url` means the console sits on server-core's own origin
+ * Turn the configuration namespace into the service's own shape: validate the
+ * input against the declared zod types, fill the defaults, derive the one key
+ * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin
  * under the default segment, which is the single-origin deployment.
  *
  * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
  * would let an input carrying one key of a section replace the whole section
  * and take every other key's default with it.
  */
-export declare function resolveConfig(input: Partial<ConfigInput>): Config;
+export declare function resolveConfig(input: Partial<ConfigInput>): Promise<Config>;
 /**
  * The standalone entry's configuration, read from the environment alone.
  * `authup.yml` reaches this service through the CLI roles, which compose this
  * very registry into the one document loader.
  */
-export declare function readConfigFromEnv(): Config;
+export declare function readConfigFromEnv(): Promise<Config>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;mGAcxB,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CACzB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAC3B,MAAM,CAuBT;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAK,MAAM,CAO3C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;mGAcxB,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAC/B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAK,OAAO,CAAC,MAAM,CAAC,CAO1D"}

package/dist/constants.d.ts

@@ -1,3 +1,9 @@
+import type { CONTRACT_VERSION as BundleContractVersion } from '@authup/client-auth-console';
+/**
+ * The render contract this service compiles against. The literal type fails
+ * the build the moment the bundle's constant moves without this one.
+ */
+export declare const CONTRACT_VERSION: typeof BundleContractVersion;
 /**
  * The vite base the auth console bundle is built with. Asset hrefs in the
  * shell are emitted against it, so the service mounts its assets there and
@@ -14,7 +20,7 @@ export declare const BASE_PATH = "/console/auth";
  * The pages the service renders. Each is a route of the console bundle's
  * own router, and each is what a server-core page GET now redirects to.
  */
-export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
+export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout", "/device"];
 /**
  * Where this service mounts the bundle's `assets/` directory. The public
  * asset URL is the service's own public path plus this route, which is what

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,KAAK,qGAOR,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,eAAO,MAAM,WAAW,aAAa,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE7F;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAG,OAAO,qBAAyB,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,KAAK,gHAQR,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,eAAO,MAAM,WAAW,aAAa,CAAC"}

package/dist/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AASjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAWnC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBlD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,cAAc,EAC9B,MAAM,GAAE,UAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAuFhB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AASjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAcnC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBlD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,cAAc,EAC9B,MAAM,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CA8GhB"}

