@authup/server-auth-console 1.0.0-beta.65 → 1.0.0-beta.67

package/README.md

@@ -5,9 +5,10 @@
 [![Known Vulnerabilities](https://snyk.io/test/github/authup/authup/badge.svg)](https://snyk.io/test/github/authup/authup)
 
 The service behind authup's hosted auth pages: `/authorize` (login and
-consent), `/register`, `/activate`, `/password-forgot`, `/password-reset` and
-`/logout`. A server-core page GET redirects here carrying the request's own
-query, so the authorization request is what identifies the flow.
+consent), `/register`, `/activate`, `/password-forgot`, `/password-reset`,
+`/device` (device verification, RFC 8628) and `/logout`. A server-core page GET
+redirects here carrying the request's own query, so the authorization request
+is what identifies the flow.
 
 It renders `@authup/client-auth-console` through that package's own render
 contract, resolved out of `node_modules`: the SSR bundle per request with the
@@ -16,9 +17,10 @@ its own `/assets`, plus the operator theme and the security headers a login
 page needs.
 
 It hydrates ANONYMOUSLY over HTTP and holds no credential, no database and no
-loopback: `/authorize` from `GET /authorize/info`, the four workflow pages from
-`GET /` plus their own query, and `/logout` from nothing at all, since that page
-drives the end-session call itself. Substituting a package that fulfills the
+loopback: `/authorize` from `GET /authorize/info`, the four workflow pages and
+`/device` from `GET /` plus their own query (`/device` pre-fills the `user_code`
+it was called with), and `/logout` from nothing at all, since that page drives
+the end-session call itself. Substituting a package that fulfills the
 render contract is the supported way to replace the hosted auth UI.
 
 ## Usage

package/dist/{application-YmicGt26.mjs → application-h8KbQSdz.mjs}

@@ -7,9 +7,10 @@ import { basic } from "@routup/basic";
 import path from "node:path";
 import { App, defineCoreHandler } from "routup";
 import { Client } from "@authup/core-http-kit";
+import { getURLBasePath, isUUID } from "@authup/kit";
+import { OAuth2UIColorMode } from "@authup/specs";
 import { useRequestQuery } from "@routup/basic/query";
 import { InternalError } from "@authup/errors";
-import { getURLBasePath } from "@authup/kit";
 import { locateUpSync, read } from "locter";
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -75,7 +76,7 @@ async function readConfigFromEnv() {
 * The render contract this service compiles against. The literal type fails
 * the build the moment the bundle's constant moves without this one.
 */
-const CONTRACT_VERSION = 3;
+const CONTRACT_VERSION = 5;
 /**
 * The vite base the auth console bundle is built with. Asset hrefs in the
 * shell are emitted against it, so the service mounts its assets there and
@@ -98,7 +99,8 @@ const PAGES = [
 	"/activate",
 	"/password-forgot",
 	"/password-reset",
-	"/logout"
+	"/logout",
+	"/device"
 ];
 /**
 * Where this service mounts the bundle's `assets/` directory. The public
@@ -246,6 +248,64 @@ function buildWorkflowPageData(event, features, options = {}) {
 	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
 	return data;
 }
+/**
+* The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`
+* parameter: a space-separated list of BCP47 tags in preference order.
+*
+* It rides the authorization request, so it survives the page GET's hop and
+* the rebuild a federated round-trip makes from the stored code request. The
+* four workflow pages take it straight from their own query, since an RP
+* linking to one can say the same thing there.
+*/
+function readUILocalesHint(event) {
+	const { ui_locales: uiLocales } = useRequestQuery(event);
+	if (typeof uiLocales !== "string") return;
+	return uiLocales.split(" ").find((tag) => /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(tag));
+}
+/**
+* The color mode the RP renders in, from authup's own `ui_color_mode`. One
+* value rather than a list, since there is nothing to negotiate.
+*
+* Checked against the enum rather than local literals because the realm's
+* discovery document ADVERTISES that same set as
+* `ui_color_modes_supported`: a second spelling here would let the pages and
+* the document disagree about what the deployment accepts.
+*/
+function readUIColorModeHint(event) {
+	const { ui_color_mode: uiColorMode } = useRequestQuery(event);
+	return typeof uiColorMode === "string" && Object.values(OAuth2UIColorMode).includes(uiColorMode) ? uiColorMode : void 0;
+}
+/**
+* The `user_code` the device page prefills (RFC 8628 section 3.3.1): the
+* query value uppercased and stripped of everything outside `A-Z0-9`, or
+* `undefined` when nothing bounded remains. The page renders it back, so what
+* reaches the payload is at most 16 alphanumeric characters.
+*/
+function readDeviceUserCode(event) {
+	const query = useRequestQuery(event);
+	if (typeof query.user_code !== "string") return;
+	const canonical = query.user_code.toUpperCase().replace(/[^A-Z0-9]/g, "");
+	if (canonical.length === 0 || canonical.length > 16) return;
+	return canonical;
+}
+/**
+* The provider a federated login on the device page came back from (#3589).
+* A routing hint and no secret: the pending login itself rides an HttpOnly
+* cookie. Anything that is not a uuid is dropped, the rule `/authorize`
+* reads its own hint by: the page interpolates the value into the
+* completion request path.
+*/
+function readDeviceFederatedLogin(event) {
+	const { provider } = useRequestQuery(event);
+	return typeof provider === "string" && isUUID(provider) ? { providerId: provider } : void 0;
+}
+/**
+* The refusal marker the federated callback may attach. A closed set of one,
+* so nothing request-derived is rendered.
+*/
+function readDeviceError(event) {
+	return useRequestQuery(event).error === "access_denied" ? "access_denied" : void 0;
+}
 //#endregion
 //#region src/path.ts
 const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));
@@ -289,7 +349,7 @@ function resolveDistPath(distPath) {
 async function assertRenderContract(distPath) {
 	const entry = path.join(distPath, "server", "server.js");
 	const version = (await read(entry)).CONTRACT_VERSION ?? 1;
-	if (version !== 3) throw new InternalError(`The auth console bundle "${entry}" implements render-contract version ${version}, but this service requires 3. Rebuild it against the current @authup/client-auth-console contract.`);
+	if (version !== 5) throw new InternalError(`The auth console bundle "${entry}" implements render-contract version ${version}, but this service requires 5. Rebuild it against the current @authup/client-auth-console contract.`);
 }
 function createRenderPage(distPath) {
 	let cachedDistPath;
@@ -303,6 +363,8 @@ function createRenderPage(distPath) {
 		const manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(resolved, "client", ".vite", "ssr-manifest.json"), "utf-8"));
 		const render = cachedRender ??= (await read(path.join(resolved, "server", "server.js"))).render;
 		const preferences = readUIClientPreferences(event);
+		if (!preferences.locale || preferences.locale === "auto") preferences.locale = readUILocalesHint(event) || preferences.locale;
+		if (!preferences.colorMode || preferences.colorMode === "system") preferences.colorMode = readUIColorModeHint(event) || preferences.colorMode;
 		const basePath = getURLBasePath(config.url);
 		const payload = {
 			config: {
@@ -403,6 +465,20 @@ async function createHandler$1(config, themeProvider, render) {
 			theme
 		})
 	}));
+	app.use(defineCoreHandler({
+		method: "get",
+		path: "/device",
+		fn: async (event) => renderPage(event, config, {
+			url: "/device",
+			data: {
+				features: await readFeatures(),
+				userCode: readDeviceUserCode(event),
+				federatedLogin: readDeviceFederatedLogin(event),
+				error: readDeviceError(event)
+			},
+			theme
+		})
+	}));
 	const distPath = resolveDistPath(config.distPath);
 	if (distPath) {
 		if (!render) await assertRenderContract(distPath);
@@ -437,6 +513,6 @@ function createApplication$1(context = {}) {
 	});
 }
 //#endregion
-export { VITE_BASE as _, resolveDistPath as a, resolveConfig as b, createAPIClient as c, sanitizeRelativeRedirect as d, ASSETS_PATH as f, PAGES as g, HEALTH_PATH as h, createRenderPage as i, createFeaturesReader as l, CONTRACT_VERSION as m, createHandler$1 as n, resolvePackagePath as o, BASE_PATH as p, assertRenderContract as r, buildWorkflowPageData as s, createApplication$1 as t, readAuthorizeInfo as u, CONFIG_SCHEMA as v, readConfigFromEnv as y };
+export { CONFIG_SCHEMA as C, VITE_BASE as S, resolveConfig as T, ASSETS_PATH as _, resolveDistPath as a, HEALTH_PATH as b, createAPIClient as c, readDeviceError as d, readDeviceFederatedLogin as f, sanitizeRelativeRedirect as g, readUILocalesHint as h, createRenderPage as i, createFeaturesReader as l, readUIColorModeHint as m, createHandler$1 as n, resolvePackagePath as o, readDeviceUserCode as p, assertRenderContract as r, buildWorkflowPageData as s, createApplication$1 as t, readAuthorizeInfo as u, BASE_PATH as v, readConfigFromEnv as w, PAGES as x, CONTRACT_VERSION as y };
 
-//# sourceMappingURL=application-YmicGt26.mjs.map
+//# sourceMappingURL=application-h8KbQSdz.mjs.map

