@authup/server-core 1.0.0-beta.46 → 1.0.0-beta.47

package/dist/adapters/http/middleware/index.mjs

@@ -15,5 +15,6 @@ import { createLoggerMiddleware } from "./built-in/logger.mjs";
 import { registerPrometheusMiddleware } from "./built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./built-in/swagger.mjs";
+import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./built-in/ui-http-client.mjs";
 import "./built-in/index.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createSwaggerMiddleware, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };

package/dist/adapters/http/request/helpers/index.d.ts

@@ -1,9 +1,11 @@
 export * from './actor.ts';
 export * from './body-realm-id.ts';
 export * from './identity.ts';
+export * from './locale.ts';
 export * from './locations.ts';
 export * from './param-id.ts';
 export * from './realm-id.ts';
+export * from './redirect.ts';
 export * from './scopes.ts';
 export * from './token.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/request/helpers/index.mjs

@@ -4,9 +4,11 @@ import.meta.url;
 import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./identity.mjs";
 import { buildActorContext } from "./actor.mjs";
 import { getBodyRealmID } from "./body-realm-id.mjs";
+import { LOCALE_COOKIE, useRequestLocale } from "./locale.mjs";
 import { readFromLocations } from "./locations.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./realm-id.mjs";
+import { sanitizeRelativeRedirect } from "./redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./scopes.mjs";
 import { setRequestToken, useRequestToken } from "./token.mjs";
-export { RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isRequestIdentityMasterRealmMember, readFromLocations, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestParamID, useRequestScopes, useRequestToken };
+export { LOCALE_COOKIE, RequestIdentity, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isRequestIdentityMasterRealmMember, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestScopes, useRequestToken };

package/dist/adapters/http/request/helpers/locale.d.ts

@@ -0,0 +1,14 @@
+import type { LocaleCode } from '@authup/i18n';
+import type { IAppEvent } from 'routup';
+export declare const LOCALE_COOKIE = "vc-locale";
+/**
+ * Resolve the requester's preferred **authored** locale. The explicit UI
+ * locale cookie (`vc-locale`, written by @vuecs/locale) wins when it maps
+ * onto a supported catalog locale; `auto` and unsupported values fall
+ * through to the Accept-Language chain (routup-negotiated, q-ordered),
+ * which is walked for the first language authup ships — so
+ * `pt-BR, de;q=0.8` resolves to `de`, not the default. Returns undefined
+ * when nothing matches (callers fall back to the default locale).
+ */
+export declare function useRequestLocale(event: IAppEvent): LocaleCode | undefined;
+//# sourceMappingURL=locale.d.ts.map

package/dist/adapters/http/request/helpers/locale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/locale.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAkBzE"}

package/dist/adapters/http/request/helpers/locale.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { matchLocale } from "@authup/i18n";
+import { getRequestAcceptableLanguages } from "routup";
+import { useRequestCookie } from "@routup/basic/cookie";
+//#region src/adapters/http/request/helpers/locale.ts
+const LOCALE_COOKIE = "vc-locale";
+/**
+* Resolve the requester's preferred **authored** locale. The explicit UI
+* locale cookie (`vc-locale`, written by @vuecs/locale) wins when it maps
+* onto a supported catalog locale; `auto` and unsupported values fall
+* through to the Accept-Language chain (routup-negotiated, q-ordered),
+* which is walked for the first language authup ships — so
+* `pt-BR, de;q=0.8` resolves to `de`, not the default. Returns undefined
+* when nothing matches (callers fall back to the default locale).
+*/ function useRequestLocale(event) {
+	const cookie = useRequestCookie(event, LOCALE_COOKIE);
+	if (typeof cookie === "string") {
+		const matched = matchLocale(cookie);
+		if (matched) return matched;
+	}
+	const languages = getRequestAcceptableLanguages(event);
+	for (const language of languages) {
+		const matched = matchLocale(language);
+		if (matched) return matched;
+	}
+}
+//#endregion
+export { LOCALE_COOKIE, useRequestLocale };
+
+//# sourceMappingURL=locale.mjs.map