package/dist/index.d.mts

@@ -3,6 +3,7 @@ import { AuthConsoleConfig, CoreConfig, RootConfig, SECTION_KEY, ThemeConfig, To
 import { App, IApp, IAppEvent } from "routup";
 import { AuthorizeInfo, Client, StatusResponseFeatures } from "@authup/core-http-kit";
 import { Application } from "orkos";
+import { CONTRACT_VERSION as CONTRACT_VERSION$1 } from "@authup/client-auth-console";
 //#region src/types.d.ts
 /**
  * The `authup.yml` NAMESPACE: the sections this service selects keys from.
@@ -13,7 +14,7 @@ import { Application } from "orkos";
  * `distPath` below are this service's names for values the document calls
  * something else, so they belong to {@link Config} alone.
  */
-type ConfigInput = ToObjectLiteral<RootConfig & {
+export type ConfigInput = ToObjectLiteral<RootConfig & {
   [SECTION_KEY.THEME]: ThemeConfig;
   [SECTION_KEY.CORE]: Pick<CoreConfig, 'host' | 'port'>;
 } & AuthConsoleConfig>;
@@ -22,7 +23,7 @@ type ConfigInput = ToObjectLiteral<RootConfig & {
  * and server-core is the external thing it calls, hence `url` for its own
  * address and `apiUrl` for the API's.
  */
-type Config = {
+export type Config = {
   /**
    * The public URL this service is reachable at, e.g.
    * `https://example.com/console/auth`. Its path component becomes the
@@ -67,10 +68,10 @@ type Config = {
 };
 /**
  * How a page becomes a document. The default is this service's own
- * `renderPage`, reading the built bundle; a caller serving the console from
- * source substitutes one that reads through a vite dev server instead.
+ * `createRenderPage`, reading the built bundle; a caller serving the console
+ * from source substitutes one that reads through a vite dev server instead.
  */
-type RenderPage = (event: IAppEvent, config: Config, ctx: {
+export type RenderPage = (event: IAppEvent, config: Config, ctx: {
   url: string;
   data: Record<string, any>;
   theme?: IThemeProvider;
@@ -89,7 +90,7 @@ type RenderPage = (event: IAppEvent, config: Config, ctx: {
  * construction time, before the caller has said where to look. Pass
  * `listen: false` to be mounted on someone else's listener.
  */
-declare function createApplication(context?: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>>): Application;
+export declare function createApplication(context?: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>>): Application;
 //#endregion
 //#region src/config.d.ts
 /**
@@ -105,53 +106,58 @@ declare function createApplication(context?: Partial<Omit<CreateApplicationConte
  * (`url`, `port`, `host`); every other section stays under the key the
  * document nests it at.
  */
-declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<import("@authup/server-config").ToObjectLiteral<import("@authup/server-config").RootConfig & {
+export declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<import("@authup/server-config").ToObjectLiteral<import("@authup/server-config").RootConfig & {
   theme: import("@authup/server-config").ThemeConfig;
   core: Pick<CoreConfig, "host" | "port">;
 } & import("@authup/server-config").AuthConsoleConfig>, "publicUrl" | "internalUrl" | "db", string>;
 /**
- * Turn the configuration namespace into the service's own shape: fill the
- * defaults, derive the one key that is derived rather than configured, and
- * rename. An empty `url` means the console sits on server-core's own origin
+ * Turn the configuration namespace into the service's own shape: validate the
+ * input against the declared zod types, fill the defaults, derive the one key
+ * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin
  * under the default segment, which is the single-origin deployment.
  *
  * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
  * would let an input carrying one key of a section replace the whole section
  * and take every other key's default with it.
  */
-declare function resolveConfig(input: Partial<ConfigInput>): Config;
+export declare function resolveConfig(input: Partial<ConfigInput>): Promise<Config>;