package/dist/application-h8KbQSdz.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-h8KbQSdz.mjs","names":["createHandler","createAssetsHandler","createApplication","createConsoleApplication","createHandler"],"sources":["../src/config.ts","../src/constants.ts","../src/redirect.ts","../src/payload.ts","../src/path.ts","../src/resolve.ts","../src/render.ts","../src/handler.ts","../src/application.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AUTH_CONSOLE_SCHEMA,\n    CORE_SCHEMA,\n    ROOT_SCHEMA,\n    SECTION_KEY,\n    THEME_SCHEMA,\n} from '@authup/server-config';\nimport {\n    buildSchemaDefaults,\n    defineSchema,\n    mergeSchemaData,\n    mountSchema,\n    readSchemaFromEnv,\n    resolveSchemaData,\n} from '@authup/server-config-kit';\nimport { Container } from 'validup';\nimport type { CoreConfig, EnvironmentVariable } from '@authup/server-config';\nimport type { Config, ConfigInput } from './types';\n\n/**\n * The keys this service reads, SELECTED out of the document schema by name.\n *\n * Nothing is declared here: every key of `authup.yml` is declared once in\n * `@authup/server-config`, so this service cannot spell a path, an\n * environment variable, a default or a reader differently from server-core,\n * which reads several of the same keys. Neither package depends on the other;\n * both depend on the declaration.\n *\n * Its own section is spread, so this service reads it in its own vocabulary\n * (`url`, `port`, `host`); every other section stays under the key the\n * document nests it at.\n */\nexport const CONFIG_SCHEMA = defineSchema<ConfigInput, 'publicUrl' | 'internalUrl' | 'db'>({\n    ...AUTH_CONSOLE_SCHEMA,\n    ...ROOT_SCHEMA,\n    [SECTION_KEY.THEME]: THEME_SCHEMA,\n    // Two keys of core, never the section. `publicUrl` derives from\n    // the core listener address, which is what a console needs; selecting the\n    // whole section also selects its INVARIANTS, and `resolveSchemaData` runs\n    // every resolver in a registry -- so a console would refuse to start on a\n    // short SECRETS_ENCRYPTION_KEY, or on mfaRequired without mfaEnabled, for\n    // keys it has no database, key store or MFA to use.\n    [SECTION_KEY.CORE]: defineSchema<Pick<CoreConfig, 'host' | 'port'>, never, EnvironmentVariable>({\n        host: CORE_SCHEMA.host,\n        port: CORE_SCHEMA.port,\n    }),\n});\n\n/**\n * Turn the configuration namespace into the service's own shape: validate the\n * input against the declared zod types, fill the defaults, derive the one key\n * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin\n * under the default segment, which is the single-origin deployment.\n *\n * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread\n * would let an input carrying one key of a section replace the whole section\n * and take every other key's default with it.\n */\nexport async function resolveConfig(\n    input: Partial<ConfigInput>,\n) : Promise<Config> {\n    const validator = new Container<ConfigInput>();\n    mountSchema(validator, CONFIG_SCHEMA);\n\n    const parsed = await validator.run(input);\n\n    const values = resolveSchemaData<ConfigInput>(\n        CONFIG_SCHEMA,\n        mergeSchemaData<ConfigInput>(\n            CONFIG_SCHEMA,\n            buildSchemaDefaults<ConfigInput>(CONFIG_SCHEMA),\n            parsed,\n        ),\n    ) as ConfigInput;\n\n    return {\n        url: values.url,\n        apiUrl: values.publicUrl,\n        // `internalUrl` falls back to `publicUrl`, so an operator who has one\n        // address for both sides configures nothing. The composed `authup\n        // start` overrides this with its own listen address unless the\n        // document named one.\n        apiInternalUrl: values.internalUrl,\n        port: values.port,\n        host: values.host,\n        distPath: values.path,\n        theme: values.theme,\n    };\n}\n\n/**\n * The standalone entry's configuration, read from the environment alone.\n * `authup.yml` reaches this service through the CLI roles, which compose this\n * very registry into the one document loader.\n */\nexport async function readConfigFromEnv() : Promise<Config> {\n    // The explicit type argument is load-bearing: inferred from the schema\n    // object, a key declared without a default (the derived publicUrl) comes\n    // back as unknown.\n    const input : Partial<ConfigInput> = readSchemaFromEnv<ConfigInput>(CONFIG_SCHEMA);\n\n    return resolveConfig(input);\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { CONTRACT_VERSION as BundleContractVersion } from '@authup/client-auth-console';\n\n/**\n * The render contract this service compiles against. The literal type fails\n * the build the moment the bundle's constant moves without this one.\n */\nexport const CONTRACT_VERSION : typeof BundleContractVersion = 5;\n\n/**\n * The vite base the auth console bundle is built with. Asset hrefs in the\n * shell are emitted against it, so the service mounts its assets there and\n * rebases them only when the deployment carries a sub-path.\n */\nexport const VITE_BASE = '/console/auth/';\n\n/**\n * The path the service is served under by default, i.e. the path component\n * of `authConsole.url`. It is the same segment server-core mounted\n * the assets at before the split, so a built bundle needs no rebuild.\n */\nexport const BASE_PATH = '/console/auth';\n\n/**\n * The pages the service renders. Each is a route of the console bundle's\n * own router, and each is what a server-core page GET now redirects to.\n */\nexport const PAGES = [\n    '/authorize',\n    '/register',\n    '/activate',\n    '/password-forgot',\n    '/password-reset',\n    '/logout',\n    '/device',\n] as const;\n\n/**\n * Where this service mounts the bundle's `assets/` directory. The public\n * asset URL is the service's own public path plus this route, which is what\n * the bundle's fixed vite base is rebased onto.\n */\nexport const ASSETS_PATH = '/assets';\n\nexport const HEALTH_PATH = '/healthy';\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { AuthorizeInfo, StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport { Client } from '@authup/core-http-kit';\nimport { isUUID } from '@authup/kit';\nimport { OAuth2UIColorMode } from '@authup/specs';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from './redirect';\nimport type { Config } from './types';\n\n/**\n * The service hydrates ANONYMOUSLY. It holds no credential of its own and\n * asks server-core only for what an unauthenticated visitor may see, which\n * is the whole of what these pages render.\n *\n * It dispatches against `apiInternalUrl`, never the browser-facing `apiUrl`:\n * this is a server-side call, so it must not depend on the public address\n * resolving from inside the deployment. Unlike server-core's own internal\n * client the swap is on `baseURL` rather than at the transport layer,\n * because nothing derived from it reaches a caller -- there is no\n * `redirect_uri` here to be compared byte for byte later.\n */\nexport function createAPIClient(config: Config) : Client {\n    return new Client({ baseURL: config.apiInternalUrl });\n}\n\n/**\n * Report an outbound failure to the operator and raise one the visitor may\n * see, which is deliberately not the same error.\n *\n * hapic embeds the resolved request URL in its message, and this service has\n * no error middleware: routup answers with `event.error.message` verbatim, on\n * the public login page. That URL is `apiInternalUrl`, which on a split\n * deployment names a service on the operator's own network, so an API that is\n * merely down would publish its internal address to every anonymous visitor.\n * It was harmless while the value was `publicUrl`, an address the browser\n * already had.\n *\n * The rule and the remedy are server-core's own (`sanitizeError` /\n * `describeError`): the caller gets a message it can act on, the detail goes\n * to the log. `console.error` rather than a logger because a console handler\n * is built from a config alone and is given none -- and because this line is\n * the only trace such a failure leaves, which is how #3550 was diagnosed in\n * the first place.\n */\nfunction failWithoutAddress(error: unknown) : never {\n    // eslint-disable-next-line no-console\n    console.error('[authup] the auth console could not reach the API:', error);\n\n    throw new Error('The identity provider could not be reached.');\n}\n\n/**\n * The feature flags every workflow page gates its form on. A page that\n * cannot reach them must not silently claim a workflow is disabled, so the\n * failure propagates rather than defaulting to false.\n *\n * Read ONCE and held for the reader's lifetime, the same shape render.ts\n * keeps for the dist template, manifest and render entry: `GET /` reports\n * the version and the boot-config feature flags, none of which changes\n * without a restart, so a TTL would be a number with nothing behind it.\n * Without it every workflow page render is an API call, and under the\n * composed `authup start` those all arrive over loopback on one shared\n * rate-limit key. Only a SUCCESS is held, so an API that was down at the\n * first render is retried rather than remembered as broken.\n *\n * The cache is instance-scoped rather than module-scoped (098 C4): the\n * answer depends on which API the client was built against, so two handlers\n * in one process must not share one, and a module slot would additionally\n * leak between test cases.\n */\nexport function createFeaturesReader(client: Client) : () => Promise<StatusResponseFeatures> {\n    let cached : StatusResponseFeatures | undefined;\n    let pending : Promise<StatusResponseFeatures> | undefined;\n\n    return () => {\n        if (cached) {\n            return Promise.resolve(cached);\n        }\n\n        if (pending) {\n            return pending;\n        }\n\n        pending = client.status.get()\n            .then((status: StatusResponse) => {\n                cached = status.features;\n\n                return cached;\n            })\n            .catch((e) => failWithoutAddress(e));\n\n        const clear = () => {\n            pending = undefined;\n        };\n        pending.then(clear, clear);\n\n        return pending;\n    };\n}\n\n/**\n * The `/authorize` render input, resolved by server-core (plan 101 D2-1).\n * The browser's query is forwarded verbatim: the answer is derived from all\n * of it, the `provider` hint and the closed `error` marker set included.\n */\nexport async function readAuthorizeInfo(client: Client, event: IAppEvent) : Promise<AuthorizeInfo> {\n    const { search } = new URL(event.request.url);\n\n    try {\n        return await client.authorize.getInfo(search);\n    } catch (e) {\n        return failWithoutAddress(e);\n    }\n}\n\nexport type WorkflowPageOptions = {\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * The payload the four workflow pages render from: the feature flags plus\n * the handful of query params each one declares. Unchanged from the\n * assembly server-core did before the split, including the open-redirect\n * guard on `redirect`.\n */\nexport function buildWorkflowPageData(\n    event: IAppEvent,\n    features: StatusResponseFeatures,\n    options: WorkflowPageOptions = {},\n) : Record<string, any> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return data;\n}\n\n/**\n * The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`\n * parameter: a space-separated list of BCP47 tags in preference order.\n *\n * It rides the authorization request, so it survives the page GET's hop and\n * the rebuild a federated round-trip makes from the stored code request. The\n * four workflow pages take it straight from their own query, since an RP\n * linking to one can say the same thing there.\n */\nexport function readUILocalesHint(event: IAppEvent) : string | undefined {\n    const { ui_locales: uiLocales } = useRequestQuery(event);\n    if (typeof uiLocales !