@authup/server-core 1.0.0-beta.5 → 1.0.0-beta.50

package/dist/adapters/http/request/helpers/param-id.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"param-id.mjs","names":["isUUID","ValidupError","buildErrorMessageForAttribute","defineIssueItem","useRequestParamID","event","options","id","getRequestParamID","path","message","getRequestStringParam","undefined","key","value","params","length","getRequestStringParamOrFail"],"sources":["../../../../../src/adapters/http/request/helpers/param-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isUUID } from '@authup/kit';\nimport type { IAppEvent } from 'routup';\nimport { ValidupError, buildErrorMessageForAttribute, defineIssueItem } from 'validup';\n\ntype RequestIDParamOptions = {\n    /**\n     * default: true\n     */\n    isUUID?: boolean\n};\n\nexport function useRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string {\n    const id = getRequestParamID(event, options);\n    if (typeof id === 'undefined') {\n        throw new ValidupError([\n            defineIssueItem({\n                path: ['id'],\n                message: buildErrorMessageForAttribute('id'),\n            }),\n        ]);\n    }\n\n    return id;\n}\n\nexport function getRequestParamID(event: IAppEvent, options: RequestIDParamOptions = {}) : string | undefined {\n    const id = getRequestStringParam(event, 'id');\n    if (!id) {\n        return undefined;\n    }\n\n    options.isUUID = options.isUUID ?? true;\n    if (options.isUUID && !isUUID(id)) {\n        return undefined;\n    }\n\n    return id;\n}\n\nexport function getRequestStringParam(event: IAppEvent, key: string) : string | undefined {\n    const value = event.params[key];\n    if (typeof value !== 'string' || value.length === 0) {\n        return undefined;\n    }\n\n    return value;\n}\n\nexport function getRequestStringParamOrFail(event: IAppEvent, key: string) : string | undefined {\n    const value = getRequestStringParam(event, key);\n    if (typeof value === 'undefined') {\n        throw new ValidupError([\n            defineIssueItem({\n                path: [key],\n                message: buildErrorMessageForAttribute(key),\n            }),\n        ]);\n    }\n\n    return value;\n}\n"],"mappings":";;;;;;AAkBA,SAAgBI,kBAAkBC,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKC,kBAAkBH,OAAOC,OAAAA;CACpC,IAAI,OAAOC,OAAO,aACd,MAAM,IAAIN,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAAC,IAAA;EACPC,SAASR,8BAA8B,IAAA;CAC3C,CAAA,CAAA,CACH;CAGL,OAAOK;AACX;AAEA,SAAgBC,kBAAkBH,OAAkBC,UAAiC,CAAC,GAAC;CACnF,MAAMC,KAAKI,sBAAsBN,OAAO,IAAA;CACxC,IAAI,CAACE,IACD;CAGJD,QAAQN,SAASM,QAAQN,UAAU;CACnC,IAAIM,QAAQN,UAAU,CAACA,OAAOO,EAAAA,GAC1B;CAGJ,OAAOA;AACX;AAEA,SAAgBI,sBAAsBN,OAAkBQ,KAAW;CAC/D,MAAMC,QAAQT,MAAMU,OAAOF;CAC3B,IAAI,OAAOC,UAAU,YAAYA,MAAME,WAAW,GAC9C;CAGJ,OAAOF;AACX;AAEA,SAAgBG,4BAA4BZ,OAAkBQ,KAAW;CACrE,MAAMC,QAAQH,sBAAsBN,OAAOQ,GAAAA;CAC3C,IAAI,OAAOC,UAAU,aACjB,MAAM,IAAIb,aAAa,CACnBE,gBAAgB;EACZM,MAAM,CAACI,GAAAA;EACPH,SAASR,8BAA8BW,GAAAA;CAC3C,CAAA,CAAA,CACH;CAGL,OAAOC;AACX"}

package/dist/adapters/http/request/helpers/realm-id.d.ts

@@ -0,0 +1,5 @@
+import type { IAppEvent } from 'routup';
+export declare function setRequestRealmID(event: IAppEvent, id: string): void;
+export declare function getRequestRealmID(event: IAppEvent): string | undefined;
+export declare function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void;
+//# sourceMappingURL=realm-id.d.ts.map

package/dist/adapters/http/request/helpers/realm-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-id.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAKxC,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAEpE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAMtE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAKzF"}

package/dist/adapters/http/request/helpers/realm-id.mjs

@@ -0,0 +1,22 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getRequestStringParam } from "./param-id.mjs";
+//#region src/adapters/http/request/helpers/realm-id.ts
+const sym = Symbol("RRealmID");
+function setRequestRealmID(event, id) {
+	event.store[sym] = id;
+}
+function getRequestRealmID(event) {
+	const stored = event.store[sym];
+	if (stored) return stored;
+	return getRequestStringParam(event, "realmId");
+}
+function applyRouteRealmIDToBody(event, data) {
+	const routeRealmId = getRequestRealmID(event);
+	if (routeRealmId) data.realm_id = routeRealmId;
+}
+//#endregion
+export { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID };
+
+//# sourceMappingURL=realm-id.mjs.map