package/dist/adapters/http/request/helpers/locale.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale.mjs","names":["matchLocale","useRequestCookie","getRequestAcceptableLanguages","LOCALE_COOKIE","useRequestLocale","event","cookie","matched","languages","language","undefined"],"sources":["../../../../../src/adapters/http/request/helpers/locale.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { LocaleCode } from '@authup/i18n';\nimport { matchLocale } from '@authup/i18n';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport type { IAppEvent } from 'routup';\nimport { getRequestAcceptableLanguages } from 'routup';\n\nexport const LOCALE_COOKIE = 'vc-locale';\n\n/**\n * Resolve the requester's preferred **authored** locale. The explicit UI\n * locale cookie (`vc-locale`, written by @vuecs/locale) wins when it maps\n * onto a supported catalog locale; `auto` and unsupported values fall\n * through to the Accept-Language chain (routup-negotiated, q-ordered),\n * which is walked for the first language authup ships — so\n * `pt-BR, de;q=0.8` resolves to `de`, not the default. Returns undefined\n * when nothing matches (callers fall back to the default locale).\n */\nexport function useRequestLocale(event: IAppEvent): LocaleCode | undefined {\n    const cookie = useRequestCookie(event, LOCALE_COOKIE);\n    if (typeof cookie === 'string') {\n        const matched = matchLocale(cookie);\n        if (matched) {\n            return matched;\n        }\n    }\n\n    const languages = getRequestAcceptableLanguages(event);\n    for (const language of languages) {\n        const matched = matchLocale(language);\n        if (matched) {\n            return matched;\n        }\n    }\n\n    return undefined;\n}\n"],"mappings":";;;;;;;AAaA,MAAaG,gBAAgB;;;;;;;;;GAW7B,SAAgBC,iBAAiBC,OAAgB;CAC7C,MAAMC,SAASL,iBAAiBI,OAAOF,aAAAA;CACvC,IAAI,OAAOG,WAAW,UAAU;EAC5B,MAAMC,UAAUP,YAAYM,MAAAA;EAC5B,IAAIC,SACA,OAAOA;CAEf;CAEA,MAAMC,YAAYN,8BAA8BG,KAAAA;CAChD,KAAK,MAAMI,YAAYD,WAAW;EAC9B,MAAMD,UAAUP,YAAYS,QAAAA;EAC5B,IAAIF,SACA,OAAOA;CAEf;AAGJ"}

package/dist/adapters/http/request/helpers/locations.mjs

@@ -1,8 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { readRequestBody } from "@routup/basic/body";
 import { useRequestCookies } from "@routup/basic/cookie";
+import { readRequestBody } from "@routup/basic/body";
 import { useRequestQuery } from "@routup/basic/query";
 //#region src/adapters/http/request/helpers/locations.ts
 async function readFromLocations(event, locations) {

package/dist/adapters/http/request/helpers/redirect.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Open-redirect guard for the `redirect` query parameter carried by the
+ * auth workflow pages: only same-origin relative paths pass through, so the
+ * value can be safely reflected into an anchor href / forwarded as a
+ * post-login destination.
+ *
+ * Rejects: non-strings, control/whitespace chars (browsers strip some,
+ * shifting where the URL authority begins), protocol-relative (`//host`),
+ * backslash variants (browsers normalise `\` → `/`), and any scheme
+ * (`javascript:`, `http:`) — both on the raw and once-decoded form so a
+ * percent-encoded separator (`%2f`, `%5c`) can't slip past.
+ */
+export declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/adapters/http/request/helpers/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAwC3E"}

package/dist/adapters/http/request/helpers/redirect.mjs

@@ -0,0 +1,36 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/redirect.ts
+/**
+* Open-redirect guard for the `redirect` query parameter carried by the
+* auth workflow pages: only same-origin relative paths pass through, so the
+* value can be safely reflected into an anchor href / forwarded as a
+* post-login destination.
+*
+* Rejects: non-strings, control/whitespace chars (browsers strip some,
+* shifting where the URL authority begins), protocol-relative (`//host`),
+* backslash variants (browsers normalise `\` → `/`), and any scheme
+* (`javascript:`, `http:`) — both on the raw and once-decoded form so a
+* percent-encoded separator (`%2f`, `%5c`) can't slip past.
+*/ function sanitizeRelativeRedirect(input) {
+	if (typeof input !== "string" || input.length === 0) return;
+	if (/[\u0000-\u0020\u007f]/.test(input)) return;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(input);
+	} catch {
+		return;
+	}
+	if (/[\u0000-\u001f\u007f]/.test(decoded)) return;
+	for (const candidate of [input, decoded]) {
+		if (!candidate.startsWith("/")) return;
+		if (candidate.length > 1 && (candidate[1] === "/" || candidate[1] === "\\")) return;
+		if (candidate.includes("\\")) return;
+	}
+	return input;
+}
+//#endregion
+export { sanitizeRelativeRedirect };
+
+//# sourceMappingURL=redirect.mjs.map