== 'string') {\n        return undefined;\n    }\n\n    // ponytail: the first well-formed tag wins, and it is NOT narrowed to a\n    // locale authup has a catalog for. That is the latitude the navigator\n    // path already takes -- a `de-CH` visitor is stamped `lang=\"de-CH\"` and\n    // reads the `de` catalog. Narrow here (matchLocale over LOCALES) if the\n    // lang attribute ever has to name only an authored locale, which costs\n    // this service a dependency on @authup/i18n.\n    return uiLocales\n        .split(' ')\n        .find((tag) => /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(tag));\n}\n\n/**\n * The color mode the RP renders in, from authup's own `ui_color_mode`. One\n * value rather than a list, since there is nothing to negotiate.\n *\n * Checked against the enum rather than local literals because the realm's\n * discovery document ADVERTISES that same set as\n * `ui_color_modes_supported`: a second spelling here would let the pages and\n * the document disagree about what the deployment accepts.\n */\nexport function readUIColorModeHint(event: IAppEvent) : string | undefined {\n    const { ui_color_mode: uiColorMode } = useRequestQuery(event);\n\n    return typeof uiColorMode === 'string' &&\n        (Object.values(OAuth2UIColorMode) as string[]).includes(uiColorMode) ?\n        uiColorMode :\n        undefined;\n}\n\n/**\n * The `user_code` the device page prefills (RFC 8628 section 3.3.1): the\n * query value uppercased and stripped of everything outside `A-Z0-9`, or\n * `undefined` when nothing bounded remains. The page renders it back, so what\n * reaches the payload is at most 16 alphanumeric characters.\n */\nexport function readDeviceUserCode(event: IAppEvent) : string | undefined {\n    const query = useRequestQuery(event);\n    if (typeof query.user_code !== 'string') {\n        return undefined;\n    }\n\n    const canonical = query.user_code.toUpperCase().replace(/[^A-Z0-9]/g, '');\n    if (canonical.length === 0 || canonical.length > 16) {\n        return undefined;\n    }\n\n    return canonical;\n}\n\n/**\n * The provider a federated login on the device page came back from (#3589).\n * A routing hint and no secret: the pending login itself rides an HttpOnly\n * cookie. Anything that is not a uuid is dropped, the rule `/authorize`\n * reads its own hint by: the page interpolates the value into the\n * completion request path.\n */\nexport function readDeviceFederatedLogin(event: IAppEvent) : { providerId: string } | undefined {\n    const { provider } = useRequestQuery(event);\n\n    return typeof provider === 'string' && isUUID(provider) ?\n        { providerId: provider } :\n        undefined;\n}\n\n/**\n * The refusal marker the federated callback may attach. A closed set of one,\n * so nothing request-derived is rendered.\n */\nexport function readDeviceError(event: IAppEvent) : 'access_denied' | undefined {\n    return useRequestQuery(event).error === 'access_denied' ? 'access_denied' : undefined;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from './path';\n\n/**\n * Locate the auth console package: a substituted one (config `distPath`)\n * first, else the SSR auth workflow UI shipped as\n * `@authup/client-auth-console` (a dependency of THIS service), which the\n * node_modules ancestor walk from this package's own root (locter's\n * `locateUp`) finds for the workspace (symlink onto\n * apps/client-auth-console) and for a published install alike.\n *\n * The `cwd` anchor is behavioural, not incidental: it decides which\n * node_modules tree is walked, so it stays pinned to this package rather\n * than to the process cwd.\n */\nexport function resolvePackagePath(distPath?: string) : string | undefined {\n    return distPath || locateUpSync(\n        'node_modules/@authup/client-auth-console/package.json',\n        { cwd: PACKAGE_PATH },\n    )?.directory;\n}\n\n/**\n * Locate the BUILT auth console bundle (`dist/client` template + assets,\n * `dist/server/server.js` render entry). A half-built package is no bundle:\n * without the render entry there is nothing to render with.\n */\nexport function resolveDistPath(distPath?: string) : string | undefined {\n    const packagePath = resolvePackagePath(distPath);\n    if (!packagePath) {\n        return undefined;\n    }\n\n    const candidate = path.join(packagePath, 'dist');\n    if (\n        fs.existsSync(path.join(candidate, 'client', 'index.html')) &&\n        fs.existsSync(path.join(candidate, 'server', 'server.js'))\n    ) {\n        return candidate;\n    }\n\n    return undefined;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { HydrationPayload, RenderFunction } from '@authup/client-auth-console';\nimport { InternalError } from '@authup/errors';\nimport { getURLBasePath } from '@authup/kit';\nimport {\n    applyTheme,\n    applyUIPageHeaders,\n    readUIClientPreferences,\n    rebaseAssetURLs,\n    replaceTemplateMarker,\n    stampHtmlAttributes,\n} from '@authup/server-console-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { CONTRACT_VERSION, VITE_BASE } from './constants';\nimport { readUIColorModeHint, readUILocalesHint } from './payload';\nimport { resolveDistPath } from './resolve';\nimport type { RenderPage } from './types';\n\n/**\n * Refuse a bundle built against another render contract at boot, naming the\n * entry and both versions, instead of failing per request on `/authorize`.\n * A bundle predating the export is version 1. Reads the module itself, which\n * Node's ESM cache then hands the render for free.\n */\nexport async function assertRenderContract(distPath: string) : Promise<void> {\n    const entry = path.join(distPath, 'server', 'server.js');\n    const bundle = await read(entry) as Record<string, any>;\n    const version = bundle.CONTRACT_VERSION ?? 1;\n\n    if (version !== CONTRACT_VERSION) {\n        throw new InternalError(\n            `The auth console bundle \"${entry}\" implements render-contract version ${version}, ` +\n            `but this service requires ${CONTRACT_VERSION}. ` +\n            'Rebuild it against the current @authup/client-auth-console contract.',\n        );\n    }\n}\n\nexport function createRenderPage(distPath?: string) : RenderPage {\n    // Per-handler caches for the immutable production SSR assets: the dist\n    // template, manifest and server bundle do not change after boot, so read\n    // them once instead of per request (the auth/login routes are hot paths).\n    // Held in this closure rather than at module scope so a second handler in\n    // the process, with a substituted package, never renders another's\n    // template. Only a resolved dist is kept, so a bundle built after boot is\n    // picked up on the next request.\n    let cachedDistPath: string | undefined;\n    let cachedHtml: string | undefined;\n    let cachedManifest: Record<string, any> | undefined;\n    let cachedRender: RenderFunction | undefined;\n\n    return async (event, config, ctx) => {\n        const resolved = (cachedDistPath ??= resolveDistPath(distPath));\n        if (!resolved) {\n            throw new InternalError(\n                'The auth console bundle (@authup/client-auth-console) is not built or installed.',\n            );\n        }\n\n        const html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(resolved, 'client', 'index.html'),\n            'utf-8',\n        ));\n        const manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(resolved, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        const render = (cachedRender ??= (await read(\n            path.join(resolved, 'server', 'server.js'),\n        )).render as RenderFunction);\n\n        // The client app hydrates locale + color-mode from the payload, so it\n        // adopts the same values the HTML shell is stamped with below.\n        const preferences = readUIClientPreferences(event);\n\n        // `ui_locales` is what the RP says the visitor is reading over there,\n        // which is fresher than anything this origin knows about a visitor\n        // arriving for the first time. It seeds the page only while they have\n        // made no choice HERE: `vc-locale` holds `auto` until the switcher\n        // writes a tag (@vuecs/locale never writes the resolved value back),\n        // so an explicit choice keeps winning and the switcher cannot be\n        // undone by the next authorize request carrying the hint. Seeding is\n        // all it does -- the ref starts there, and nothing writes it back.\n        if (!preferences.locale || preferences.locale === 'auto') {\n            preferences.locale = readUILocalesHint(event) || preferences.locale;\n        }\n\n        // `ui_color_mode` the same way, and `system` is its `auto`: the\n        // switcher is a binary toggle, so it only ever writes `light` or\n        // `dark`, and anything else in the cookie means the visitor never\n        // touched it here.\n        if (!preferences.colorMode || preferences.colorMode === 'system') {\n            preferences.colorMode = readUIColorModeHint(event) || preferences.colorMode;\n        }\n\n        // `baseURL` is server-core's public URL: the console derives its HTTP\n        // client and its cookie path from it. `basePath` is where THIS service\n        // is served, which is what the router and every inter-page href need.\n        // Before the split the two were the same value; they are not any more,\n        // so the console reads them separately.\n        const basePath = getURLBasePath(config.url);\n\n        const payload : HydrationPayload = {\n            config: {\n                baseURL: config.apiUrl,\n                basePath,\n                colorMode: preferences.colorMode,\n                locale: preferences.locale,\n            },\n            data: ctx.data,\n        };\n\n        const [appHtml, preloadLinks] = await render({\n            url: ctx.url,\n            manifest,\n            payload,\n        });\n\n        let body = replaceTemplateMarker(html, '<!--preload-links-->', preloadLinks);\n        body = replaceTemplateMarker(body, '<!--app-html-->', appHtml);\n\n        body = stampHtmlAttributes(body, preferences);\n\n        // This service mounts the bundle's assets at its own /assets, so the\n        // fixed vite base in every href is replaced by this service's public\n        // path. The vite base was decided when the bundle was built and says\n        // nothing about where the service is published.\n        body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);\n\n        // The theme's own asset urls are built from the same base, and the\n        // service mounts them under it, so a themed deployment needs no rule of\n        // its own at the reverse proxy beyond the one that reaches this service.\n        body = await applyTheme(body, ctx.theme, basePath);\n\n        applyUIPageHeaders(event);\n\n        return body;\n    };\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IThemeProvider } from '@authup/server-console-kit';\nimport {\n    THEME_ASSET_MOUNT_PATH,\n    createThemeAssetsHandler,\n    createThemeProvider,\n} from '@authup/server-console-kit';\nimport { createHandler as createAssetsHandler } from '@routup/assets';\nimport { basic } from '@routup/basic';\nimport path from 'node:path';\nimport type { IApp } from 'routup';\nimport { App, defineCoreHandler } from 'routup';\nimport { ASSETS_PATH, HEALTH_PATH } from './constants';\nimport {\n    buildWorkflowPageData,\n    createAPIClient,\n    createFeaturesReader,\n    readAuthorizeInfo,\n    readDeviceError,\n    readDeviceFederatedLogin,\n    readDeviceUserCode,\n} from './payload';\nimport { assertRenderContract, createRenderPage } from './render';\nimport { resolveDistPath } from './resolve';\nimport type { Config, RenderPage } from './types';\n\nconst WORKFLOW_PAGES : {\n    url: string,\n    realmAware?: boolean,\n    tokenAware?: boolean\n}[] = [\n    { url: '/register', realmAware: true },\n    { url: '/activate', tokenAware: true },\n    { url: '/password-forgot', realmAware: true },\n    {\n        url: '/password-reset',\n        realmAware: true,\n        tokenAware: true,\n    },\n];\n\n/**\n * The service as a mountable routup handler, so the CLI can compose it onto\n * server-core's own listener for the single-container deployment while a\n * split deployment runs it behind its own server.