@authup/server-auth-console 1.0.0-beta.64

package/dist/application.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../src/application.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAGzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC7B,OAAO,GAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,CAAM,GAC9E,WAAW,CAMd"}

package/dist/bin.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { t as createServer, v as readConfigFromEnv } from "./server-Brhsp_x-.mjs";
+import { serve } from "routup/node";
+//#region src/bin.ts
+/**
+* The standalone entry. It reads the keys this service declares from the
+* environment; `authup.yml` reaches the service through the CLI roles
+* (`authup start console auth`), which hand each factory its own section, and that
+* is also how it is started in practice.
+*/
+const config = readConfigFromEnv();
+const app = await createServer(config);
+await serve(app, {
+	port: config.port,
+	hostname: config.host,
+	silent: true
+}).ready();
+//#endregion
+export {};
+
+//# sourceMappingURL=bin.mjs.map

package/dist/bin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.mjs","names":[],"sources":["../src/bin.ts"],"sourcesContent":["#!/usr/bin/env node\n/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { serve } from 'routup/node';\nimport { readConfigFromEnv } from './config';\nimport { createServer } from './server';\n\n/**\n * The standalone entry. It reads the keys this service declares from the\n * environment; `authup.yml` reaches the service through the CLI roles\n * (`authup start console auth`), which hand each factory its own section, and that\n * is also how it is started in practice.\n */\nconst config = readConfigFromEnv();\nconst app = await createServer(config);\n\nconst server = serve(app, {\n    port: config.port,\n    hostname: config.host,\n    silent: true,\n});\n\nawait server.ready();\n"],"mappings":";;;;;;;;;;AAkBA,MAAM,SAAS,kBAAkB;AACjC,MAAM,MAAM,MAAM,aAAa,MAAM;AAQrC,MANe,MAAM,KAAK;CACtB,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,QAAQ;AACZ,CAEW,CAAC,CAAC,MAAM"}

package/dist/config.d.ts

@@ -0,0 +1,37 @@
+import type { CoreConfig } from '@authup/server-config';
+import type { Config, ConfigInput } from './types';
+/**
+ * The keys this service reads, SELECTED out of the document schema by name.
+ *
+ * Nothing is declared here: every key of `authup.yml` is declared once in
+ * `@authup/server-config`, so this service cannot spell a path, an
+ * environment variable, a default or a reader differently from server-core,
+ * which reads several of the same keys. Neither package depends on the other;
+ * both depend on the declaration.
+ *
+ * Its own section is spread, so this service reads it in its own vocabulary
+ * (`url`, `port`, `host`); every other section stays under the key the
+ * document nests it at.
+ */
+export declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<import("@authup/server-config").ToObjectLiteral<import("@authup/server-config").RootConfig & {
+    theme: import("@authup/server-config").ThemeConfig;
+    core: Pick<CoreConfig, "host" | "port">;
+} & import("@authup/server-config").AuthConsoleConfig>, "publicUrl" | "internalUrl" | "db", string>;
+/**
+ * Turn the configuration namespace into the service's own shape: fill the
+ * defaults, derive the one key that is derived rather than configured, and
+ * rename. An empty `url` means the console sits on server-core's own origin
+ * under the default segment, which is the single-origin deployment.
+ *
+ * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
+ * would let an input carrying one key of a section replace the whole section
+ * and take every other key's default with it.
+ */
+export declare function resolveConfig(input: Partial<ConfigInput>): Config;
+/**
+ * The standalone entry's configuration, read from the environment alone.
+ * `authup.yml` reaches this service through the CLI roles, which compose this
+ * very registry into the one document loader.
+ */
+export declare function readConfigFromEnv(): Config;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;mGAcxB,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CACzB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAC3B,MAAM,CAuBT;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAK,MAAM,CAO3C"}