package/dist/adapters/http/request/helpers/redirect.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.mjs","names":["sanitizeRelativeRedirect","input","length","undefined","test","decoded","decodeURIComponent","candidate","startsWith","includes"],"sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;;;;;;;;;GAmBA,SAAgBA,yBAAyBC,OAAc;CACnD,IAAI,OAAOA,UAAU,YAAYA,MAAMC,WAAW,GAC9C;CAMJ,IAAI,wBAAwBE,KAAKH,KAAAA,GAC7B;CAGJ,IAAII;CACJ,IAAI;EACAA,UAAUC,mBAAmBL,KAAAA;CACjC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwBG,KAAKC,OAAAA,GAC7B;CAGJ,KAAK,MAAME,aAAa,CAACN,OAAOI,OAAAA,GAAU;EACtC,IAAI,CAACE,UAAUC,WAAW,GAAA,GACtB;EAEJ,IAAID,UAAUL,SAAS,MAAMK,UAAU,OAAO,OAAOA,UAAU,OAAO,OAClE;EAEJ,IAAIA,UAAUE,SAAS,IAAA,GACnB;CAER;CAEA,OAAOR;AACX"}

package/dist/adapters/http/request/index.mjs

@@ -6,12 +6,14 @@ import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./
 import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./helpers/identity.mjs";
 import { buildActorContext } from "./helpers/actor.mjs";
 import { getBodyRealmID } from "./helpers/body-realm-id.mjs";
+import { LOCALE_COOKIE, useRequestLocale } from "./helpers/locale.mjs";
 import { readFromLocations } from "./helpers/locations.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./helpers/realm-id.mjs";
+import { sanitizeRelativeRedirect } from "./helpers/redirect.mjs";
 import { setRequestScopes, useRequestScopes } from "./helpers/scopes.mjs";
 import { setRequestToken, useRequestToken } from "./helpers/token.mjs";
 import "./helpers/index.mjs";
 import { RequestPermissionEvaluator } from "./permission/module.mjs";
 import "./permission/index.mjs";
-export { RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isRequestIdentityMasterRealmMember, readFromLocations, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };
+export { LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isRequestIdentityMasterRealmMember, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };

package/dist/adapters/http/ui/base-path.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Rewrite root-absolute /public/ asset references (script/link/preload tags
+ * emitted with the fixed vite base) so they carry the path prefix under which
+ * authup is publicly served (e.g. /auth/public/...). The reverse proxy is
+ * expected to strip the prefix before the request reaches authup, so the
+ * assets middleware keeps serving at /public.
+ */
+export declare function rebasePublicAssetURLs(html: string, basePath: string): string;
+//# sourceMappingURL=base-path.d.ts.map

package/dist/adapters/http/ui/base-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-path.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/base-path.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,MAAM,CAM7E"}

package/dist/adapters/http/ui/base-path.mjs

@@ -0,0 +1,18 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/ui/base-path.ts
+/**
+* Rewrite root-absolute /public/ asset references (script/link/preload tags
+* emitted with the fixed vite base) so they carry the path prefix under which
+* authup is publicly served (e.g. /auth/public/...). The reverse proxy is
+* expected to strip the prefix before the request reaches authup, so the
+* assets middleware keeps serving at /public.
+*/ function rebasePublicAssetURLs(html, basePath) {
+	if (!basePath) return html;
+	return html.replace(/(src|href)="\/public\//g, `$1="${basePath}/public/`);
+}
+//#endregion
+export { rebasePublicAssetURLs };
+
+//# sourceMappingURL=base-path.mjs.map