\n *\n * The paths are prefix-free. authup assumes a prefix-stripping reverse\n * proxy, so a service published at `<origin>/console/auth` receives\n * `/authorize`, exactly as server-core received it before the split.\n */\nexport async function createHandler(\n    config: Config,\n    themeProvider?: IThemeProvider,\n    render?: RenderPage,\n) : Promise<IApp> {\n    const renderPage = render ?? createRenderPage(config.distPath);\n\n    const app = new App();\n    const client = createAPIClient(config);\n    const readFeatures = createFeaturesReader(client);\n\n    // The shell is stamped from the vc-locale / vc-color-mode cookies, and\n    // without the plugin every cookie read answers undefined, which is a\n    // silent flash of the wrong color mode on every full load. server-core\n    // registers it globally, so a mounted handler inherits one; a standalone\n    // service has nothing above it.\n    app.use(basic({ cookie: true, query: true }));\n\n    // A missing directory disables theming entirely: no provider is created\n    // and the rendered pages are byte-identical to the un-themed ones, so the\n    // default configuration pays nothing. An invalid manifest throws here and\n    // fails the boot rather than surfacing per request.\n    // Injected by the theme module when this runs inside the console\n    // application; built here for a caller holding only a config.\n    const theme = themeProvider ?? await createThemeProvider(config);\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: HEALTH_PATH,\n        fn: () => ({ status: 'ok' }),\n    }));\n\n    if (theme) {\n        app.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(theme));\n    }\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/authorize',\n        fn: async (event) => renderPage(event, config, {\n            url: '/authorize',\n            data: await readAuthorizeInfo(client, event),\n            theme,\n        }),\n    }));\n\n    for (const page of WORKFLOW_PAGES) {\n        app.use(defineCoreHandler({\n            method: 'get',\n            path: page.url,\n            fn: async (event) => {\n                const features = await readFeatures();\n\n                return renderPage(event, config, {\n                    url: page.url,\n                    data: buildWorkflowPageData(event, features, page),\n                    theme,\n                });\n            },\n        }));\n    }\n\n    // The logout page needs nothing resolved up front: it drives the\n    // end-session call itself and renders from the answer, so the render\n    // stays a pure shell and no request reaches server-core here.\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/logout',\n        fn: async (event) => renderPage(event, config, {\n            url: '/logout',\n            data: {},\n            theme,\n        }),\n    }));\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/device',\n        fn: async (event) => renderPage(event, config, {\n            url: '/device',\n            data: {\n                features: await readFeatures(),\n                userCode: readDeviceUserCode(event),\n                federatedLogin: readDeviceFederatedLogin(event),\n                error: readDeviceError(event),\n            },\n            theme,\n        }),\n    }));\n\n    // Only the assets directory is mounted, never dist/client itself: the\n    // template and the ssr manifest are inputs of the render, not files to\n    // serve. A missing bundle only disables the mount; the page routes\n    // report the actionable error. A resolved one is checked against the\n    // render contract here, unless a substituted render never reads it.\n    const distPath = resolveDistPath(config.distPath);\n    if (distPath) {\n        if (!render) {\n            await assertRenderContract(distPath);\n        }\n\n        // Every name carries a content hash, so a new build means new names.\n        app.use(ASSETS_PATH, createAssetsHandler(\n            path.posix.join(distPath, 'client', 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n                cacheMaxAge: 60 * 60 * 24 * 365,\n                cacheImmutable: true,\n            },\n        ));\n    }\n\n    return app;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createApplication as createConsoleApplication } from '@authup/server-console-kit';\nimport type { CreateApplicationContext } from '@authup/server-console-kit';\nimport type { Application } from 'orkos';\nimport { readConfigFromEnv } from './config';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * This console as a runnable service: its own module graph, its own\n * container, its own lifecycle, and nothing of server-core's. It is what\n * `authup start console` starts, what the `authup-auth-console` bin starts, and what\n * `authup start` composes onto its own listener, so no caller reaches past\n * the graph for a bare handler.\n *\n * `config` defaults to a FACTORY, not a value: resolving it reads the\n * document, and a console started alongside others must not do that at\n * construction time, before the caller has said where to look. Pass\n * `listen: false` to be mounted on someone else's listener.\n */\nexport function createApplication(\n    context: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>> = {},\n) : Application {\n    return createConsoleApplication<Config>({\n        listen: context.listen,\n        config: context.config ?? readConfigFromEnv,\n        createHandler: (resolved, theme) => createHandler(resolved, theme),\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,MAAa,gBAAgB,aAA8D;CACvF,GAAG;CACH,GAAG;EACF,YAAY,QAAQ;EAOpB,YAAY,OAAO,aAA4E;EAC5F,MAAM,YAAY;EAClB,MAAM,YAAY;CACtB,CAAC;AACL,CAAC;;;;;;;;;;;AAYD,eAAsB,cAClB,OACgB;CAChB,MAAM,YAAY,IAAI,UAAuB;CAC7C,YAAY,WAAW,aAAa;CAEpC,MAAM,SAAS,MAAM,UAAU,IAAI,KAAK;CAExC,MAAM,SAAS,kBACX,eACA,gBACI,eACA,oBAAiC,aAAa,GAC9C,MACJ,CACJ;CAEA,OAAO;EACH,KAAK,OAAO;EACZ,QAAQ,OAAO;EAKf,gBAAgB,OAAO;EACvB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,OAAO,OAAO;CAClB;AACJ;;;;;;AAOA,eAAsB,oBAAsC;CAMxD,OAAO,cAF8B,kBAA+B,aAE3C,CAAC;AAC9B;;;;;;;AChGA,MAAa,mBAAkD;;;;;;AAO/D,MAAa,YAAY;;;;;;AAOzB,MAAa,YAAY;;;;;AAMzB,MAAa,QAAQ;CACjB;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;AAOA,MAAa,cAAc;AAE3B,MAAa,cAAc;;;;;;;;;;;;;;;AC/B3B,SAAgB,yBAAyB,OAAoC;CACzE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAC9C;CAMJ,IAAI,wBAAwB,KAAK,KAAK,GAClC;CAGJ,IAAI;CACJ,IAAI;EACA,UAAU,mBAAmB,KAAK;CACtC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwB,KAAK,OAAO,GACpC;CAGJ,KAAK,MAAM,aAAa,CAAC,OAAO,OAAO,GAAG;EACtC,IAAI,CAAC,UAAU,WAAW,GAAG,GACzB;EAEJ,IAAI,UAAU,SAAS,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,OAClE;EAEJ,IAAI,UAAU,SAAS,IAAI,GACvB;CAER;CAEA,OAAO;AACX;;;;;;;;;;;;;;;AC/BA,SAAgB,gBAAgB,QAAyB;CACrD,OAAO,IAAI,OAAO,EAAE,SAAS,OAAO,eAAe,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,mBAAmB,OAAwB;CAEhD,QAAQ,MAAM,sDAAsD,KAAK;CAEzE,MAAM,IAAI,MAAM,6CAA6C;AACjE;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,qBAAqB,QAAwD;CACzF,IAAI;CACJ,IAAI;CAEJ,aAAa;EACT,IAAI,QACA,OAAO,QAAQ,QAAQ,MAAM;EAGjC,IAAI,SACA,OAAO;EAGX,UAAU,OAAO,OAAO,IAAI,CAAC,CACxB,MAAM,WAA2B;GAC9B,SAAS,OAAO;GAEhB,OAAO;EACX,CAAC,CAAC,CACD,OAAO,MAAM,mBAAmB,CAAC,CAAC;EAEvC,MAAM,cAAc;GAChB,UAAU,KAAA;EACd;EACA,QAAQ,KAAK,OAAO,KAAK;EAEzB,OAAO;CACX;AACJ;;;;;;AAOA,eAAsB,kBAAkB,QAAgB,OAA2C;CAC/F,MAAM,EAAE,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;CAE5C,IAAI;EACA,OAAO,MAAM,OAAO,UAAU,QAAQ,MAAM;CAChD,SAAS,GAAG;EACR,OAAO,mBAAmB,CAAC;CAC/B;AACJ;;;;;;;AAgBA,SAAgB,sBACZ,OACA,UACA,UAA+B,CAAC,GACZ;CACpB,MAAM,QAAQ,gBAAgB,KAAK;CAEnC,MAAM,OAA4B;EAC9B;EACA,UAAU,yBAAyB,MAAM,QAAQ;CACrD;CAEA,IAAI,QAAQ,YAAY;EACpB,MAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,MAAM;EAC1E,KAAK,UAAU,OAAO,YAAY,WAAW,UAAU,KAAA;CAC3D;CAEA,IAAI,QAAQ,YACR,KAAK,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,KAAA;CAGjE,OAAO;AACX;;;;;;;;;;AAWA,SAAgB,kBAAkB,OAAuC;CACrE,MAAM,EAAE,YAAY,cAAc,gBAAgB,KAAK;CACvD,IAAI,OAAO,cAAc,UACrB;CASJ,OAAO,UACF,MAAM,GAAG,CAAC,CACV,MAAM,QAAQ,kCAAkC,KAAK,GAAG,CAAC;AAClE;;;;;;;;;;AAWA,SAAgB,oBAAoB,OAAuC;CACvE,MAAM,EAAE,eAAe,gBAAgB,gBAAgB,KAAK;CAE5D,OAAO,OAAO,gBAAgB,YACzB,OAAO,OAAO,iBAAiB,CAAC,CAAc,SAAS,WAAW,IACnE,cACA,KAAA;AACR;;;;;;;AAQA,SAAgB,mBAAmB,OAAuC;CACtE,MAAM,QAAQ,gBAAgB,KAAK;CACnC,IAAI,OAAO,MAAM,cAAc,UAC3B;CAGJ,MAAM,YAAY,MAAM,UAAU,YAAY,CAAC,CAAC,QAAQ,cAAc,EAAE;CACxE,IAAI,UAAU,WAAW,KAAK,UAAU,SAAS,IAC7C;CAGJ,OAAO;AACX;;;;;;;;AASA,SAAgB,yBAAyB,OAAuD;CAC5F,MAAM,EAAE,aAAa,gBAAgB,KAAK;CAE1C,OAAO,OAAO,aAAa,YAAY,OAAO,QAAQ,IAClD,EAAE,YAAY,SAAS,IACvB,KAAA;AACR;;;;;AAMA,SAAgB,gBAAgB,OAAgD;CAC5E,OAAO,gBAAgB,KAAK,CAAC,CAAC,UAAU,kBAAkB,kBAAkB,KAAA;AAChF;;;AC3OA,MAAa,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AACpE,MAAa,eAAe,KAAK,KAAK,WAAW,IAAI;;;;;;;;;;;;;;;ACarD,SAAgB,mBAAmB,UAAwC;CACvE,OAAO,YAAY,aACf,yDACA,EAAE,KAAK,aAAa,CACxB,CAAC,EAAE;AACP;;;;;;AAOA,SAAgB,gBAAgB,UAAwC;CACpE,MAAM,cAAc,mBAAmB,QAAQ;CAC/C,IAAI,CAAC,aACD;CAGJ,MAAM,YAAY,KAAK,KAAK,aAAa,MAAM;CAC/C,IACI,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,YAAY,CAAC,KAC1D,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,WAAW,CAAC,GAEzD,OAAO;AAIf;;;;;;;;;ACnBA,eAAsB,qBAAqB,UAAkC;CACzE,MAAM,QAAQ,KAAK,KAAK,UAAU,UAAU,WAAW;CAEvD,MAAM,WAAU,MADK,KAAK,KAAK,EAAA,CACR,oBAAoB;CAE3C,IAAI,YAAA,GACA,MAAM,IAAI,cACN,4BAA4B,MAAM,uCAAuC,QAAQ,oGAGrF;AAER;AAEA,SAAgB,iBAAiB,UAAgC;CAQ7D,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,OAAO,OAAO,OAAO,QAAQ,QAAQ;EACjC,MAAM,WAAY,mBAAmB,gBAAgB,QAAQ;EAC7D,IAAI,CAAC,UACD,MAAM,IAAI,cACN,kFACJ;EAGJ,MAAM,OAAQ,eAAe,MAAM,GAAG,SAAS,SAC3C,KAAK,KAAK,UAAU,UAAU,YAAY,GAC1C,OACJ;EACA,MAAM,WAAY,mBAAmB,KAAK,MAAM,MAAM,GAAG,SAAS,SAC9D,KAAK,KAAK,UAAU,UAAU,SAAS,mBAAmB,GAC1D,OACJ,CAAC;EACD,MAAM,SAAU,kBAAkB,MAAM,KACpC,KAAK,KAAK,UAAU,UAAU,WAAW,CAC7C,EAAA,CAAG;EAIH,MAAM,cAAc,wBAAwB,KAAK;EAUjD,IAAI,CAAC,YAAY,UAAU,YAAY,WAAW,QAC9C,YAAY,SAAS,kBAAkB,KAAK,KAAK,YAAY;EAOjE,IAAI,CAAC,YAAY,aAAa,YAAY,cAAc,UACpD,YAAY,YAAY,oBAAoB,KAAK,KAAK,YAAY;EAQtE,MAAM,WAAW,eAAe,OAAO,GAAG;EAE1C,MAAM,UAA6B;GAC/B,QAAQ;IACJ,SAAS,OAAO;IAChB;IACA,WAAW,YAAY;IACvB,QAAQ,YAAY;GACxB;GACA,MAAM,IAAI;EACd;EAEA,MAAM,CAAC,SAAS,gBAAgB,MAAM,OAAO;GACzC,KAAK,IAAI;GACT;GACA;EACJ,CAAC;EAED,IAAI,OAAO,sBAAsB,MAAM,wBAAwB,YAAY;EAC3E,OAAO,sBAAsB,MAAM,mBAAmB,OAAO;EAE7D,OAAO,oBAAoB,MAAM,WAAW;EAM5C,OAAO,gBAAgB,MAAM,WAAW,GAAG,SAAS,EAAE;EAKtD,OAAO,MAAM,WAAW,MAAM,IAAI,OAAO,QAAQ;EAEjD,mBAAmB,KAAK;EAExB,OAAO;CACX;AACJ;;;AClHA,MAAM,iBAIA;CACF;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAoB,YAAY;CAAK;CAC5C;EACI,KAAK;EACL,YAAY;EACZ,YAAY;CAChB;AACJ;;;;;;;;;;AAWA,eAAsBA,gBAClB,QACA,eACA,QACc;CACd,MAAM,aAAa,UAAU,iBAAiB,OAAO,QAAQ;CAE7D,MAAM,MAAM,IAAI,IAAI;CACpB,MAAM,SAAS,gBAAgB,MAAM;CACrC,MAAM,eAAe,qBAAqB,MAAM;CAOhD,IAAI,IAAI,MAAM;EAAE,QAAQ;EAAM,OAAO;CAAK,CAAC,CAAC;CAQ5C,MAAM,QAAQ,iBAAiB,MAAM,oBAAoB,MAAM;CAE/D,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,WAAW,EAAE,QAAQ,KAAK;CAC9B,CAAC,CAAC;CAEF,IAAI,OACA,IAAI,IAAI,wBAAwB,yBAAyB,KAAK,CAAC;CAGnE,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,MAAM,kBAAkB,QAAQ,KAAK;GAC3C;EACJ,CAAC;CACL,CAAC,CAAC;CAEF,KAAK,MAAM,QAAQ,gBACf,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM,KAAK;EACX,IAAI,OAAO,UAAU;GACjB,MAAM,WAAW,MAAM,aAAa;GAEpC,OAAO,WAAW,OAAO,QAAQ;IAC7B,KAAK,KAAK;IACV,MAAM,sBAAsB,OAAO,UAAU,IAAI;IACjD;GACJ,CAAC;EACL;CACJ,CAAC,CAAC;CAMN,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,CAAC;GACP;EACJ,CAAC;CACL,CAAC,CAAC;CAEF,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM;IACF,UAAU,MAAM,aAAa;IAC7B,UAAU,mBAAmB,KAAK;IAClC,gBAAgB,yBAAyB,KAAK;IAC9C,OAAO,gBAAgB,KAAK;GAChC;GACA;EACJ,CAAC;CACL,CAAC,CAAC;CAOF,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,UAAU;EACV,IAAI,CAAC,QACD,MAAM,qBAAqB,QAAQ;EAIvC,IAAI,IAAI,aAAaC,cACjB,KAAK,MAAM,KAAK,UAAU,UAAU,QAAQ,GAC5C;GACI,aAAa;GACb,MAAM;GACN,aAAa;GACb,gBAAgB;EACpB,CACJ,CAAC;CACL;CAEA,OAAO;AACX;;;;;;;;;;;;;;;AChJA,SAAgBC,oBACZ,UAA4E,CAAC,GACjE;CACZ,OAAOC,kBAAiC;EACpC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,UAAU;EAC1B,gBAAgB,UAAU,UAAUC,gBAAc,UAAU,KAAK;CACrE,CAAC;AACL"}