package/dist/constants.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The vite base the auth console bundle is built with. Asset hrefs in the
+ * shell are emitted against it, so the service mounts its assets there and
+ * rebases them only when the deployment carries a sub-path.
+ */
+export declare const VITE_BASE = "/console/auth/";
+/**
+ * The path the service is served under by default, i.e. the path component
+ * of `authConsole.url`. It is the same segment server-core mounted
+ * the assets at before the split, so a built bundle needs no rebuild.
+ */
+export declare const BASE_PATH = "/console/auth";
+/**
+ * The pages the service renders. Each is a route of the console bundle's
+ * own router, and each is what a server-core page GET now redirects to.
+ */
+export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
+/**
+ * Where this service mounts the bundle's `assets/` directory. The public
+ * asset URL is the service's own public path plus this route, which is what
+ * the bundle's fixed vite base is rebased onto.
+ */
+export declare const ASSETS_PATH = "/assets";
+export declare const HEALTH_PATH = "/healthy";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,KAAK,qGAOR,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,eAAO,MAAM,WAAW,aAAa,CAAC"}

package/dist/handler.d.ts

@@ -0,0 +1,14 @@
+import type { IThemeProvider } from '@authup/server-console-kit';
+import type { IApp } from 'routup';
+import type { Config, RenderPage } from './types';
+/**
+ * The service as a mountable routup handler, so the CLI can compose it onto
+ * server-core's own listener for the single-container deployment while a
+ * split deployment runs it behind its own server.
+ *
+ * The paths are prefix-free. authup assumes a prefix-stripping reverse
+ * proxy, so a service published at `<origin>/console/auth` receives
+ * `/authorize`, exactly as server-core received it before the split.
+ */
+export declare function createHandler(config: Config, themeProvider?: IThemeProvider, render?: RenderPage): Promise<IApp>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AASjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAWnC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBlD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,cAAc,EAC9B,MAAM,GAAE,UAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAuFhB"}