 /**
  * The standalone entry's configuration, read from the environment alone.
  * `authup.yml` reaches this service through the CLI roles, which compose this
  * very registry into the one document loader.
  */
-declare function readConfigFromEnv(): Config;
+export declare function readConfigFromEnv(): Promise<Config>;
 //#endregion
 //#region src/constants.d.ts
+/**
+ * The render contract this service compiles against. The literal type fails
+ * the build the moment the bundle's constant moves without this one.
+ */
+export declare const CONTRACT_VERSION: typeof CONTRACT_VERSION$1;
 /**
  * The vite base the auth console bundle is built with. Asset hrefs in the
  * shell are emitted against it, so the service mounts its assets there and
  * rebases them only when the deployment carries a sub-path.
  */
-declare const VITE_BASE = "/console/auth/";
+export declare const VITE_BASE = "/console/auth/";
 /**
  * The path the service is served under by default, i.e. the path component
  * of `authConsole.url`. It is the same segment server-core mounted
  * the assets at before the split, so a built bundle needs no rebuild.
  */
-declare const BASE_PATH = "/console/auth";
+export declare const BASE_PATH = "/console/auth";
 /**
  * The pages the service renders. Each is a route of the console bundle's
  * own router, and each is what a server-core page GET now redirects to.
  */
-declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
+export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout", "/device"];
 /**
  * Where this service mounts the bundle's `assets/` directory. The public
  * asset URL is the service's own public path plus this route, which is what
  * the bundle's fixed vite base is rebased onto.
  */
-declare const ASSETS_PATH = "/assets";
-declare const HEALTH_PATH = "/healthy";
+export declare const ASSETS_PATH = "/assets";
+export declare const HEALTH_PATH = "/healthy";
 //#endregion
 //#region src/handler.d.ts
 /**
@@ -163,7 +169,7 @@ declare const HEALTH_PATH = "/healthy";
  * proxy, so a service published at `<origin>/console/auth` receives
  * `/authorize`, exactly as server-core received it before the split.
  */
-declare function createHandler(config: Config, themeProvider?: IThemeProvider, render?: RenderPage): Promise<IApp>;
+export declare function createHandler(config: Config, themeProvider?: IThemeProvider, render?: RenderPage): Promise<IApp>;
 //#endregion
 //#region src/payload.d.ts
 /**
@@ -178,7 +184,7 @@ declare function createHandler(config: Config, themeProvider?: IThemeProvider, r
  * because nothing derived from it reaches a caller -- there is no
  * `redirect_uri` here to be compared byte for byte later.
  */
-declare function createAPIClient(config: Config): Client;
+export declare function createAPIClient(config: Config): Client;
 /**
  * The feature flags every workflow page gates its form on. A page that
  * cannot reach them must not silently claim a workflow is disabled, so the
@@ -198,14 +204,14 @@ declare function createAPIClient(config: Config): Client;
  * in one process must not share one, and a module slot would additionally
  * leak between test cases.
  */
-declare function createFeaturesReader(client: Client): () => Promise<StatusResponseFeatures>;
+export declare function createFeaturesReader(client: Client): () => Promise<StatusResponseFeatures>;
 /**
  * The `/authorize` render input, resolved by server-core (plan 101 D2-1).
  * The browser's query is forwarded verbatim: the answer is derived from all
  * of it, the `provider` hint and the closed `error` marker set included.
  */
-declare function readAuthorizeInfo(client: Client, event: IAppEvent): Promise<AuthorizeInfo>;
-type WorkflowPageOptions = {
+export declare function readAuthorizeInfo(client: Client, event: IAppEvent): Promise<AuthorizeInfo>;
+export type WorkflowPageOptions = {
   realmAware?: boolean;
   tokenAware?: boolean;
 };
@@ -215,7 +221,49 @@ type WorkflowPageOptions = {
  * assembly server-core did before the split, including the open-redirect