package/dist/bin.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as createApplication } from "./application-YmicGt26.mjs";
+import { t as createApplication } from "./application-h8KbQSdz.mjs";
 import process from "node:process";
 //#region src/bin.ts
 /**

package/dist/constants.d.ts

@@ -20,7 +20,7 @@ export declare const BASE_PATH = "/console/auth";
  * The pages the service renders. Each is a route of the console bundle's
  * own router, and each is what a server-core page GET now redirects to.
  */
-export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
+export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout", "/device"];
 /**
  * Where this service mounts the bundle's `assets/` directory. The public
  * asset URL is the service's own public path plus this route, which is what

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE7F;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAG,OAAO,qBAAyB,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,KAAK,qGAOR,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,eAAO,MAAM,WAAW,aAAa,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,IAAI,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE7F;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAG,OAAO,qBAAyB,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,KAAK,gHAQR,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,eAAO,MAAM,WAAW,aAAa,CAAC"}

package/dist/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AASjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAWnC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBlD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,cAAc,EAC9B,MAAM,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CA+FhB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AASjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAcnC,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBlD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAC/B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,cAAc,EAC9B,MAAM,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CA8GhB"}

package/dist/index.d.mts

@@ -150,7 +150,7 @@ export declare const BASE_PATH = "/console/auth";
  * The pages the service renders. Each is a route of the console bundle's
  * own router, and each is what a server-core page GET now redirects to.
  */
-export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout"];
+export declare const PAGES: readonly ["/authorize", "/register", "/activate", "/password-forgot", "/password-reset", "/logout", "/device"];
 /**
  * Where this service mounts the bundle's `assets/` directory. The public
  * asset URL is the service's own public path plus this route, which is what
@@ -222,6 +222,48 @@ export type WorkflowPageOptions = {
  * guard on `redirect`.
  */
 export declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+/**
+ * The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`
+ * parameter: a space-separated list of BCP47 tags in preference order.
+ *
+ * It rides the authorization request, so it survives the page GET's hop and
+ * the rebuild a federated round-trip makes from the stored code request. The
+ * four workflow pages take it straight from their own query, since an RP
+ * linking to one can say the same thing there.
+ */
+export declare function readUILocalesHint(event: IAppEvent): string | undefined;
+/**
+ * The color mode the RP renders in, from authup's own `ui_color_mode`. One
+ * value rather than a list, since there is nothing to negotiate.
+ *
+ * Checked against the enum rather than local literals because the realm's
+ * discovery document ADVERTISES that same set as
+ * `ui_color_modes_supported`: a second spelling here would let the pages and
+ * the document disagree about what the deployment accepts.
+ */
+export declare function readUIColorModeHint(event: IAppEvent): string | undefined;
+/**
+ * The `user_code` the device page prefills (RFC 8628 section 3.3.1): the
+ * query value uppercased and stripped of everything outside `A-Z0-9`, or
+ * `undefined` when nothing bounded remains. The page renders it back, so what
+ * reaches the payload is at most 16 alphanumeric characters.
+ */
+export declare function readDeviceUserCode(event: IAppEvent): string | undefined;
+/**
+ * The provider a federated login on the device page came back from (#3589).
+ * A routing hint and no secret: the pending login itself rides an HttpOnly
+ * cookie. Anything that is not a uuid is dropped, the rule `/authorize`
+ * reads its own hint by: the page interpolates the value into the
+ * completion request path.
+ */
+export declare function readDeviceFederatedLogin(event: IAppEvent): {
+  providerId: string;
+} | undefined;
+/**
+ * The refusal marker the federated callback may attach. A closed set of one,
+ * so nothing request-derived is rendered.
+ */
+export declare function readDeviceError(event: IAppEvent): 'access_denied' | undefined;
 //#endregion
 //#region src/redirect.d.ts
 /**

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/application.ts","../src/config.ts","../src/constants.ts","../src/handler.ts","../src/payload.ts","../src/redirect.ts","../src/render.ts","../src/resolve.ts","../src/server.ts"],"mappings":";;;;;;;;;;;;;;;;YA2BY,cAAc,gBACtB;GAEK,YAAY,QAAQ;GAEpB,YAAY,OAAO,KAAK;IAE7B;;;;;;YAQQ;;;;;;EAMR;;;;;;;;EAQA;;;;;;;;;;;;;;;EAeA;;;;;EAKA;EACA;;;;;EAKA;EAEA,OAAO;;;;;;;YAQC,cACR,OAAO,WACP,QAAQ,QACR;EACI;EACA,MAAM;EACN,QAAQ;MAEX;;;;;;;;;;;;;;;wBC1EW,kBACZ,UAAS,QAAQ,KAAK,yBAAyB,6BAC/C;;;;;;;;;;;;;;;;qBCWS,mDAAa,uCAAA,gDAAA;;QAAb,KAAA;oCAcX;;;;;;;;;;;wBAYoB,cAClB,OAAO,QAAQ,eACf,QAAQ;;;;;;wBAmCU,qBAAsB,QAAQ;;;;;;;qBCzFvC,yBAA0B;;;;;;qBAO1B;;;;;;qBAOA;;;;;qBAMA;;;;;;qBAcA;qBAEA;;;;;;;;;;;;wBCIS,cAClB,QAAQ,QACR,gBAAgB,gBAChB,SAAS,aACT,QAAQ;;;;;;;;;;;;;;;wBC/BI,gBAAgB,QAAQ,SAAU;;;;;;;;;;;;;;;;;;;;wBAiDlC,qBAAqB,QAAQ,eAAgB,QAAQ;;;;;;wBAmC/C,kBAAkB,QAAQ,QAAQ,OAAO,YAAa,QAAQ;YAUxE;EAIR;EACA;;;;;;;;wBASY,sBACZ,OAAO,WACP,UAAU,wBACV,UAAS,sBACT;;;;;;;;;;;;;;;wBCvHY,yBAAyB;;;;;;;;;wBCYnB,qBAAqB,mBAAoB;wBAc/C,iBAAiB,oBAAqB;;;;;;;;;;;;;;;wBCrBtC,mBAAmB;;;;;;wBAYnB,gBAAgB;;;;;;;wBCrBV,aAAa,QAAQ,SAAU,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/application.ts","../src/config.ts","../src/constants.ts","../src/handler.ts","../src/payload.ts","../src/redirect.ts","../src/render.ts","../src/resolve.ts","../src/server.ts"],"mappings":";;;;;;;;;;;;;;;;YA2BY,cAAc,gBACtB;GAEK,YAAY,QAAQ;GAEpB,YAAY,OAAO,KAAK;IAE7B;;;;;;YAQQ;;;;;;EAMR;;;;;;;;EAQA;;;;;;;;;;;;;;;EAeA;;;;;EAKA;EACA;;;;;EAKA;EAEA,OAAO;;;;;;;YAQC,cACR,OAAO,WACP,QAAQ,QACR;EACI;EACA,MAAM;EACN,QAAQ;MAEX;;;;;;;;;;;;;;;wBC1EW,kBACZ,UAAS,QAAQ,KAAK,yBAAyB,6BAC/C;;;;;;;;;;;;;;;;qBCWS,mDAAa,uCAAA,gDAAA;;QAAb,KAAA;oCAcX;;;;;;;;;;;wBAYoB,cAClB,OAAO,QAAQ,eACf,QAAQ;;;;;;wBAmCU,qBAAsB,QAAQ;;;;;;;qBCzFvC,yBAA0B;;;;;;qBAO1B;;;;;;qBAOA;;;;;qBAMA;;;;;;qBAeA;qBAEA;;;;;;;;;;;;wBCMS,cAClB,QAAQ,QACR,gBAAgB,gBAChB,SAAS,aACT,QAAQ;;;;;;;;;;;;;;;wBChCI,gBAAgB,QAAQ,SAAU;;;;;;;;;;;;;;;;;;;;wBAiDlC,qBAAqB,QAAQ,eAAgB,QAAQ;;;;;;wBAmC/C,kBAAkB,QAAQ,QAAQ,OAAO,YAAa,QAAQ;YAUxE;EAIR;EACA;;;;;;;;wBASY,sBACZ,OAAO,WACP,UAAU,wBACV,UAAS,sBACT;;;;;;;;;;wBA6BY,kBAAkB,OAAO;;;;;;;;;;wBA0BzB,oBAAoB,OAAO;;;;;;;wBAe3B,mBAAmB,OAAO;;;;;;;;wBAqB1B,yBAAyB,OAAO;EAAe;;;;;;wBAY/C,gBAAgB,OAAO;;;;;;;;;;;;;;;wBChOvB,yBAAyB;;;;;;;;;wBCanB,qBAAqB,mBAAoB;wBAc/C,iBAAiB,oBAAqB;;;;;;;;;;;;;;;wBCtBtC,mBAAmB;;;;;;wBAYnB,gBAAgB;;;;;;;wBCrBV,aAAa,QAAQ,SAAU,QAAQ"}

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { _ as VITE_BASE, a as resolveDistPath, b as resolveConfig, c as createAPIClient, d as sanitizeRelativeRedirect, f as ASSETS_PATH, g as PAGES, h as HEALTH_PATH, i as createRenderPage, l as createFeaturesReader, m as CONTRACT_VERSION, n as createHandler, o as resolvePackagePath, p as BASE_PATH, r as assertRenderContract, s as buildWorkflowPageData, t as createApplication, u as readAuthorizeInfo, v as CONFIG_SCHEMA, y as readConfigFromEnv } from "./application-YmicGt26.mjs";
+import { C as CONFIG_SCHEMA, S as VITE_BASE, T as resolveConfig, _ as ASSETS_PATH, a as resolveDistPath, b as HEALTH_PATH, c as createAPIClient, d as readDeviceError, f as readDeviceFederatedLogin, g as sanitizeRelativeRedirect, h as readUILocalesHint, i as createRenderPage, l as createFeaturesReader, m as readUIColorModeHint, n as createHandler, o as resolvePackagePath, p as readDeviceUserCode, r as assertRenderContract, s as buildWorkflowPageData, t as createApplication, u as readAuthorizeInfo, v as BASE_PATH, w as readConfigFromEnv, x as PAGES, y as CONTRACT_VERSION } from "./application-h8KbQSdz.mjs";
 import { App } from "routup";
 //#region src/server.ts
 /**
@@ -11,6 +11,6 @@ async function createServer(config) {
 	return app;
 }
 //#endregion
-export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, CONTRACT_VERSION, HEALTH_PATH, PAGES, VITE_BASE, assertRenderContract, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createRenderPage, createServer, readAuthorizeInfo, readConfigFromEnv, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect };
+export { ASSETS_PATH, BASE_PATH, CONFIG_SCHEMA, CONTRACT_VERSION, HEALTH_PATH, PAGES, VITE_BASE, assertRenderContract, buildWorkflowPageData, createAPIClient, createApplication, createFeaturesReader, createHandler, createRenderPage, createServer, readAuthorizeInfo, readConfigFromEnv, readDeviceError, readDeviceFederatedLogin, readDeviceUserCode, readUIColorModeHint, readUILocalesHint, resolveConfig, resolveDistPath, resolvePackagePath, sanitizeRelativeRedirect };
 