package/dist/adapters/http/ui/base-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-path.mjs","names":["rebasePublicAssetURLs","html","basePath","replace"],"sources":["../../../../src/adapters/http/ui/base-path.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Rewrite root-absolute /public/ asset references (script/link/preload tags\n * emitted with the fixed vite base) so they carry the path prefix under which\n * authup is publicly served (e.g. /auth/public/...). The reverse proxy is\n * expected to strip the prefix before the request reaches authup, so the\n * assets middleware keeps serving at /public.\n */\nexport function rebasePublicAssetURLs(html: string, basePath: string) : string {\n    if (!basePath) {\n        return html;\n    }\n\n    return html.replace(/(src|href)=\"\\/public\\//g, `$1=\"${basePath}/public/`);\n}\n"],"mappings":";;;;;;;;;;GAcA,SAAgBA,sBAAsBC,MAAcC,UAAgB;CAChE,IAAI,CAACA,UACD,OAAOD;CAGX,OAAOA,KAAKE,QAAQ,2BAA2B,OAAOD,SAAS,SAAS;AAC5E"}

package/dist/adapters/http/ui/index.d.ts

@@ -0,0 +1,5 @@
+export * from './base-path.ts';
+export * from './render.ts';
+export * from './serve.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/index.mjs

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { rebasePublicAssetURLs } from "./base-path.mjs";
+import { renderUIPage } from "./render.mjs";
+import { serveWorkflowPage } from "./serve.mjs";
+export { rebasePublicAssetURLs, renderUIPage, serveWorkflowPage };

package/dist/adapters/http/ui/render.d.ts

@@ -0,0 +1,4 @@
+import type { IAppEvent } from 'routup';
+import type { UIRenderContext } from './types.ts';
+export declare function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string>;
+//# sourceMappingURL=render.d.ts.map

package/dist/adapters/http/ui/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE1F"}

package/dist/adapters/http/ui/render.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
+import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
+import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
+import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
+import "../middleware/index.mjs";
+import { rebasePublicAssetURLs } from "./base-path.mjs";
+import { getURLBasePath } from "@authup/kit";
+import path from "node:path";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
+import { useRequestCookie } from "@routup/basic/cookie";
+import { load } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/render.ts
+const COLOR_MODE_COOKIE = "vc-color-mode";
+let cachedHtml;
+let cachedManifest;
+let cachedRender;
+async function renderUIPage(event, ctx) {
+	const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);
+	const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);
+	ctx.payload.config.colorMode = colorMode;
+	const locale = useRequestCookie(event, LOCALE_COOKIE);
+	ctx.payload.config.locale = locale;
+	let html;
+	let manifest;
+	let render;
+	if (isJIT) {
+		const vite = event.store[VITE_SERVER_STORE_KEY];
+		html = await fs.promises.readFile(path.join(UI_SOURCE_PATH, "index.html"), "utf-8");
+		html = await vite.transformIndexHtml("/", html);
+		manifest = {};
+		render = (await vite.ssrLoadModule("/src/server.ts")).render;
+	} else {
+		html = cachedHtml ??= await fs.promises.readFile(path.join(UI_DIST_PATH, "client", "index.html"), "utf-8");
+		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(UI_DIST_PATH, "client", ".vite", "ssr-manifest.json"), "utf-8"));
+		render = cachedRender ??= (await load(path.join(UI_DIST_PATH, "server", "server.js"))).render;
+	}
+	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
+	const [appHtml, preloadLinks] = await render({
+		url: ctx.url,
+		manifest,
+		payload: ctx.payload,
+		httpClient: httpClientFactory ? httpClientFactory() : void 0
+	});
+	let body = html.replace("<!--preload-links-->", preloadLinks).replace("<!--app-html-->", appHtml);
+	let htmlAttrs = "lang=\"en\"";
+	if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) htmlAttrs = `lang="${locale}"`;
+	if (colorMode === "dark" || colorMode === "light") htmlAttrs += ` class="${colorMode}"`;
+	body = body.replace(/<html\b[^>]*>/i, `<html ${htmlAttrs}>`);
+	body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));
+	event.response.headers.set("content-type", "text/html; charset=utf-8");
+	return body;
+}
+//#endregion
+export { renderUIPage };
+
+//# sourceMappingURL=render.mjs.map