package/dist/index.d.mts

@@ -0,0 +1,273 @@
+import { CreateApplicationContext, IThemeProvider } from "@authup/server-console-kit";
+import { AuthConsoleConfig, CoreConfig, RootConfig, SECTION_KEY, ThemeConfig, ToObjectLiteral } from "@authup/server-config";
+import { App, IApp, IAppEvent } from "routup";
+import { AuthorizeInfo, Client, StatusResponseFeatures } from "@authup/core-http-kit";
+import { Application } from "orkos";
+//#region src/types.d.ts
+/**
+ * The `authup.yml` NAMESPACE: the sections this service selects keys from.
+ *
+ * Its OWN section is spread flat, because those keys are already this
+ * service's vocabulary; every other section keeps the key the document nests
+ * it at. What the two vocabularies do not share stays out: `apiUrl` and
+ * `distPath` below are this service's names for values the document calls
+ * something else, so they belong to {@link Config} alone.
+ */
+type ConfigInput = ToObjectLiteral<RootConfig & {
+  [SECTION_KEY.THEME]: ThemeConfig;
+  [SECTION_KEY.CORE]: Pick<CoreConfig, 'host' | 'port'>;
+} & AuthConsoleConfig>;
+/**
+ * The service's own configuration. This console is the primary context here
+ * and server-core is the external thing it calls, hence `url` for its own
+ * address and `apiUrl` for the API's.
+ */
+type Config = {
+  /**
+   * The public URL this service is reachable at, e.g.
+   * `https://example.com/console/auth`. Its path component becomes the
+   * console router's base and the prefix every inter-page href carries.
+   */
+  url: string;
+  /**
+   * The public URL of server-core, e.g. `https://example.com`. It is what
+   * the rendered page talks to, so it must be the address the VISITOR can
+   * reach, not an internal one: it becomes the hydration payload's
+   * `baseURL`, from which the console derives its HTTP client and its
+   * cookie path.
+   */
+  apiUrl: string;
+  /**
+   * Where THIS PROCESS reaches server-core: the document's `internalUrl`.
+   * This is the one console that renders server-side, so the two addresses
+   * are different questions, and a container port mapping is enough to make
+   * them different answers: published as `-p 3001:3000`, `apiUrl` names a
+   * port nothing listens on inside the container and every hosted page
+   * answers 502 (#3550). On a cluster network it is the service DNS name,
+   * so the render never leaves for the ingress and back.
+   *
+   * Defaults to {@link apiUrl}, which is right whenever the deployment
+   * answers at one address from both sides. The composed `authup start`
+   * overrides it with its own listen address unless the document named one,
+   * the same self-call rule server-core's internal client follows.
+   */
+  apiInternalUrl: string;
+  /**
+   * Where the standalone service listens. Unrelated to `url`: behind a
+   * reverse proxy the two always differ.
+   */
+  port: number;
+  host: string;
+  /**
+   * A substituted console package to render instead of the resolved
+   * `@authup/client-auth-console` (the `AUTH_CONSOLE_PATH` seam).
+   */
+  distPath: string;
+  theme: ThemeConfig;
+};
+/**
+ * How a page becomes a document. The default is this service's own
+ * `renderPage`, reading the built bundle; a caller serving the console from
+ * source substitutes one that reads through a vite dev server instead.
+ */
+type RenderPage = (event: IAppEvent, config: Config, ctx: {
+  url: string;
+  data: Record<string, any>;
+  theme?: IThemeProvider;
+}) => Promise<string>;
+//#endregion
+//#region src/application.d.ts
+/**
+ * This console as a runnable service: its own module graph, its own
+ * container, its own lifecycle, and nothing of server-core's. It is what
+ * `authup start console` starts, what the `authup-auth-console` bin starts, and what
+ * `authup start` composes onto its own listener, so no caller reaches past
+ * the graph for a bare handler.
+ *
+ * `config` defaults to a FACTORY, not a value: resolving it reads the
+ * document, and a console started alongside others must not do that at
+ * construction time, before the caller has said where to look. Pass
+ * `listen: false` to be mounted on someone else's listener.
+ */
+declare function createApplication(context?: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>>): Application;
+//#endregion
+//#region src/config.d.ts
+/**
+ * The keys this service reads, SELECTED out of the document schema by name.
+ *
+ * Nothing is declared here: every key of `authup.yml` is declared once in
+ * `@authup/server-config`, so this service cannot spell a path, an
+ * environment variable, a default or a reader differently from server-core,
+ * which reads several of the same keys. Neither package depends on the other;
+ * both depend on the declaration.
+ *
+ * Its own section is spread, so this service reads it in its own vocabulary