 //# sourceMappingURL=index.mjs.map

package/dist/payload.d.ts

@@ -52,4 +52,46 @@ export type WorkflowPageOptions = {
  * guard on `redirect`.
  */
 export declare function buildWorkflowPageData(event: IAppEvent, features: StatusResponseFeatures, options?: WorkflowPageOptions): Record<string, any>;
+/**
+ * The RP's own UI language, from the OIDC Core section 3.1.2.1 `ui_locales`
+ * parameter: a space-separated list of BCP47 tags in preference order.
+ *
+ * It rides the authorization request, so it survives the page GET's hop and
+ * the rebuild a federated round-trip makes from the stored code request. The
+ * four workflow pages take it straight from their own query, since an RP
+ * linking to one can say the same thing there.
+ */
+export declare function readUILocalesHint(event: IAppEvent): string | undefined;
+/**
+ * The color mode the RP renders in, from authup's own `ui_color_mode`. One
+ * value rather than a list, since there is nothing to negotiate.
+ *
+ * Checked against the enum rather than local literals because the realm's
+ * discovery document ADVERTISES that same set as
+ * `ui_color_modes_supported`: a second spelling here would let the pages and
+ * the document disagree about what the deployment accepts.
+ */
+export declare function readUIColorModeHint(event: IAppEvent): string | undefined;
+/**
+ * The `user_code` the device page prefills (RFC 8628 section 3.3.1): the
+ * query value uppercased and stripped of everything outside `A-Z0-9`, or
+ * `undefined` when nothing bounded remains. The page renders it back, so what
+ * reaches the payload is at most 16 alphanumeric characters.
+ */
+export declare function readDeviceUserCode(event: IAppEvent): string | undefined;
+/**
+ * The provider a federated login on the device page came back from (#3589).
+ * A routing hint and no secret: the pending login itself rides an HttpOnly
+ * cookie. Anything that is not a uuid is dropped, the rule `/authorize`
+ * reads its own hint by: the page interpolates the value into the
+ * completion request path.
+ */
+export declare function readDeviceFederatedLogin(event: IAppEvent): {
+    providerId: string;
+} | undefined;
+/**
+ * The refusal marker the federated callback may attach. A closed set of one,
+ * so nothing request-derived is rendered.
+ */
+export declare function readDeviceError(event: IAppEvent): 'access_denied' | undefined;
 //# sourceMappingURL=payload.d.ts.map

package/dist/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../src/payload.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAkB,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,CAEvD;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,OAAO,CAAC,sBAAsB,CAAC,CA4B3F;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,aAAa,CAAC,CAQjG;AAED,MAAM,MAAM,mBAAmB,GAAG;IAI9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,sBAAsB,EAChC,OAAO,GAAE,mBAAwB,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkBtB"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../src/payload.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAkB,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAI/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,CAEvD;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAI,MAAM,OAAO,CAAC,sBAAsB,CAAC,CA4B3F;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,aAAa,CAAC,CAQjG;AAED,MAAM,MAAM,mBAAmB,GAAG;IAI9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,sBAAsB,EAChC,OAAO,GAAE,mBAAwB,GACjC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkBtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAI,MAAM,GAAG,SAAS,CAevE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAI,MAAM,GAAG,SAAS,CAOzE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,MAAM,GAAG,SAAS,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAI;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAM9F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAI,eAAe,GAAG,SAAS,CAE9E"}

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAY3E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,UAAU,CAgF/D"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,IAAI,CAAC,CAY3E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAI,UAAU,CAoG/D"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/server-auth-console",
     "type": "module",
-    "version": "1.0.0-beta.65",
+    "version": "1.0.0-beta.67",
     "description": "The SSR service behind authup's hosted auth pages: it renders the auth console bundle and hydrates it anonymously over HTTP.",
     "license": "AGPL-3.0-only",
     "bin": {
@@ -51,23 +51,24 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/client-auth-console": "^1.0.0-beta.65",
-        "@authup/core-http-kit": "^1.0.0-beta.65",
-        "@authup/errors": "^1.0.0-beta.65",
-        "@authup/kit": "^1.0.0-beta.65",
-        "@authup/server-config": "^1.0.0-beta.65",
-        "@authup/server-config-kit": "^1.0.0-beta.65",
-        "@authup/server-console-kit": "^1.0.0-beta.65",
+        "@authup/client-auth-console": "^1.0.0-beta.67",
+        "@authup/core-http-kit": "^1.0.0-beta.67",
+        "@authup/errors": "^1.0.0-beta.67",
+        "@authup/kit": "^1.0.0-beta.67",
+        "@authup/server-config": "^1.0.0-beta.67",
+        "@authup/server-config-kit": "^1.0.0-beta.67",
+        "@authup/server-console-kit": "^1.0.0-beta.67",
+        "@authup/specs": "^1.0.0-beta.67",
         "@routup/assets": "^5.0.0",
         "@routup/basic": "^3.0.0",
         "locter": "^4.1.1",
         "orkos": "^1.1.1",
         "routup": "^6.1.0",
         "validup": "^2.0.1",
-        "zod": "^4.5.4"
+        "zod": "^4.6.5"
     },
     "devDependencies": {
-        "@types/node": "^26.4.1",
+        "@types/node": "^26.6.1",
         "cross-env": "^10.1.0",
         "vitest": "^4.0.18"
     },