  * guard on `redirect`.
  */
-declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+export declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+/**
+ * The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`
+ * parameter: a space-separated list of BCP47 tags in preference order.
+ *
+ * It rides the authorization request, so it survives the page GET's hop and
+ * the rebuild a federated round-trip makes from the stored code request. The
+ * four workflow pages take it straight from their own query, since an RP
+ * linking to one can say the same thing there.
+ */
+export declare function readUILocalesHint(event: IAppEvent): string | undefined;
+/**
+ * The color mode the RP renders in, from authup's own `ui_color_mode`. One
+ * value rather than a list, since there is nothing to negotiate.
+ *
+ * Checked against the enum rather than local literals because the realm's
+ * discovery document ADVERTISES that same set as
+ * `ui_color_modes_supported`: a second spelling here would let the pages and
+ * the document disagree about what the deployment accepts.
+ */
+export declare function readUIColorModeHint(event: IAppEvent): string | undefined;
+/**
+ * The `user_code` the device page prefills (RFC 8628 section 3.3.1): the
+ * query value uppercased and stripped of everything outside `A-Z0-9`, or
+ * `undefined` when nothing bounded remains. The page renders it back, so what
+ * reaches the payload is at most 16 alphanumeric characters.
+ */
+export declare function readDeviceUserCode(event: IAppEvent): string | undefined;
+/**
+ * The provider a federated login on the device page came back from (#3589).
+ * A routing hint and no secret: the pending login itself rides an HttpOnly
+ * cookie. Anything that is not a uuid is dropped, the rule `/authorize`
+ * reads its own hint by: the page interpolates the value into the
+ * completion request path.
+ */
+export declare function readDeviceFederatedLogin(event: IAppEvent): {
+  providerId: string;
+} | undefined;
+/**
+ * The refusal marker the federated callback may attach. A closed set of one,
+ * so nothing request-derived is rendered.
+ */
+export declare function readDeviceError(event: IAppEvent): 'access_denied' | undefined;
 //#endregion
 //#region src/redirect.d.ts
 /**
@@ -230,44 +278,44 @@ declare function buildWorkflowPageData(event: IAppEvent, features: StatusRespons
  * (`javascript:`, `http:`) — both on the raw and once-decoded form so a
  * percent-encoded separator (`%2f`, `%5c`) can't slip past.
  */
-declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
+export declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
 //#endregion
 //#region src/render.d.ts
-declare const renderPage: RenderPage;
-//#endregion
-//#region src/resolve.d.ts
 /**
- * Point the resolution at a substituted package (config `distPath`)
- * instead of the node_modules walk. Called once at boot.
+ * Refuse a bundle built against another render contract at boot, naming the
+ * entry and both versions, instead of failing per request on `/authorize`.
+ * A bundle predating the export is version 1. Reads the module itself, which
+ * Node's ESM cache then hands the render for free.
  */
-declare function setPackagePath(value: string | undefined): void;
+export declare function assertRenderContract(distPath: string): Promise<void>;
+export declare function createRenderPage(distPath?: string): RenderPage;
+//#endregion
+//#region src/resolve.d.ts
 /**
- * Locate the auth console package. The SSR auth workflow UI ships as
- * `@authup/client-auth-console` (a dependency of THIS service), so the
+ * Locate the auth console package: a substituted one (config `distPath`)
+ * first, else the SSR auth workflow UI shipped as
+ * `@authup/client-auth-console` (a dependency of THIS service), which the
  * node_modules ancestor walk from this package's own root (locter's
- * `locateUp`) finds it for the workspace (symlink onto
- * apps/client-auth-console) and for a published install alike. Only a