package/dist/adapters/http/ui/render.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","load","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { load } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await load(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAC3C,OAAOP;AACX"}

package/dist/adapters/http/ui/serve.d.ts

@@ -0,0 +1,16 @@
+import type { StatusResponseFeatures } from '@authup/core-http-kit';
+import type { IAppEvent } from 'routup';
+export type ServeWorkflowPageOptions = {
+    url: string;
+    baseURL: string;
+    features: StatusResponseFeatures;
+    realmAware?: boolean;
+    tokenAware?: boolean;
+};
+/**
+ * Single SSR payload-assembly path for the auth workflow GET routes:
+ * whitelists query params, applies the open-redirect guard, and renders.
+ * Keeps the four workflow controllers as thin POST adapters.
+ */
+export declare function serveWorkflowPage(event: IAppEvent, options: ServeWorkflowPageOptions): Promise<string>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/adapters/http/ui/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/dist/adapters/http/ui/serve.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sanitizeRelativeRedirect } from "../request/helpers/redirect.mjs";
+import "../request/index.mjs";
+import { renderUIPage } from "./render.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+//#region src/adapters/http/ui/serve.ts
+/**
+* Single SSR payload-assembly path for the auth workflow GET routes:
+* whitelists query params, applies the open-redirect guard, and renders.
+* Keeps the four workflow controllers as thin POST adapters.
+*/ function serveWorkflowPage(event, options) {
+	const query = useRequestQuery(event);
+	const data = {
+		features: options.features,
+		redirect: sanitizeRelativeRedirect(query.redirect)
+	};
+	if (options.realmAware) data.realmId = typeof query.realm_id === "string" ? query.realm_id : void 0;
+	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
+	return renderUIPage(event, {
+		url: options.url,
+		payload: {
+			config: { baseURL: options.baseURL },
+			data
+		}
+	});
+}
+//#endregion
+export { serveWorkflowPage };
+
+//# sourceMappingURL=serve.mjs.map

package/dist/adapters/http/ui/serve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realm_id` / `token` query params (e.g.\n    // prefill from an email deep link). Off by default so a page never\n    // reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        data.realmId = typeof query.realm_id === 'string' ? query.realm_id : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YACRH,KAAKI,UAAU,OAAOL,MAAMM,aAAa,WAAWN,MAAMM,WAAWC,KAAAA;CAGzE,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/adapters/http/ui/types.d.ts

@@ -0,0 +1,8 @@
+export type UIRenderContext = {
+    url: string;
+    payload: {
+        config: Record<string, any>;
+        data: Record<string, any>;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC7B,CAAC;CACL,CAAC"}

package/dist/adapters/http/ui/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/app/index.mjs

@@ -6,6 +6,7 @@ import { CacheInjectionKey } from "./modules/cache/constants.mjs";
 import { ModuleName } from "./modules/constants.mjs";
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./modules/config/constants.mjs";
 import { ConfigModule } from "./modules/config/module.mjs";
+import { getAppOrigins } from "./modules/config/origins.mjs";
 import { CacheModule } from "./modules/cache/module.mjs";
 import { SessionRepository } from "./modules/authentication/repositories/session.mjs";
 import { AuthenticationModule } from "./modules/authentication/module.mjs";
@@ -50,7 +51,7 @@ import { LDAPInjectionKey } from "./modules/ldap/constants.mjs";
 import { LdapModule } from "./modules/ldap/module.mjs";
 import { IdentityModule } from "./modules/identity/module.mjs";
 import { OAuth2Module } from "./modules/oauth2/module.mjs";
-import { MailInjectionKey } from "./modules/mail/constants.mjs";
+import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./modules/mail/constants.mjs";
 import { MailModule } from "./modules/mail/module.mjs";
 import { HTTPModule } from "./modules/http/module.mjs";
 import { DefaultProvisioningSource } from "./modules/provisioning/sources/default/module.mjs";
@@ -61,4 +62,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, UserAttributeRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, ProvisionerModule, RealmRepositoryAdapter, RobotIdentityRepository, RobotPermissionRepositoryAdapter, RobotRepositoryAdapter, RobotRoleRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, UserAttributeRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, getAppOrigins };

package/dist/app/modules/config/constants.d.ts

@@ -9,6 +9,7 @@ export declare enum ConfigEnvironmentVariableName {
     HOST = "HOST",
     PORT = "PORT",
     PUBLIC_URL = "PUBLIC_URL",
+    ADDITIONAL_DOMAINS = "ADDITIONAL_DOMAINS",
     TOKEN_ACCESS_MAX_AGE = "TOKEN_ACCESS_MAX_AGE",
     TOKEN_REFRESH_MAX_AGE = "TOKEN_REFRESH_MAX_AGE",
     REGISTRATION_ENABLED = "REGISTRATION_ENABLED",