package/dist/application-YmicGt26.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"application-YmicGt26.mjs","names":["createHandler","createAssetsHandler","createApplication","createConsoleApplication","createHandler"],"sources":["../src/config.ts","../src/constants.ts","../src/redirect.ts","../src/payload.ts","../src/path.ts","../src/resolve.ts","../src/render.ts","../src/handler.ts","../src/application.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AUTH_CONSOLE_SCHEMA,\n    CORE_SCHEMA,\n    ROOT_SCHEMA,\n    SECTION_KEY,\n    THEME_SCHEMA,\n} from '@authup/server-config';\nimport {\n    buildSchemaDefaults,\n    defineSchema,\n    mergeSchemaData,\n    mountSchema,\n    readSchemaFromEnv,\n    resolveSchemaData,\n} from '@authup/server-config-kit';\nimport { Container } from 'validup';\nimport type { CoreConfig, EnvironmentVariable } from '@authup/server-config';\nimport type { Config, ConfigInput } from './types';\n\n/**\n * The keys this service reads, SELECTED out of the document schema by name.\n *\n * Nothing is declared here: every key of `authup.yml` is declared once in\n * `@authup/server-config`, so this service cannot spell a path, an\n * environment variable, a default or a reader differently from server-core,\n * which reads several of the same keys. Neither package depends on the other;\n * both depend on the declaration.\n *\n * Its own section is spread, so this service reads it in its own vocabulary\n * (`url`, `port`, `host`); every other section stays under the key the\n * document nests it at.\n */\nexport const CONFIG_SCHEMA = defineSchema<ConfigInput, 'publicUrl' | 'internalUrl' | 'db'>({\n    ...AUTH_CONSOLE_SCHEMA,\n    ...ROOT_SCHEMA,\n    [SECTION_KEY.THEME]: THEME_SCHEMA,\n    // Two keys of core, never the section. `publicUrl` derives from\n    // the core listener address, which is what a console needs; selecting the\n    // whole section also selects its INVARIANTS, and `resolveSchemaData` runs\n    // every resolver in a registry -- so a console would refuse to start on a\n    // short SECRETS_ENCRYPTION_KEY, or on mfaRequired without mfaEnabled, for\n    // keys it has no database, key store or MFA to use.\n    [SECTION_KEY.CORE]: defineSchema<Pick<CoreConfig, 'host' | 'port'>, never, EnvironmentVariable>({\n        host: CORE_SCHEMA.host,\n        port: CORE_SCHEMA.port,\n    }),\n});\n\n/**\n * Turn the configuration namespace into the service's own shape: validate the\n * input against the declared zod types, fill the defaults, derive the one key\n * that is derived rather than configured, and rename. An empty `url` means the console sits on server-core's own origin\n * under the default segment, which is the single-origin deployment.\n *\n * The defaults are layered SECTION-AWARE ({@link mergeSchemaData}): a spread\n * would let an input carrying one key of a section replace the whole section\n * and take every other key's default with it.\n */\nexport async function resolveConfig(\n    input: Partial<ConfigInput>,\n) : Promise<Config> {\n    const validator = new Container<ConfigInput>();\n    mountSchema(validator, CONFIG_SCHEMA);\n\n    const parsed = await validator.run(input);\n\n    const values = resolveSchemaData<ConfigInput>(\n        CONFIG_SCHEMA,\n        mergeSchemaData<ConfigInput>(\n            CONFIG_SCHEMA,\n            buildSchemaDefaults<ConfigInput>(CONFIG_SCHEMA),\n            parsed,\n        ),\n    ) as ConfigInput;\n\n    return {\n        url: values.url,\n        apiUrl: values.publicUrl,\n        // `internalUrl` falls back to `publicUrl`, so an operator who has one\n        // address for both sides configures nothing. The composed `authup\n        // start` overrides this with its own listen address unless the\n        // document named one.\n        apiInternalUrl: values.internalUrl,\n        port: values.port,\n        host: values.host,\n        distPath: values.path,\n        theme: values.theme,\n    };\n}\n\n/**\n * The standalone entry's configuration, read from the environment alone.\n * `authup.yml` reaches this service through the CLI roles, which compose this\n * very registry into the one document loader.\n */\nexport async function readConfigFromEnv() : Promise<Config> {\n    // The explicit type argument is load-bearing: inferred from the schema\n    // object, a key declared without a default (the derived publicUrl) comes\n    // back as unknown.\n    const input : Partial<ConfigInput> = readSchemaFromEnv<ConfigInput>(CONFIG_SCHEMA);\n\n    return resolveConfig(input);\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { CONTRACT_VERSION as BundleContractVersion } from '@authup/client-auth-console';\n\n/**\n * The render contract this service compiles against. The literal type fails\n * the build the moment the bundle's constant moves without this one.\n */\nexport const CONTRACT_VERSION : typeof BundleContractVersion = 3;\n\n/**\n * The vite base the auth console bundle is built with. Asset hrefs in the\n * shell are emitted against it, so the service mounts its assets there and\n * rebases them only when the deployment carries a sub-path.\n */\nexport const VITE_BASE = '/console/auth/';\n\n/**\n * The path the service is served under by default, i.e. the path component\n * of `authConsole.url`. It is the same segment server-core mounted\n * the assets at before the split, so a built bundle needs no rebuild.\n */\nexport const BASE_PATH = '/console/auth';\n\n/**\n * The pages the service renders. Each is a route of the console bundle's\n * own router, and each is what a server-core page GET now redirects to.\n */\nexport const PAGES = [\n    '/authorize',\n    '/register',\n    '/activate',\n    '/password-forgot',\n    '/password-reset',\n    '/logout',\n] as const;\n\n/**\n * Where this service mounts the bundle's `assets/` directory. The public\n * asset URL is the service's own public path plus this route, which is what\n * the bundle's fixed vite base is rebased onto.\n */\nexport const ASSETS_PATH = '/assets';\n\nexport const HEALTH_PATH = '/healthy';\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { AuthorizeInfo, StatusResponse, StatusResponseFeatures } from '@authup/core-http-kit';\nimport { Client } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from './redirect';\nimport type { Config } from './types';\n\n/**\n * The service hydrates ANONYMOUSLY. It holds no credential of its own and\n * asks server-core only for what an unauthenticated visitor may see, which\n * is the whole of what these pages render.\n *\n * It dispatches against `apiInternalUrl`, never the browser-facing `apiUrl`:\n * this is a server-side call, so it must not depend on the public address\n * resolving from inside the deployment. Unlike server-core's own internal\n * client the swap is on `baseURL` rather than at the transport layer,\n * because nothing derived from it reaches a caller -- there is no\n * `redirect_uri` here to be compared byte for byte later.\n */\nexport function createAPIClient(config: Config) : Client {\n    return new Client({ baseURL: config.apiInternalUrl });\n}\n\n/**\n * Report an outbound failure to the operator and raise one the visitor may\n * see, which is deliberately not the same error.\n *\n * hapic embeds the resolved request URL in its message, and this service has\n * no error middleware: routup answers with `event.error.message` verbatim, on\n * the public login page. That URL is `apiInternalUrl`, which on a split\n * deployment names a service on the operator's own network, so an API that is\n * merely down would publish its internal address to every anonymous visitor.\n * It was harmless while the value was `publicUrl`, an address the browser\n * already had.\n *\n * The rule and the remedy are server-core's own (`sanitizeError` /\n * `describeError`): the caller gets a message it can act on, the detail goes\n * to the log. `console.error` rather than a logger because a console handler\n * is built from a config alone and is given none -- and because this line is\n * the only trace such a failure leaves, which is how #3550 was diagnosed in\n * the first place.\n */\nfunction failWithoutAddress(error: unknown) : never {\n    // eslint-disable-next-line no-console\n    console.error('[authup] the auth console could not reach the API:', error);\n\n    throw new Error('The identity provider could not be reached.');\n}\n\n/**\n * The feature flags every workflow page gates its form on. A page that\n * cannot reach them must not silently claim a workflow is disabled, so the\n * failure propagates rather than defaulting to false.\n *\n * Read ONCE and held for the reader's lifetime, the same shape render.ts\n * keeps for the dist template, manifest and render entry: `GET /` reports\n * the version and the boot-config feature flags, none of which changes\n * without a restart, so a TTL would be a number with nothing behind it.\n * Without it every workflow page render is an API call, and under the\n * composed `authup start` those all arrive over loopback on one shared\n * rate-limit key. Only a SUCCESS is held, so an API that was down at the\n * first render is retried rather than remembered as broken.\n *\n * The cache is instance-scoped rather than module-scoped (098 C4): the\n * answer depends on which API the client was built against, so two handlers\n * in one process must not share one, and a module slot would additionally\n * leak between test cases.\n */\nexport function createFeaturesReader(client: Client) : () => Promise<StatusResponseFeatures> {\n    let cached : StatusResponseFeatures | undefined;\n    let pending : Promise<StatusResponseFeatures> | undefined;\n\n    return () => {\n        if (cached) {\n            return Promise.resolve(cached);\n        }\n\n        if (pending) {\n            return pending;\n        }\n\n        pending = client.status.get()\n            .then((status: StatusResponse) => {\n                cached = status.features;\n\n                return cached;\n            })\n            .catch((e) => failWithoutAddress(e));\n\n        const clear = () => {\n            pending = undefined;\n        };\n        pending.then(clear, clear);\n\n        return pending;\n    };\n}\n\n/**\n * The `/authorize` render input, resolved by server-core (plan 101 D2-1).\n * The browser's query is forwarded verbatim: the answer is derived from all\n * of it, the `provider` hint and the closed `error` marker set included.\n */\nexport async function readAuthorizeInfo(client: Client, event: IAppEvent) : Promise<AuthorizeInfo> {\n    const { search } = new URL(event.request.url);\n\n    try {\n        return await client.authorize.getInfo(search);\n    } catch (e) {\n        return failWithoutAddress(e);\n    }\n}\n\nexport type WorkflowPageOptions = {\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * The payload the four workflow pages render from: the feature flags plus\n * the handful of query params each one declares. Unchanged from the\n * assembly server-core did before the split, including the open-redirect\n * guard on `redirect`.\n */\nexport function buildWorkflowPageData(\n    event: IAppEvent,\n    features: StatusResponseFeatures,\n    options: WorkflowPageOptions = {},\n) : Record<string, any> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return data;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const CODE_PATH = path.dirname(fileURLToPath(import.meta.url));\nexport const PACKAGE_PATH = path.join(CODE_PATH, '..');\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from './path';\n\n/**\n * Locate the auth console package: a substituted one (config `distPath`)\n * first, else the SSR auth workflow UI shipped as\n * `@authup/client-auth-console` (a dependency of THIS service), which the\n * node_modules ancestor walk from this package's own root (locter's\n * `locateUp`) finds for the workspace (symlink onto\n * apps/client-auth-console) and for a published install alike.\n *\n * The `cwd` anchor is behavioural, not incidental: it decides which\n * node_modules tree is walked, so it stays pinned to this package rather\n * than to the process cwd.\n */\nexport function resolvePackagePath(distPath?: string) : string | undefined {\n    return distPath || locateUpSync(\n        'node_modules/@authup/client-auth-console/package.json',\n        { cwd: PACKAGE_PATH },\n    )?.directory;\n}\n\n/**\n * Locate the BUILT auth console bundle (`dist/client` template + assets,\n * `dist/server/server.js` render entry). A half-built package is no bundle:\n * without the render entry there is nothing to render with.\n */\nexport function resolveDistPath(distPath?: string) : string | undefined {\n    const packagePath = resolvePackagePath(distPath);\n    if (!packagePath) {\n        return undefined;\n    }\n\n    const candidate = path.join(packagePath, 'dist');\n    if (\n        fs.existsSync(path.join(candidate, 'client', 'index.html')) &&\n        fs.existsSync(path.join(candidate, 'server', 'server.js'))\n    ) {\n        return candidate;\n    }\n\n    return undefined;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { HydrationPayload, RenderFunction } from '@authup/client-auth-console';\nimport { InternalError } from '@authup/errors';\nimport { getURLBasePath } from '@authup/kit';\nimport {\n    applyTheme,\n    applyUIPageHeaders,\n    readUIClientPreferences,\n    rebaseAssetURLs,\n    replaceTemplateMarker,\n    stampHtmlAttributes,\n} from '@authup/server-console-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { CONTRACT_VERSION, VITE_BASE } from './constants';\nimport { resolveDistPath } from './resolve';\nimport type { RenderPage } from './types';\n\n/**\n * Refuse a bundle built against another render contract at boot, naming the\n * entry and both versions, instead of failing per request on `/authorize`.\n * A bundle predating the export is version 1. Reads the module itself, which\n * Node's ESM cache then hands the render for free.\n */\nexport async function assertRenderContract(distPath: string) : Promise<void> {\n    const entry = path.join(distPath, 'server', 'server.js');\n    const bundle = await read(entry) as Record<string, any>;\n    const version = bundle.CONTRACT_VERSION ?? 1;\n\n    if (version !== CONTRACT_VERSION) {\n        throw new InternalError(\n            `The auth console bundle \"${entry}\" implements render-contract version ${version}, ` +\n            `but this service requires ${CONTRACT_VERSION}. ` +\n            'Rebuild it against the current @authup/client-auth-console contract.',\n        );\n    }\n}\n\nexport function createRenderPage(distPath?: string) : RenderPage {\n    // Per-handler caches for the immutable production SSR assets: the dist\n    // template, manifest and server bundle do not change after boot, so read\n    // them once instead of per request (the auth/login routes are hot paths).\n    // Held in this closure rather than at module scope so a second handler in\n    // the process, with a substituted package, never renders another's\n    // template. Only a resolved dist is kept, so a bundle built after boot is\n    // picked up on the next request.