+ * (`url`, `port`, `host`); every other section stays under the key the
+ * document nests it at.
+ */
+declare const CONFIG_SCHEMA: import("@authup/server-config-kit").Schema<import("@authup/server-config").ToObjectLiteral<import("@authup/server-config").RootConfig & {
+  theme: import("@authup/server-config").ThemeConfig;
+  core: Pick<CoreConfig, "host" | "port">;
+} & import("@authup/server-config").AuthConsoleConfig>, "publicUrl" | "internalUrl" | "db", string>;
+/**
+ * Turn the configuration namespace into the service's own shape: fill the
+ * defaults, derive the one key that is derived rather than configured, and
+ * rename. An empty `url` means the console sits on server-core's own origin
+ * under the default segment, which is the single-origin deployment.
+ *
+ * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread
+ * would let an input carrying one key of a section replace the whole section
+ * and take every other key's default with it.
+ */
+declare function resolveConfig(input: Partial<ConfigInput>): Config;
+/**
+ * The standalone entry's configuration, read from the environment alone.
+ * `authup.yml` reaches this service through the CLI roles, which compose this
+ * very registry into the one document loader.
+ */
+declare function readConfigFromEnv(): Config;
+//#endregion
+//#region src/constants.d.ts
+/**
+ * The vite base the auth console bundle is built with. Asset hrefs in the
+ * shell are emitted against it, so the service mounts its assets there and
+ * rebases them only when the deployment carries a sub-path.
+ */
+declare const VITE_BASE = "/console/auth/";
+/**
+ * The path the service is served under by default, i.e. the path component
+ * of `authConsole.url`. It is the same segment server-core mounted
+ * the assets at before the split, so a built bundle needs no rebuild.
+ */
+declare const BASE_PATH = "/console/auth";
+/**
+ * The pages the service renders. Each is a route of the console bundle's
+ * own router, and each is what a server-core page GET now redirects to.
+ */
+declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
+/**
+ * Where this service mounts the bundle's `assets/` directory. The public
+ * asset URL is the service's own public path plus this route, which is what
+ * the bundle's fixed vite base is rebased onto.
+ */
+declare const ASSETS_PATH = "/assets";
+declare const HEALTH_PATH = "/healthy";
+//#endregion
+//#region src/handler.d.ts
+/**
+ * The service as a mountable routup handler, so the CLI can compose it onto
+ * server-core's own listener for the single-container deployment while a
+ * split deployment runs it behind its own server.
+ *
+ * The paths are prefix-free. authup assumes a prefix-stripping reverse
+ * proxy, so a service published at `<origin>/console/auth` receives
+ * `/authorize`, exactly as server-core received it before the split.
+ */
+declare function createHandler(config: Config, themeProvider?: IThemeProvider, render?: RenderPage): Promise<IApp>;
+//#endregion
+//#region src/payload.d.ts
+/**
+ * The service hydrates ANONYMOUSLY. It holds no credential of its own and
+ * asks server-core only for what an unauthenticated visitor may see, which
+ * is the whole of what these pages render.
+ *
+ * It dispatches against `apiInternalUrl`, never the browser-facing `apiUrl`:
+ * this is a server-side call, so it must not depend on the public address
+ * resolving from inside the deployment. Unlike server-core's own internal
+ * client the swap is on `baseURL` rather than at the transport layer,
+ * because nothing derived from it reaches a caller -- there is no
+ * `redirect_uri` here to be compared byte for byte later.
+ */
+declare function createAPIClient(config: Config): Client;
+/**
+ * The feature flags every workflow page gates its form on. A page that
+ * cannot reach them must not silently claim a workflow is disabled, so the
+ * failure propagates rather than defaulting to false.
+ *
+ * Read ONCE and held for the reader's lifetime, the same shape render.ts
+ * keeps for the dist template, manifest and render entry: `GET /` reports
+ * the version and the boot-config feature flags, none of which changes
+ * without a restart, so a TTL would be a number with nothing behind it.
+ * Without it every workflow page render is an API call, and under the
+ * composed `authup start` those all arrive over loopback on one shared
+ * rate-limit key. Only a SUCCESS is held, so an API that was down at the
+ * first render is retried rather than remembered as broken.
+ *
+ * The cache is instance-scoped rather than module-scoped (098 C4): the
+ * answer depends on which API the client was built against, so two handlers
+ * in one process must not share one, and a module slot would additionally
+ * leak between test cases.