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAEvD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IAEvD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,gBAAgB,qBAAqB;IACrC,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,wBAAwB,6BAA6B;IAErD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -12,6 +12,7 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["HOST"] = "HOST";
 	ConfigEnvironmentVariableName["PORT"] = "PORT";
 	ConfigEnvironmentVariableName["PUBLIC_URL"] = "PUBLIC_URL";
+	ConfigEnvironmentVariableName["ADDITIONAL_DOMAINS"] = "ADDITIONAL_DOMAINS";
 	ConfigEnvironmentVariableName["TOKEN_ACCESS_MAX_AGE"] = "TOKEN_ACCESS_MAX_AGE";
 	ConfigEnvironmentVariableName["TOKEN_REFRESH_MAX_AGE"] = "TOKEN_REFRESH_MAX_AGE";
 	ConfigEnvironmentVariableName["REGISTRATION_ENABLED"] = "REGISTRATION_ENABLED";

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    ADDITIONAL_DOMAINS = 'ADDITIONAL_DOMAINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    ROBOT_AUTH_BASIC = 'ROBOT_AUTH_BASIC',\n    ROBOT_ADMIN_ENABLED = 'ROBOT_ADMIN_ENABLED',\n    ROBOT_ADMIN_SECRET = 'ROBOT_ADMIN_SECRET',\n    ROBOT_ADMIN_SECRET_RESET = 'ROBOT_ADMIN_SECRET_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAA"}

package/dist/app/modules/config/index.d.ts

@@ -1,4 +1,5 @@
 export * from './constants.ts';
 export * from './module.ts';
+export * from './origins.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/app/modules/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/app/modules/config/index.mjs

@@ -3,4 +3,5 @@ import "node:url";
 import.meta.url;
 import { ConfigEnvironmentVariableName, ConfigInjectionKey } from "./constants.mjs";
 import { ConfigModule } from "./module.mjs";
-export { ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule };
+import { getAppOrigins } from "./origins.mjs";
+export { ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, getAppOrigins };

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,MAAM,CAoE/D"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,MAAM,CA0F/D"}

package/dist/app/modules/config/normalize.mjs

@@ -22,8 +22,14 @@ function normalizeConfig(input = {}) {
 			publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;
 		} else publicUrl = `http://${toPublicHost(host)}:${port}`;
 	}
+	const env = read("NODE_ENV", EnvironmentName.DEVELOPMENT);
+	const additionalDomains = [...parsed.additionalDomains ?? []];
+	if (env !== EnvironmentName.PRODUCTION) {
+		const devOrigin = "http://localhost:3000";
+		if (!additionalDomains.includes(devOrigin)) additionalDomains.push(devOrigin);
+	}
 	return {
-		env: read("NODE_ENV", EnvironmentName.DEVELOPMENT),
+		env,
 		rootPath: process.cwd(),
 		writableDirectoryPath,
 		logger: true,
@@ -58,7 +64,8 @@ function normalizeConfig(input = {}) {
 		robotAdminSecretReset: false,
 		permissions: [],
 		permissionsDefaultPolicyAssignment: true,
-		...parsed
+		...parsed,
+		additionalDomains
 	};
 }
 //#endregion