\n    let cachedDistPath: string | undefined;\n    let cachedHtml: string | undefined;\n    let cachedManifest: Record<string, any> | undefined;\n    let cachedRender: RenderFunction | undefined;\n\n    return async (event, config, ctx) => {\n        const resolved = (cachedDistPath ??= resolveDistPath(distPath));\n        if (!resolved) {\n            throw new InternalError(\n                'The auth console bundle (@authup/client-auth-console) is not built or installed.',\n            );\n        }\n\n        const html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(resolved, 'client', 'index.html'),\n            'utf-8',\n        ));\n        const manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(resolved, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        const render = (cachedRender ??= (await read(\n            path.join(resolved, 'server', 'server.js'),\n        )).render as RenderFunction);\n\n        // The client app hydrates locale + color-mode from the payload, so it\n        // adopts the same values the HTML shell is stamped with below.\n        const preferences = readUIClientPreferences(event);\n\n        // `baseURL` is server-core's public URL: the console derives its HTTP\n        // client and its cookie path from it. `basePath` is where THIS service\n        // is served, which is what the router and every inter-page href need.\n        // Before the split the two were the same value; they are not any more,\n        // so the console reads them separately.\n        const basePath = getURLBasePath(config.url);\n\n        const payload : HydrationPayload = {\n            config: {\n                baseURL: config.apiUrl,\n                basePath,\n                colorMode: preferences.colorMode,\n                locale: preferences.locale,\n            },\n            data: ctx.data,\n        };\n\n        const [appHtml, preloadLinks] = await render({\n            url: ctx.url,\n            manifest,\n            payload,\n        });\n\n        let body = replaceTemplateMarker(html, '<!--preload-links-->', preloadLinks);\n        body = replaceTemplateMarker(body, '<!--app-html-->', appHtml);\n\n        body = stampHtmlAttributes(body, preferences);\n\n        // This service mounts the bundle's assets at its own /assets, so the\n        // fixed vite base in every href is replaced by this service's public\n        // path. The vite base was decided when the bundle was built and says\n        // nothing about where the service is published.\n        body = rebaseAssetURLs(body, VITE_BASE, `${basePath}/`);\n\n        // The theme's own asset urls are built from the same base, and the\n        // service mounts them under it, so a themed deployment needs no rule of\n        // its own at the reverse proxy beyond the one that reaches this service.\n        body = await applyTheme(body, ctx.theme, basePath);\n\n        applyUIPageHeaders(event);\n\n        return body;\n    };\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IThemeProvider } from '@authup/server-console-kit';\nimport {\n    THEME_ASSET_MOUNT_PATH,\n    createThemeAssetsHandler,\n    createThemeProvider,\n} from '@authup/server-console-kit';\nimport { createHandler as createAssetsHandler } from '@routup/assets';\nimport { basic } from '@routup/basic';\nimport path from 'node:path';\nimport type { IApp } from 'routup';\nimport { App, defineCoreHandler } from 'routup';\nimport { ASSETS_PATH, HEALTH_PATH } from './constants';\nimport {\n    buildWorkflowPageData,\n    createAPIClient,\n    createFeaturesReader,\n    readAuthorizeInfo,\n} from './payload';\nimport { assertRenderContract, createRenderPage } from './render';\nimport { resolveDistPath } from './resolve';\nimport type { Config, RenderPage } from './types';\n\nconst WORKFLOW_PAGES : {\n    url: string,\n    realmAware?: boolean,\n    tokenAware?: boolean\n}[] = [\n    { url: '/register', realmAware: true },\n    { url: '/activate', tokenAware: true },\n    { url: '/password-forgot', realmAware: true },\n    {\n        url: '/password-reset',\n        realmAware: true,\n        tokenAware: true,\n    },\n];\n\n/**\n * The service as a mountable routup handler, so the CLI can compose it onto\n * server-core's own listener for the single-container deployment while a\n * split deployment runs it behind its own server.\n *\n * The paths are prefix-free. authup assumes a prefix-stripping reverse\n * proxy, so a service published at `<origin>/console/auth` receives\n * `/authorize`, exactly as server-core received it before the split.\n */\nexport async function createHandler(\n    config: Config,\n    themeProvider?: IThemeProvider,\n    render?: RenderPage,\n) : Promise<IApp> {\n    const renderPage = render ?? createRenderPage(config.distPath);\n\n    const app = new App();\n    const client = createAPIClient(config);\n    const readFeatures = createFeaturesReader(client);\n\n    // The shell is stamped from the vc-locale / vc-color-mode cookies, and\n    // without the plugin every cookie read answers undefined, which is a\n    // silent flash of the wrong color mode on every full load. server-core\n    // registers it globally, so a mounted handler inherits one; a standalone\n    // service has nothing above it.\n    app.use(basic({ cookie: true, query: true }));\n\n    // A missing directory disables theming entirely: no provider is created\n    // and the rendered pages are byte-identical to the un-themed ones, so the\n    // default configuration pays nothing. An invalid manifest throws here and\n    // fails the boot rather than surfacing per request.\n    // Injected by the theme module when this runs inside the console\n    // application; built here for a caller holding only a config.\n    const theme = themeProvider ?? await createThemeProvider(config);\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: HEALTH_PATH,\n        fn: () => ({ status: 'ok' }),\n    }));\n\n    if (theme) {\n        app.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(theme));\n    }\n\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/authorize',\n        fn: async (event) => renderPage(event, config, {\n            url: '/authorize',\n            data: await readAuthorizeInfo(client, event),\n            theme,\n        }),\n    }));\n\n    for (const page of WORKFLOW_PAGES) {\n        app.use(defineCoreHandler({\n            method: 'get',\n            path: page.url,\n            fn: async (event) => {\n                const features = await readFeatures();\n\n                return renderPage(event, config, {\n                    url: page.url,\n                    data: buildWorkflowPageData(event, features, page),\n                    theme,\n                });\n            },\n        }));\n    }\n\n    // The logout page needs nothing resolved up front: it drives the\n    // end-session call itself and renders from the answer, so the render\n    // stays a pure shell and no request reaches server-core here.\n    app.use(defineCoreHandler({\n        method: 'get',\n        path: '/logout',\n        fn: async (event) => renderPage(event, config, {\n            url: '/logout',\n            data: {},\n            theme,\n        }),\n    }));\n\n    // Only the assets directory is mounted, never dist/client itself: the\n    // template and the ssr manifest are inputs of the render, not files to\n    // serve. A missing bundle only disables the mount; the page routes\n    // report the actionable error. A resolved one is checked against the\n    // render contract here, unless a substituted render never reads it.\n    const distPath = resolveDistPath(config.distPath);\n    if (distPath) {\n        if (!render) {\n            await assertRenderContract(distPath);\n        }\n\n        // Every name carries a content hash, so a new build means new names.\n        app.use(ASSETS_PATH, createAssetsHandler(\n            path.posix.join(distPath, 'client', 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n                cacheMaxAge: 60 * 60 * 24 * 365,\n                cacheImmutable: true,\n            },\n        ));\n    }\n\n    return app;\n}\n","/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { createApplication as createConsoleApplication } from '@authup/server-console-kit';\nimport type { CreateApplicationContext } from '@authup/server-console-kit';\nimport type { Application } from 'orkos';\nimport { readConfigFromEnv } from './config';\nimport { createHandler } from './handler';\nimport type { Config } from './types';\n\n/**\n * This console as a runnable service: its own module graph, its own\n * container, its own lifecycle, and nothing of server-core's. It is what\n * `authup start console` starts, what the `authup-auth-console` bin starts, and what\n * `authup start` composes onto its own listener, so no caller reaches past\n * the graph for a bare handler.\n *\n * `config` defaults to a FACTORY, not a value: resolving it reads the\n * document, and a console started alongside others must not do that at\n * construction time, before the caller has said where to look. Pass\n * `listen: false` to be mounted on someone else's listener.\n */\nexport function createApplication(\n    context: Partial<Omit<CreateApplicationContext<Config>, 'createHandler'>> = {},\n) : Application {\n    return createConsoleApplication<Config>({\n        listen: context.listen,\n        config: context.config ?? readConfigFromEnv,\n        createHandler: (resolved, theme) => createHandler(resolved, theme),\n    });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,MAAa,gBAAgB,aAA8D;CACvF,GAAG;CACH,GAAG;EACF,YAAY,QAAQ;EAOpB,YAAY,OAAO,aAA4E;EAC5F,MAAM,YAAY;EAClB,MAAM,YAAY;CACtB,CAAC;AACL,CAAC;;;;;;;;;;;AAYD,eAAsB,cAClB,OACgB;CAChB,MAAM,YAAY,IAAI,UAAuB;CAC7C,YAAY,WAAW,aAAa;CAEpC,MAAM,SAAS,MAAM,UAAU,IAAI,KAAK;CAExC,MAAM,SAAS,kBACX,eACA,gBACI,eACA,oBAAiC,aAAa,GAC9C,MACJ,CACJ;CAEA,OAAO;EACH,KAAK,OAAO;EACZ,QAAQ,OAAO;EAKf,gBAAgB,OAAO;EACvB,MAAM,OAAO;EACb,MAAM,OAAO;EACb,UAAU,OAAO;EACjB,OAAO,OAAO;CAClB;AACJ;;;;;;AAOA,eAAsB,oBAAsC;CAMxD,OAAO,cAF8B,kBAA+B,aAE3C,CAAC;AAC9B;;;;;;;AChGA,MAAa,mBAAkD;;;;;;AAO/D,MAAa,YAAY;;;;;;AAOzB,MAAa,YAAY;;;;;AAMzB,MAAa,QAAQ;CACjB;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;AAOA,MAAa,cAAc;AAE3B,MAAa,cAAc;;;;;;;;;;;;;;;AC9B3B,SAAgB,yBAAyB,OAAoC;CACzE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAC9C;CAMJ,IAAI,wBAAwB,KAAK,KAAK,GAClC;CAGJ,IAAI;CACJ,IAAI;EACA,UAAU,mBAAmB,KAAK;CACtC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwB,KAAK,OAAO,GACpC;CAGJ,KAAK,MAAM,aAAa,CAAC,OAAO,OAAO,GAAG;EACtC,IAAI,CAAC,UAAU,WAAW,GAAG,GACzB;EAEJ,IAAI,UAAU,SAAS,MAAM,UAAU,OAAO,OAAO,UAAU,OAAO,OAClE;EAEJ,IAAI,UAAU,SAAS,IAAI,GACvB;CAER;CAEA,OAAO;AACX;;;;;;;;;;;;;;;ACjCA,SAAgB,gBAAgB,QAAyB;CACrD,OAAO,IAAI,OAAO,EAAE,SAAS,OAAO,eAAe,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,mBAAmB,OAAwB;CAEhD,QAAQ,MAAM,sDAAsD,KAAK;CAEzE,MAAM,IAAI,MAAM,6CAA6C;AACjE;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,qBAAqB,QAAwD;CACzF,IAAI;CACJ,IAAI;CAEJ,aAAa;EACT,IAAI,QACA,OAAO,QAAQ,QAAQ,MAAM;EAGjC,IAAI,SACA,OAAO;EAGX,UAAU,OAAO,OAAO,IAAI,CAAC,CACxB,MAAM,WAA2B;GAC9B,SAAS,OAAO;GAEhB,OAAO;EACX,CAAC,CAAC,CACD,OAAO,MAAM,mBAAmB,CAAC,CAAC;EAEvC,MAAM,cAAc;GAChB,UAAU,KAAA;EACd;EACA,QAAQ,KAAK,OAAO,KAAK;EAEzB,OAAO;CACX;AACJ;;;;;;AAOA,eAAsB,kBAAkB,QAAgB,OAA2C;CAC/F,MAAM,EAAE,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;CAE5C,IAAI;EACA,OAAO,MAAM,OAAO,UAAU,QAAQ,MAAM;CAChD,SAAS,GAAG;EACR,OAAO,mBAAmB,CAAC;CAC/B;AACJ;;;;;;;AAgBA,SAAgB,sBACZ,OACA,UACA,UAA+B,CAAC,GACZ;CACpB,MAAM,QAAQ,gBAAgB,KAAK;CAEnC,MAAM,OAA4B;EAC9B;EACA,UAAU,yBAAyB,MAAM,QAAQ;CACrD;CAEA,IAAI,QAAQ,YAAY;EACpB,MAAM,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,MAAM;EAC1E,KAAK,UAAU,OAAO,YAAY,WAAW,UAAU,KAAA;CAC3D;CAEA,IAAI,QAAQ,YACR,KAAK,QAAQ,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ,KAAA;CAGjE,OAAO;AACX;;;AClJA,MAAa,YAAY,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AACpE,MAAa,eAAe,KAAK,KAAK,WAAW,IAAI;;;;;;;;;;;;;;;ACarD,SAAgB,mBAAmB,UAAwC;CACvE,OAAO,YAAY,aACf,yDACA,EAAE,KAAK,aAAa,CACxB,CAAC,EAAE;AACP;;;;;;AAOA,SAAgB,gBAAgB,UAAwC;CACpE,MAAM,cAAc,mBAAmB,QAAQ;CAC/C,IAAI,CAAC,aACD;CAGJ,MAAM,YAAY,KAAK,KAAK,aAAa,MAAM;CAC/C,IACI,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,YAAY,CAAC,KAC1D,GAAG,WAAW,KAAK,KAAK,WAAW,UAAU,WAAW,CAAC,GAEzD,OAAO;AAIf;;;;;;;;;ACpBA,eAAsB,qBAAqB,UAAkC;CACzE,MAAM,QAAQ,KAAK,KAAK,UAAU,UAAU,WAAW;CAEvD,MAAM,WAAU,MADK,KAAK,KAAK,EAAA,CACR,oBAAoB;CAE3C,IAAI,YAAA,GACA,MAAM,IAAI,cACN,4BAA4B,MAAM,uCAAuC,QAAQ,oGAGrF;AAER;AAEA,SAAgB,iBAAiB,UAAgC;CAQ7D,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,OAAO,OAAO,OAAO,QAAQ,QAAQ;EACjC,MAAM,WAAY,mBAAmB,gBAAgB,QAAQ;EAC7D,IAAI,CAAC,UACD,MAAM,IAAI,cACN,kFACJ;EAGJ,MAAM,OAAQ,eAAe,MAAM,GAAG,SAAS,SAC3C,KAAK,KAAK,UAAU,UAAU,YAAY,GAC1C,OACJ;EACA,MAAM,WAAY,mBAAmB,KAAK,MAAM,MAAM,GAAG,SAAS,SAC9D,KAAK,KAAK,UAAU,UAAU,SAAS,mBAAmB,GAC1D,OACJ,CAAC;EACD,MAAM,SAAU,kBAAkB,MAAM,KACpC,KAAK,KAAK,UAAU,UAAU,WAAW,CAC7C,EAAA,CAAG;EAIH,MAAM,cAAc,wBAAwB,KAAK;EAOjD,MAAM,WAAW,eAAe,OAAO,GAAG;EAE1C,MAAM,UAA6B;GAC/B,QAAQ;IACJ,SAAS,OAAO;IAChB;IACA,WAAW,YAAY;IACvB,QAAQ,YAAY;GACxB;GACA,MAAM,IAAI;EACd;EAEA,MAAM,CAAC,SAAS,gBAAgB,MAAM,OAAO;GACzC,KAAK,IAAI;GACT;GACA;EACJ,CAAC;EAED,IAAI,OAAO,sBAAsB,MAAM,wBAAwB,YAAY;EAC3E,OAAO,sBAAsB,MAAM,mBAAmB,OAAO;EAE7D,OAAO,oBAAoB,MAAM,WAAW;EAM5C,OAAO,gBAAgB,MAAM,WAAW,GAAG,SAAS,EAAE;EAKtD,OAAO,MAAM,WAAW,MAAM,IAAI,OAAO,QAAQ;EAEjD,mBAAmB,KAAK;EAExB,OAAO;CACX;AACJ;;;AChGA,MAAM,iBAIA;CACF;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAa,YAAY;CAAK;CACrC;EAAE,KAAK;EAAoB,YAAY;CAAK;CAC5C;EACI,KAAK;EACL,YAAY;EACZ,YAAY;CAChB;AACJ;;;;;;;;;;AAWA,eAAsBA,gBAClB,QACA,eACA,QACc;CACd,MAAM,aAAa,UAAU,iBAAiB,OAAO,QAAQ;CAE7D,MAAM,MAAM,IAAI,IAAI;CACpB,MAAM,SAAS,gBAAgB,MAAM;CACrC,MAAM,eAAe,qBAAqB,MAAM;CAOhD,IAAI,IAAI,MAAM;EAAE,QAAQ;EAAM,OAAO;CAAK,CAAC,CAAC;CAQ5C,MAAM,QAAQ,iBAAiB,MAAM,oBAAoB,MAAM;CAE/D,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,WAAW,EAAE,QAAQ,KAAK;CAC9B,CAAC,CAAC;CAEF,IAAI,OACA,IAAI,IAAI,wBAAwB,yBAAyB,KAAK,CAAC;CAGnE,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,MAAM,kBAAkB,QAAQ,KAAK;GAC3C;EACJ,CAAC;CACL,CAAC,CAAC;CAEF,KAAK,MAAM,QAAQ,gBACf,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM,KAAK;EACX,IAAI,OAAO,UAAU;GACjB,MAAM,WAAW,MAAM,aAAa;GAEpC,OAAO,WAAW,OAAO,QAAQ;IAC7B,KAAK,KAAK;IACV,MAAM,sBAAsB,OAAO,UAAU,IAAI;IACjD;GACJ,CAAC;EACL;CACJ,CAAC,CAAC;CAMN,IAAI,IAAI,kBAAkB;EACtB,QAAQ;EACR,MAAM;EACN,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ;GAC3C,KAAK;GACL,MAAM,CAAC;GACP;EACJ,CAAC;CACL,CAAC,CAAC;CAOF,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,UAAU;EACV,IAAI,CAAC,QACD,MAAM,qBAAqB,QAAQ;EAIvC,IAAI,IAAI,aAAaC,cACjB,KAAK,MAAM,KAAK,UAAU,UAAU,QAAQ,GAC5C;GACI,aAAa;GACb,MAAM;GACN,aAAa;GACb,gBAAgB;EACpB,CACJ,CAAC;CACL;CAEA,OAAO;AACX;;;;;;;;;;;;;;;AC9HA,SAAgBC,oBACZ,UAA4E,CAAC,GACjE;CACZ,OAAOC,kBAAiC;EACpC,QAAQ,QAAQ;EAChB,QAAQ,QAAQ,UAAU;EAC1B,gBAAgB,UAAU,UAAUC,gBAAc,UAAU,KAAK;CACrE,CAAC;AACL"}