+ */
+declare function createFeaturesReader(client: Client): () => Promise<StatusResponseFeatures>;
+/**
+ * The `/authorize` render input, resolved by server-core (plan 101 D2-1).
+ * The browser's query is forwarded verbatim: the answer is derived from all
+ * of it, the `provider` hint and the closed `error` marker set included.
+ */
+declare function readAuthorizeInfo(client: Client, event: IAppEvent): Promise<AuthorizeInfo>;
+type WorkflowPageOptions = {
+  realmAware?: boolean;
+  tokenAware?: boolean;
+};
+/**
+ * The payload the four workflow pages render from: the feature flags plus
+ * the handful of query params each one declares. Unchanged from the
+ * assembly server-core did before the split, including the open-redirect
+ * guard on `redirect`.
+ */
+declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+//#endregion
+//#region src/redirect.d.ts
+/**
+ * Open-redirect guard for the `redirect` query parameter carried by the
+ * auth workflow pages: only same-origin relative paths pass through, so the
+ * value can be safely reflected into an anchor href / forwarded as a
+ * post-login destination.
+ *
+ * Rejects: non-strings, control/whitespace chars (browsers strip some,
+ * shifting where the URL authority begins), protocol-relative (`//host`),
+ * backslash variants (browsers normalise `\` → `/`), and any scheme
+ * (`javascript:`, `http:`) — both on the raw and once-decoded form so a
+ * percent-encoded separator (`%2f`, `%5c`) can't slip past.
+ */
+declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
+//#endregion
+//#region src/render.d.ts
+declare const renderPage: RenderPage;
+//#endregion
+//#region src/resolve.d.ts
+/**
+ * Point the resolution at a substituted package (config `distPath`)
+ * instead of the node_modules walk. Called once at boot.
+ */
+declare function setPackagePath(value: string | undefined): void;
+/**
+ * Locate the auth console package. The SSR auth workflow UI ships as
+ * `@authup/client-auth-console` (a dependency of THIS service), so the
+ * node_modules ancestor walk from this package's own root (locter's
+ * `locateUp`) finds it for the workspace (symlink onto
+ * apps/client-auth-console) and for a published install alike. Only a
+ * positive result is cached.
+ *
+ * The `cwd` anchor is behavioural, not incidental: it decides which
+ * node_modules tree is walked, so it stays pinned to this package rather
+ * than to the process cwd.
+ */
+declare function resolvePackagePath(): string | undefined;
+/**
+ * Locate the BUILT auth console bundle (`dist/client` template + assets,
+ * `dist/server/server.js` render entry). Only a positive result is cached,
+ * so a dev building the package after boot is picked up on the next
+ * request.
+ */
+declare function resolveDistPath(): string | undefined;
+//#endregion
+//#region src/server.d.ts
+/**
+ * The standalone service: the same handler the CLI mounts in process,
+ * behind a listener of its own.
+ */
+declare function createServer(config: Config): Promise<App>;
+//#endregion
+export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, Config, ConfigInput, HEALTH_PATH, PAGES, RenderPage, VITE_BASE, WorkflowPageOptions, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createServer, readAuthorizeInfo, readConfigFromEnv, renderPage, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect, setPackagePath };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/application.ts","../src/config.ts","../src/constants.ts","../src/handler.ts","../src/payload.ts","../src/redirect.ts","../src/render.ts","../src/resolve.ts","../src/server.ts"],"mappings":";;;;;;;;;;;;;;;KA2BY,cAAc,gBACtB;GAEK,YAAY,QAAQ;GAEpB,YAAY,OAAO,KAAK;IAE7B;;;;;;KAQQ;;;;;;EAMR;;;;;;;;EAQA;;;;;;;;;;;;;;;EAeA;;;;;EAKA;EACA;;;;;EAKA;EAEA,OAAO;;;;;;;KAQC,cACR,OAAO,WACP,QAAQ,QACR;EACI;EACA,MAAM;EACN,QAAQ;MAEX;;;;;;;;;;;;;;;iBC1EW,kBACZ,UAAS,QAAQ,KAAK,yBAAyB,6BAC/C;;;;;;;;;;;;;;;;cCSS,mDAAa,uCAAA,gDAAA;;QAAb,KAAA;oCAcX;;;;;;;;;;;iBAYc,cACZ,OAAO,QAAQ,eACf;;;;;;iBA8BY,qBAAsB;;;;;;;;cCnFzB;;;;;;cAOA;;;;;cAMA;;;;;;cAcA;cAEA;;;;;;;;;;;;iBCYS,cAClB,QAAQ,QACR,gBAAgB,gBAChB,SAAQ,aACR,QAAQ;;;;;;;;;;;;;;;iBC/BI,gBAAgB,QAAQ,SAAU;;;;;;;;;;;;;;;;;;;;iBAiDlC,qBAAqB,QAAQ,eAAgB,QAAQ;;;;;;iBAmC/C,kBAAkB,QAAQ,QAAQ,OAAO,YAAa,QAAQ;KAUxE;EAIR;EACA;;;;;;;;iBASY,sBACZ,OAAO,WACP,UAAU,wBACV,UAAS,sBACT;;;;;;;;;;;;;;;iBCvHY,yBAAyB;;;cCa5B,YAAa;;;;;;;iBCZV,eAAe;;;;;;;;;;;;;iBAkBf;;;;;;;iBA4BA;;;;;;;iBCnDM,aAAa,QAAQ,SAAU,QAAQ"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export * from './application';
+export * from './config';
+export * from './constants';
+export * from './handler';
+export * from './payload';
+export * from './redirect';
+export * from './render';
+export * from './resolve';
+export * from './server';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC"}