- * positive result is cached.
+ * `locateUp`) finds for the workspace (symlink onto
+ * apps/client-auth-console) and for a published install alike.
  *
  * The `cwd` anchor is behavioural, not incidental: it decides which
  * node_modules tree is walked, so it stays pinned to this package rather
  * than to the process cwd.
  */
-declare function resolvePackagePath(): string | undefined;
+export declare function resolvePackagePath(distPath?: string): string | undefined;
 /**
  * Locate the BUILT auth console bundle (`dist/client` template + assets,
- * `dist/server/server.js` render entry). Only a positive result is cached,
- * so a dev building the package after boot is picked up on the next
- * request.
+ * `dist/server/server.js` render entry). A half-built package is no bundle:
+ * without the render entry there is nothing to render with.
  */
-declare function resolveDistPath(): string | undefined;
+export declare function resolveDistPath(distPath?: string): string | undefined;
 //#endregion
 //#region src/server.d.ts
 /**
  * The standalone service: the same handler the CLI mounts in process,
  * behind a listener of its own.
  */
-declare function createServer(config: Config): Promise<App>;
+export declare function createServer(config: Config): Promise<App>;
 //#endregion
-export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, Config, ConfigInput, HEALTH_PATH, PAGES, RenderPage, VITE_BASE, WorkflowPageOptions, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createServer, readAuthorizeInfo, readConfigFromEnv, renderPage, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect, setPackagePath };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/application.ts","../src/config.ts","../src/constants.ts","../src/handler.ts","../src/payload.ts","../src/redirect.ts","../src/render.ts","../src/resolve.ts","../src/server.ts"],"mappings":";;;;;;;;;;;;;;;KA2BY,cAAc,gBACtB;GAEK,YAAY,QAAQ;GAEpB,YAAY,OAAO,KAAK;IAE7B;;;;;;KAQQ;;;;;;EAMR;;;;;;;;EAQA;;;;;;;;;;;;;;;EAeA;;;;;EAKA;EACA;;;;;EAKA;EAEA,OAAO;;;;;;;KAQC,cACR,OAAO,WACP,QAAQ,QACR;EACI;EACA,MAAM;EACN,QAAQ;MAEX;;;;;;;;;;;;;;;iBC1EW,kBACZ,UAAS,QAAQ,KAAK,yBAAyB,6BAC/C;;;;;;;;;;;;;;;;cCSS,mDAAa,uCAAA,gDAAA;;QAAb,KAAA;oCAcX;;;;;;;;;;;iBAYc,cACZ,OAAO,QAAQ,eACf;;;;;;iBA8BY,qBAAsB;;;;;;;;cCnFzB;;;;;;cAOA;;;;;cAMA;;;;;;cAcA;cAEA;;;;;;;;;;;;iBCYS,cAClB,QAAQ,QACR,gBAAgB,gBAChB,SAAQ,aACR,QAAQ;;;;;;;;;;;;;;;iBC/BI,gBAAgB,QAAQ,SAAU;;;;;;;;;;;;;;;;;;;;iBAiDlC,qBAAqB,QAAQ,eAAgB,QAAQ;;;;;;iBAmC/C,kBAAkB,QAAQ,QAAQ,OAAO,YAAa,QAAQ;KAUxE;EAIR;EACA;;;;;;;;iBASY,sBACZ,OAAO,WACP,UAAU,wBACV,UAAS,sBACT;;;;;;;;;;;;;;;iBCvHY,yBAAyB;;;cCa5B,YAAa;;;;;;;iBCZV,eAAe;;;;;;;;;;;;;iBAkBf;;;;;;;iBA4BA;;;;;;;iBCnDM,aAAa,QAAQ,SAAU,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/application.ts","../src/config.ts","../src/constants.ts","../src/handler.ts","../src/payload.ts","../src/redirect.ts","../src/render.ts","../src/resolve.ts","../src/server.ts"],"mappings":";;;;;;;;;;;;;;;;YA2BY,cAAc,gBACtB;GAEK,YAAY,QAAQ;GAEpB,YAAY,OAAO,KAAK;IAE7B;;;;;;YAQQ;;;;;;EAMR;;;;;;;;EAQA;;;;;;;;;;;;;;;EAeA;;;;;EAKA;EACA;;;;;EAKA;EAEA,OAAO;;;;;;;YAQC,cACR,OAAO,WACP,QAAQ,QACR;EACI;EACA,MAAM;EACN,QAAQ;MAEX;;;;;;;;;;;;;;;wBC1EW,kBACZ,UAAS,QAAQ,KAAK,yBAAyB,6BAC/C;;;;;;;;;;;;;;;;qBCWS,mDAAa,uCAAA,gDAAA;;QAAb,KAAA;oCAcX;;;;;;;;;;;wBAYoB,cAClB,OAAO,QAAQ,eACf,QAAQ;;;;;;wBAmCU,qBAAsB,QAAQ;;;;;;;qBCzFvC,yBAA0B;;;;;;qBAO1B;;;;;;qBAOA;;;;;qBAMA;;;;;;qBAeA;qBAEA;;;;;;;;;;;;wBCMS,cAClB,QAAQ,QACR,gBAAgB,gBAChB,SAAS,aACT,QAAQ;;;;;;;;;;;;;;;wBChCI,gBAAgB,QAAQ,SAAU;;;;;;;;;;;;;;;;;;;;wBAiDlC,qBAAqB,QAAQ,eAAgB,QAAQ;;;;;;wBAmC/C,kBAAkB,QAAQ,QAAQ,OAAO,YAAa,QAAQ;YAUxE;EAIR;EACA;;;;;;;;wBASY,sBACZ,OAAO,WACP,UAAU,wBACV,UAAS,sBACT;;;;;;;;;;wBA6BY,kBAAkB,OAAO;;;;;;;;;;wBA0BzB,oBAAoB,OAAO;;;;;;;wBAe3B,mBAAmB,OAAO;;;;;;;;wBAqB1B,yBAAyB,OAAO;EAAe;;;;;;wBAY/C,gBAAgB,OAAO;;;;;;;;;;;;;;;wBChOvB,yBAAyB;;;;;;;;;wBCanB,qBAAqB,mBAAoB;wBAc/C,iBAAiB,oBAAqB;;;;;;;;;;;;;;;wBCtBtC,mBAAmB;;;;;;wBAYnB,gBAAgB;;;;;;;wBCrBV,aAAa,QAAQ,SAAU,QAAQ"}