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","EnvironmentName","toPublicHost","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport function normalizeConfig(input: ConfigInput = {}): Config {\n    const parsed = parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port || 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    return {\n        env: read('NODE_ENV', EnvironmentName.DEVELOPMENT),\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 3_600,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n    };\n}\n"],"mappings":";;;;;;;;;;AAeA,SAAgBM,gBAAgBC,QAAqB,CAAC,GAAC;CACnD,MAAMC,SAASH,YAAYE,KAAAA;CAE3B,MAAME,wBAAwBD,OAAOC,yBACjCR,KAAKS,KAAKR,QAAQS,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGD;CAEpD;CAEA,OAAO;EACHK,KAAKjB,KAAK,YAAYG,gBAAgBe,WAAW;EACjDC,UAAUjB,QAAQS,IAAG;EACrBF;EAEAW,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENV;EACAC;EACAC;EAEAS,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EAEzBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGxC;CACP;AACJ"}
+{"version":3,"file":"normalize.mjs","names":["read","path","process","EnvironmentName","toPublicHost","parseConfig","normalizeConfig","input","parsed","writableDirectoryPath","join","cwd","port","host","publicUrl","regex","match","env","DEVELOPMENT","additionalDomains","PRODUCTION","devOrigin","includes","push","rootPath","logger","redis","smtp","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","robotAuthBasic","robotAdminEnabled","robotAdminSecret","robotAdminSecretReset","permissions","permissionsDefaultPolicyAssignment"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { EnvironmentName } from '@authup/kit';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { parseConfig } from './parse.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport function normalizeConfig(input: ConfigInput = {}): Config {\n    const parsed = parseConfig(input);\n\n    const writableDirectoryPath = parsed.writableDirectoryPath ||\n        path.join(process.cwd(), 'writable');\n\n    const port = parsed.port || 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // In non-production (development & test) client-web runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    // Copy — never mutate the caller-supplied parsed array in place, or a\n    // repeated normalizeConfig() on the same input accumulates the dev origin\n    // into a security-sensitive allowlist.\n    const additionalDomains = [...(parsed.additionalDomains ?? [])];\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!additionalDomains.includes(devOrigin)) {\n            additionalDomains.push(devOrigin);\n        }\n    }\n\n    return {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath,\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 3_600,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        robotAuthBasic: false,\n        robotAdminEnabled: false,\n        robotAdminSecret: 'start123',\n        robotAdminSecretReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the dev-seeded value wins over the raw\n        // parsed list (parsed.additionalDomains is already merged in above).\n        additionalDomains,\n    };\n}\n"],"mappings":";;;;;;;;;;AAeA,SAAgBM,gBAAgBC,QAAqB,CAAC,GAAC;CACnD,MAAMC,SAASH,YAAYE,KAAAA;CAE3B,MAAME,wBAAwBD,OAAOC,yBACjCR,KAAKS,KAAKR,QAAQS,IAAG,GAAI,UAAA;CAE7B,MAAMC,OAAOJ,OAAOI,QAAQ;CAC5B,IAAIC,OAAOL,OAAOK,QAAQ;CAE1B,IAAIC;CACJ,IAAIN,OAAOM,WACPA,YAAYN,OAAOM;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMjB,KAAK,YAAYG,gBAAgBe,WAAW;CAUxD,MAAMC,oBAAoB,CAAA,GAAKX,OAAOW,qBAAqB,CAAA,CAAA;CAC3D,IAAIF,QAAQd,gBAAgBiB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACF,kBAAkBG,SAASD,SAAAA,GAC5BF,kBAAkBI,KAAKF,SAAAA;CAE/B;CAEA,OAAO;EACHJ;EACAO,UAAUtB,QAAQS,IAAG;EACrBF;EAEAgB,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENf;EACAC;EACAC;EAEAc,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EAEzBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,gBAAgB;EAChBC,mBAAmB;EACnBC,kBAAkB;EAClBC,uBAAuB;EAEvBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAG7C;EAIHW;CACJ;AACJ"}

package/dist/app/modules/config/origins.d.ts

@@ -0,0 +1,10 @@
+import type { Config } from './types.ts';
+/**
+ * Derive the set of trusted application origins (scheme://host[:port]).
+ *
+ * publicUrl may carry a path; both the OAuth2 redirect allowlist and the
+ * CORS origin allowlist need bare origins, so extract the origin from each
+ * configured URL and de-duplicate.
+ */
+export declare function getAppOrigins(config: Pick<Config, 'publicUrl' | 'additionalDomains'>): string[];
+//# sourceMappingURL=origins.d.ts.map

package/dist/app/modules/config/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,mBAAmB,CAAC,GAAG,MAAM,EAAE,CAS/F"}