package/dist/index.mjs

@@ -0,0 +1,26 @@
+import { _ as CONFIG_SCHEMA, a as resolvePackagePath, c as createAPIClient, d as sanitizeRelativeRedirect, f as ASSETS_PATH, g as VITE_BASE, h as PAGES, i as resolveDistPath, l as createFeaturesReader, m as HEALTH_PATH, n as createHandler, o as setPackagePath, p as BASE_PATH, r as renderPage, s as buildWorkflowPageData, t as createServer, u as readAuthorizeInfo, v as readConfigFromEnv, y as resolveConfig } from "./server-Brhsp_x-.mjs";
+import { createApplication as createApplication$1 } from "@authup/server-console-kit";
+//#region src/application.ts
+/**
+* This console as a runnable service: its own module graph, its own
+* container, its own lifecycle, and nothing of server-core's. It is what
+* `authup start console` starts, what the `authup-auth-console` bin starts, and what
+* `authup start` composes onto its own listener, so no caller reaches past
+* the graph for a bare handler.
+*
+* `config` defaults to a FACTORY, not a value: resolving it reads the
+* document, and a console started alongside others must not do that at
+* construction time, before the caller has said where to look. Pass
+* `listen: false` to be mounted on someone else's listener.
+*/
+function createApplication(context = {}) {
+	return createApplication$1({
+		listen: context.listen,
+		config: context.config ?? readConfigFromEnv,
+		createHandler: (resolved, theme) => createHandler(resolved, theme)
+	});
+}
+//#endregion
+export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, HEALTH_PATH, PAGES, VITE_BASE, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createServer, readAuthorizeInfo, readConfigFromEnv, renderPage, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect, setPackagePath };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["createConsoleApplication"],"sources":["../src/application.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createApplication as createConsoleApplication } from '@authup/server-console-kit';\nimport type { CreateApplicationContext } from '@authup/server-console-kit';\nimport type { Application } from 'orkos';\nimport { readConfigFromEnv } from './config';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * This console as a runnable service: its own module graph, its own\n * container, its own lifecycle, and nothing of server-core's. It is what\n * `authup start console` starts, what the `authup-auth-console` bin starts, and what\n * `authup start` composes onto its own listener, so no caller reaches past\n * the graph for a bare handler.\n *\n * `config` defaults to a FACTORY, not a value: resolving it reads the\n * document, and a console started alongside others must not do that at\n * construction time, before the caller has said where to look. Pass\n * `listen: false` to be mounted on someone else's listener.\n */\nexport function createApplication(\n    context: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>> = {},\n) : Application {\n    return createConsoleApplication<Config>({\n        listen: context.listen,\n        config: context.config ?? readConfigFromEnv,\n        createHandler: (resolved, theme) => createHandler(resolved, theme),\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;AA0BA,SAAgB,kBACZ,UAA4E,CAAC,GACjE;CACZ,OAAOA,oBAAiC;EACpC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,UAAU;EAC1B,gBAAgB,UAAU,UAAU,cAAc,UAAU,KAAK;CACrE,CAAC;AACL"}

package/dist/path.d.ts

@@ -0,0 +1,3 @@
+export declare const CODE_PATH: string;
+export declare const PACKAGE_PATH: string;
+//# sourceMappingURL=path.d.ts.map

package/dist/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,QAA+C,CAAC;AACtE,eAAO,MAAM,YAAY,QAA6B,CAAC"}