package/dist/index.mjs

@@ -1,26 +1,16 @@
-import { _ as CONFIG_SCHEMA, a as resolvePackagePath, c as createAPIClient, d as sanitizeRelativeRedirect, f as ASSETS_PATH, g as VITE_BASE, h as PAGES, i as resolveDistPath, l as createFeaturesReader, m as HEALTH_PATH, n as createHandler, o as setPackagePath, p as BASE_PATH, r as renderPage, s as buildWorkflowPageData, t as createServer, u as readAuthorizeInfo, v as readConfigFromEnv, y as resolveConfig } from "./server-Brhsp_x-.mjs";
-import { createApplication as createApplication$1 } from "@authup/server-console-kit";
-//#region src/application.ts
+import { C as CONFIG_SCHEMA, S as VITE_BASE, T as resolveConfig, _ as ASSETS_PATH, a as resolveDistPath, b as HEALTH_PATH, c as createAPIClient, d as readDeviceError, f as readDeviceFederatedLogin, g as sanitizeRelativeRedirect, h as readUILocalesHint, i as createRenderPage, l as createFeaturesReader, m as readUIColorModeHint, n as createHandler, o as resolvePackagePath, p as readDeviceUserCode, r as assertRenderContract, s as buildWorkflowPageData, t as createApplication, u as readAuthorizeInfo, v as BASE_PATH, w as readConfigFromEnv, x as PAGES, y as CONTRACT_VERSION } from "./application-h8KbQSdz.mjs";
+import { App } from "routup";
+//#region src/server.ts
 /**
-* This console as a runnable service: its own module graph, its own
-* container, its own lifecycle, and nothing of server-core's. It is what
-* `authup start console` starts, what the `authup-auth-console` bin starts, and what
-* `authup start` composes onto its own listener, so no caller reaches past
-* the graph for a bare handler.
-*
-* `config` defaults to a FACTORY, not a value: resolving it reads the
-* document, and a console started alongside others must not do that at
-* construction time, before the caller has said where to look. Pass
-* `listen: false` to be mounted on someone else's listener.
+* The standalone service: the same handler the CLI mounts in process,
+* behind a listener of its own.
 */
-function createApplication(context = {}) {
-	return createApplication$1({
-		listen: context.listen,
-		config: context.config ?? readConfigFromEnv,
-		createHandler: (resolved, theme) => createHandler(resolved, theme)
-	});
+async function createServer(config) {
+	const app = new App();
+	app.use(await createHandler(config));
+	return app;
 }
 //#endregion
-export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, HEALTH_PATH, PAGES, VITE_BASE, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createServer, readAuthorizeInfo, readConfigFromEnv, renderPage, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect, setPackagePath };
+export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, CONTRACT_VERSION, HEALTH_PATH, PAGES, VITE_BASE, assertRenderContract, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createRenderPage, createServer, readAuthorizeInfo, readConfigFromEnv, readDeviceError, readDeviceFederatedLogin, readDeviceUserCode, readUIColorModeHint, readUILocalesHint, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["createConsoleApplication"],"sources":["../src/application.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createApplication as createConsoleApplication } from '@authup/server-console-kit';\nimport type { CreateApplicationContext } from '@authup/server-console-kit';\nimport type { Application } from 'orkos';\nimport { readConfigFromEnv } from './config';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * This console as a runnable service: its own module graph, its own\n * container, its own lifecycle, and nothing of server-core's. It is what\n * `authup start console` starts, what the `authup-auth-console` bin starts, and what\n * `authup start` composes onto its own listener, so no caller reaches past\n * the graph for a bare handler.\n *\n * `config` defaults to a FACTORY, not a value: resolving it reads the\n * document, and a console started alongside others must not do that at\n * construction time, before the caller has said where to look. Pass\n * `listen: false` to be mounted on someone else's listener.\n */\nexport function createApplication(\n    context: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>> = {},\n) : Application {\n    return createConsoleApplication<Config>({\n        listen: context.listen,\n        config: context.config ?? readConfigFromEnv,\n        createHandler: (resolved, theme) => createHandler(resolved, theme),\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;AA0BA,SAAgB,kBACZ,UAA4E,CAAC,GACjE;CACZ,OAAOA,oBAAiC;EACpC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,UAAU;EAC1B,gBAAgB,UAAU,UAAU,cAAc,UAAU,KAAK;CACrE,CAAC;AACL"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/server.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { App } from 'routup';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * The standalone service: the same handler the CLI mounts in process,\n * behind a listener of its own.\n */\nexport async function createServer(config: Config) : Promise<App> {\n    const app = new App();\n\n    app.use(await createHandler(config));\n\n    return app;\n}\n"],"mappings":";;;;;;;AAeA,eAAsB,aAAa,QAA+B;CAC9D,MAAM,MAAM,IAAI,IAAI;CAEpB,IAAI,IAAI,MAAM,cAAc,MAAM,CAAC;CAEnC,OAAO;AACX"}

package/dist/payload.d.ts

@@ -52,4 +52,46 @@ export type WorkflowPageOptions = {
  * guard on `redirect`.
  */
 export declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+/**
+ * The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`
+ * parameter: a space-separated list of BCP47 tags in preference order.
+ *
+ * It rides the authorization request, so it survives the page GET's hop and
+ * the rebuild a federated round-trip makes from the stored code request. The
+ * four workflow pages take it straight from their own query, since an RP
+ * linking to one can say the same thing there.
+ */
+export declare function readUILocalesHint(event: IAppEvent): string | undefined;
+/**
+ * The color mode the RP renders in, from authup's own `ui_color_mode`. One
+ * value rather than a list, since there is nothing to negotiate.
+ *
+ * Checked against the enum rather than local literals because the realm's
+ * discovery document ADVERTISES that same set as
+ * `ui_color_modes_supported`: a second spelling here would let the pages and
+ * the document disagree about what the deployment accepts.
+ */
+export declare function readUIColorModeHint(event: IAppEvent): string | undefined;
+/**
+ * The `user_code` the device page prefills (RFC 8628 section 3.3.1): the
+ * query value uppercased and stripped of everything outside `A-Z0-9`, or
+ * `undefined` when nothing bounded remains. The page renders it back, so what
+ * reaches the payload is at most 16 alphanumeric characters.
+ */
+export declare function readDeviceUserCode(event: IAppEvent): string | undefined;
+/**
+ * The provider a federated login on the device page came back from (#3589).
+ * A routing hint and no secret: the pending login itself rides an HttpOnly
+ * cookie. Anything that is not a uuid is dropped, the rule `/authorize`
+ * reads its own hint by: the page interpolates the value into the
+ * completion request path.
+ */
+export declare function readDeviceFederatedLogin(event: IAppEvent): {
+    providerId: string;
+} | undefined;
+/**
+ * The refusal marker the federated callback may attach. A closed set of one,
+ * so nothing request-derived is rendered.
+ */
+export declare function readDeviceError(event: IAppEvent): 'access_denied' | undefined;
 //# sourceMappingURL=payload.d.ts.map

package/dist/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../src/payload.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAkB,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,CAEvD;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,OAAO,CAAC,sBAAsB,CAAC,CA4B3F;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,aAAa,CAAC,CAQjG;AAED,MAAM,MAAM,mBAAmB,GAAG;IAI9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,sBAAsB,EAChC,OAAO,GAAE,mBAAwB,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkBtB"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../src/payload.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAkB,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAI/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,CAEvD;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,OAAO,CAAC,sBAAsB,CAAC,CA4B3F;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,aAAa,CAAC,CAQjG;AAED,MAAM,MAAM,mBAAmB,GAAG;IAI9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,sBAAsB,EAChC,OAAO,GAAE,mBAAwB,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkBtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAI,MAAM,GAAG,SAAS,CAevE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAI,MAAM,GAAG,SAAS,CAOzE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,MAAM,GAAG,SAAS,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAM9F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAE9E"}

package/dist/render.d.ts

@@ -1,3 +1,10 @@
 import type { RenderPage } from './types';
-export declare const renderPage: RenderPage;
+/**
+ * Refuse a bundle built against another render contract at boot, naming the
+ * entry and both versions, instead of failing per request on `/authorize`.
+ * A bundle predating the export is version 1. Reads the module itself, which
+ * Node's ESM cache then hands the render for free.
+ */
+export declare function assertRenderContract(distPath: string): Promise<void>;
+export declare function createRenderPage(distPath?: string): RenderPage;
 //# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAS1C,eAAO,MAAM,UAAU,EAAG,UAkEzB,CAAC"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAY3E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,UAAU,CAoG/D"}