package/dist/payload.d.ts

@@ -0,0 +1,55 @@
+import type { AuthorizeInfo, StatusResponseFeatures } from '@authup/core-http-kit';
+import { Client } from '@authup/core-http-kit';
+import type { IAppEvent } from 'routup';
+import type { Config } from './types';
+/**
+ * The service hydrates ANONYMOUSLY. It holds no credential of its own and
+ * asks server-core only for what an unauthenticated visitor may see, which
+ * is the whole of what these pages render.
+ *
+ * It dispatches against `apiInternalUrl`, never the browser-facing `apiUrl`:
+ * this is a server-side call, so it must not depend on the public address
+ * resolving from inside the deployment. Unlike server-core's own internal
+ * client the swap is on `baseURL` rather than at the transport layer,
+ * because nothing derived from it reaches a caller -- there is no
+ * `redirect_uri` here to be compared byte for byte later.
+ */
+export declare function createAPIClient(config: Config): Client;
+/**
+ * The feature flags every workflow page gates its form on. A page that
+ * cannot reach them must not silently claim a workflow is disabled, so the
+ * failure propagates rather than defaulting to false.
+ *
+ * Read ONCE and held for the reader's lifetime, the same shape render.ts
+ * keeps for the dist template, manifest and render entry: `GET /` reports
+ * the version and the boot-config feature flags, none of which changes
+ * without a restart, so a TTL would be a number with nothing behind it.
+ * Without it every workflow page render is an API call, and under the
+ * composed `authup start` those all arrive over loopback on one shared
+ * rate-limit key. Only a SUCCESS is held, so an API that was down at the
+ * first render is retried rather than remembered as broken.
+ *
+ * The cache is instance-scoped rather than module-scoped (098 C4): the
+ * answer depends on which API the client was built against, so two handlers
+ * in one process must not share one, and a module slot would additionally
+ * leak between test cases.
+ */
+export declare function createFeaturesReader(client: Client): () => Promise<StatusResponseFeatures>;
+/**
+ * The `/authorize` render input, resolved by server-core (plan 101 D2-1).
+ * The browser's query is forwarded verbatim: the answer is derived from all
+ * of it, the `provider` hint and the closed `error` marker set included.
+ */
+export declare function readAuthorizeInfo(client: Client, event: IAppEvent): Promise<AuthorizeInfo>;
+export type WorkflowPageOptions = {
+    realmAware?: boolean;
+    tokenAware?: boolean;
+};
+/**
+ * The payload the four workflow pages render from: the feature flags plus
+ * the handful of query params each one declares. Unchanged from the
+ * assembly server-core did before the split, including the open-redirect
+ * guard on `redirect`.
+ */
+export declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+//# sourceMappingURL=payload.d.ts.map

package/dist/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../src/payload.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAkB,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,CAEvD;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,OAAO,CAAC,sBAAsB,CAAC,CA4B3F;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,aAAa,CAAC,CAQjG;AAED,MAAM,MAAM,mBAAmB,GAAG;IAI9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,sBAAsB,EAChC,OAAO,GAAE,mBAAwB,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkBtB"}

package/dist/redirect.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Open-redirect guard for the `redirect` query parameter carried by the
+ * auth workflow pages: only same-origin relative paths pass through, so the
+ * value can be safely reflected into an anchor href / forwarded as a
+ * post-login destination.
+ *
+ * Rejects: non-strings, control/whitespace chars (browsers strip some,
+ * shifting where the URL authority begins), protocol-relative (`//host`),
+ * backslash variants (browsers normalise `\` → `/`), and any scheme
+ * (`javascript:`, `http:`) — both on the raw and once-decoded form so a
+ * percent-encoded separator (`%2f`, `%5c`) can't slip past.
+ */
+export declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAwC3E"}

package/dist/render.d.ts

@@ -0,0 +1,3 @@
+import type { RenderPage } from './types';
+export declare const renderPage: RenderPage;
+//# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAS1C,eAAO,MAAM,UAAU,EAAG,UAkEzB,CAAC"}

package/dist/resolve.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Point the resolution at a substituted package (config `distPath`)
+ * instead of the node_modules walk. Called once at boot.
+ */
+export declare function setPackagePath(value: string | undefined): void;
+/**
+ * Locate the auth console package. The SSR auth workflow UI ships as
+ * `@authup/client-auth-console` (a dependency of THIS service), so the
+ * node_modules ancestor walk from this package's own root (locter's
+ * `locateUp`) finds it for the workspace (symlink onto
+ * apps/client-auth-console) and for a published install alike. Only a
+ * positive result is cached.
+ *
+ * The `cwd` anchor is behavioural, not incidental: it decides which
+ * node_modules tree is walked, so it stays pinned to this package rather
+ * than to the process cwd.
+ */
+export declare function resolvePackagePath(): string | undefined;
+/**
+ * Locate the BUILT auth console bundle (`dist/client` template + assets,
+ * `dist/server/server.js` render entry). Only a positive result is cached,
+ * so a dev building the package after boot is picked up on the next
+ * request.
+ */
+export declare function resolveDistPath(): string | undefined;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAI,IAAI,CAI/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,IAAK,MAAM,GAAG,SAAS,CAoBxD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAK,MAAM,GAAG,SAAS,CAerD"}