package/dist/resolve.d.ts

@@ -1,26 +1,20 @@
 /**
- * Point the resolution at a substituted package (config `distPath`)
- * instead of the node_modules walk. Called once at boot.
- */
-export declare function setPackagePath(value: string | undefined): void;
-/**
- * Locate the auth console package. The SSR auth workflow UI ships as
- * `@authup/client-auth-console` (a dependency of THIS service), so the
+ * Locate the auth console package: a substituted one (config `distPath`)
+ * first, else the SSR auth workflow UI shipped as
+ * `@authup/client-auth-console` (a dependency of THIS service), which the
  * node_modules ancestor walk from this package's own root (locter's
- * `locateUp`) finds it for the workspace (symlink onto
- * apps/client-auth-console) and for a published install alike. Only a
- * positive result is cached.
+ * `locateUp`) finds for the workspace (symlink onto
+ * apps/client-auth-console) and for a published install alike.
  *
  * The `cwd` anchor is behavioural, not incidental: it decides which
  * node_modules tree is walked, so it stays pinned to this package rather
  * than to the process cwd.
  */
-export declare function resolvePackagePath(): string | undefined;
+export declare function resolvePackagePath(distPath?: string): string | undefined;
 /**
  * Locate the BUILT auth console bundle (`dist/client` template + assets,
- * `dist/server/server.js` render entry). Only a positive result is cached,
- * so a dev building the package after boot is picked up on the next
- * request.
+ * `dist/server/server.js` render entry). A half-built package is no bundle:
+ * without the render entry there is nothing to render with.
  */
-export declare function resolveDistPath(): string | undefined;
+export declare function resolveDistPath(distPath?: string): string | undefined;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAI,IAAI,CAI/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,IAAK,MAAM,GAAG,SAAS,CAoBxD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAK,MAAM,GAAG,SAAS,CAerD"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS,CAKzE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS,CAetE"}

package/dist/types.d.ts

@@ -64,8 +64,8 @@ export type Config = {
 };
 /**
  * How a page becomes a document. The default is this service's own
- * `renderPage`, reading the built bundle; a caller serving the console from
- * source substitutes one that reads through a vite dev server instead.
+ * `createRenderPage`, reading the built bundle; a caller serving the console
+ * from source substitutes one that reads through a vite dev server instead.
  */
 export type RenderPage = (event: IAppEvent, config: Config, ctx: {
     url: string;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/server-auth-console",
     "type": "module",
-    "version": "1.0.0-beta.64",
+    "version": "1.0.0-beta.66",
     "description": "The SSR service behind authup's hosted auth pages: it renders the auth console bundle and hydrates it anonymously over HTTP.",
     "license": "AGPL-3.0-only",
     "bin": {
@@ -51,21 +51,24 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/client-auth-console": "^1.0.0-beta.64",
-        "@authup/core-http-kit": "^1.0.0-beta.64",
-        "@authup/errors": "^1.0.0-beta.64",
-        "@authup/kit": "^1.0.0-beta.64",
-        "@authup/server-config-kit": "^1.0.0-beta.64",
-        "@authup/server-config": "^1.0.0-beta.64",
-        "@authup/server-console-kit": "^1.0.0-beta.64",
+        "@authup/client-auth-console": "^1.0.0-beta.66",
+        "@authup/core-http-kit": "^1.0.0-beta.66",
+        "@authup/errors": "^1.0.0-beta.66",
+        "@authup/kit": "^1.0.0-beta.66",
+        "@authup/server-config": "^1.0.0-beta.66",
+        "@authup/server-config-kit": "^1.0.0-beta.66",
+        "@authup/server-console-kit": "^1.0.0-beta.66",
+        "@authup/specs": "^1.0.0-beta.66",
         "@routup/assets": "^5.0.0",
         "@routup/basic": "^3.0.0",
         "locter": "^4.1.1",
         "orkos": "^1.1.1",
         "routup": "^6.1.0",
-        "zod": "^4.5.4"
+        "validup": "^2.0.1",
+        "zod": "^4.6.5"
     },
     "devDependencies": {
+        "@types/node": "^26.6.1",
         "cross-env": "^10.1.0",
         "vitest": "^4.0.18"
     },