package/dist/adapters/http/request/helpers/realm-id.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-id.mjs","names":["getRequestStringParam","sym","Symbol","setRequestRealmID","event","id","store","getRequestRealmID","stored","applyRouteRealmIDToBody","data","routeRealmId","realm_id"],"sources":["../../../../../src/adapters/http/request/helpers/realm-id.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport { getRequestStringParam } from './param-id.ts';\n\nconst sym = Symbol('RRealmID');\n\nexport function setRequestRealmID(event: IAppEvent, id: string): void {\n    event.store[sym] = id;\n}\n\nexport function getRequestRealmID(event: IAppEvent): string | undefined {\n    const stored = event.store[sym] as string | undefined;\n    if (stored) {\n        return stored;\n    }\n    return getRequestStringParam(event, 'realmId');\n}\n\nexport function applyRouteRealmIDToBody(event: IAppEvent, data: Record<string, any>): void {\n    const routeRealmId = getRequestRealmID(event);\n    if (routeRealmId) {\n        data.realm_id = routeRealmId;\n    }\n}\n"],"mappings":";;;;;AAUA,MAAMC,MAAMC,OAAO,UAAA;AAEnB,SAAgBC,kBAAkBC,OAAkBC,IAAU;CAC1DD,MAAME,MAAML,OAAOI;AACvB;AAEA,SAAgBE,kBAAkBH,OAAgB;CAC9C,MAAMI,SAASJ,MAAME,MAAML;CAC3B,IAAIO,QACA,OAAOA;CAEX,OAAOR,sBAAsBI,OAAO,SAAA;AACxC;AAEA,SAAgBK,wBAAwBL,OAAkBM,MAAyB;CAC/E,MAAMC,eAAeJ,kBAAkBH,KAAAA;CACvC,IAAIO,cACAD,KAAKE,WAAWD;AAExB"}

package/dist/adapters/http/request/helpers/redirect.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Open-redirect guard for the `redirect` query parameter carried by the
+ * auth workflow pages: only same-origin relative paths pass through, so the
+ * value can be safely reflected into an anchor href / forwarded as a
+ * post-login destination.
+ *
+ * Rejects: non-strings, control/whitespace chars (browsers strip some,
+ * shifting where the URL authority begins), protocol-relative (`//host`),
+ * backslash variants (browsers normalise `\` → `/`), and any scheme
+ * (`javascript:`, `http:`) — both on the raw and once-decoded form so a
+ * percent-encoded separator (`%2f`, `%5c`) can't slip past.
+ */
+export declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/adapters/http/request/helpers/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAwC3E"}

package/dist/adapters/http/request/helpers/redirect.mjs

@@ -0,0 +1,36 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/redirect.ts
+/**
+* Open-redirect guard for the `redirect` query parameter carried by the
+* auth workflow pages: only same-origin relative paths pass through, so the
+* value can be safely reflected into an anchor href / forwarded as a
+* post-login destination.
+*
+* Rejects: non-strings, control/whitespace chars (browsers strip some,
+* shifting where the URL authority begins), protocol-relative (`//host`),
+* backslash variants (browsers normalise `\` → `/`), and any scheme
+* (`javascript:`, `http:`) — both on the raw and once-decoded form so a
+* percent-encoded separator (`%2f`, `%5c`) can't slip past.
+*/ function sanitizeRelativeRedirect(input) {
+	if (typeof input !== "string" || input.length === 0) return;
+	if (/[\u0000-\u0020\u007f]/.test(input)) return;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(input);
+	} catch {
+		return;
+	}
+	if (/[\u0000-\u001f\u007f]/.test(decoded)) return;
+	for (const candidate of [input, decoded]) {
+		if (!candidate.startsWith("/")) return;
+		if (candidate.length > 1 && (candidate[1] === "/" || candidate[1] === "\\")) return;
+		if (candidate.includes("\\")) return;
+	}
+	return input;
+}
+//#endregion
+export { sanitizeRelativeRedirect };
+
+//# sourceMappingURL=redirect.mjs.map

package/dist/adapters/http/request/helpers/redirect.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.mjs","names":["sanitizeRelativeRedirect","input","length","undefined","test","decoded","decodeURIComponent","candidate","startsWith","includes"],"sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;;;;;;;;;GAmBA,SAAgBA,yBAAyBC,OAAc;CACnD,IAAI,OAAOA,UAAU,YAAYA,MAAMC,WAAW,GAC9C;CAMJ,IAAI,wBAAwBE,KAAKH,KAAAA,GAC7B;CAGJ,IAAII;CACJ,IAAI;EACAA,UAAUC,mBAAmBL,KAAAA;CACjC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwBG,KAAKC,OAAAA,GAC7B;CAGJ,KAAK,MAAME,aAAa,CAACN,OAAOI,OAAAA,GAAU;EACtC,IAAI,CAACE,UAAUC,WAAW,GAAA,GACtB;EAEJ,IAAID,UAAUL,SAAS,MAAMK,UAAU,OAAO,OAAOA,UAAU,OAAO,OAClE;EAEJ,IAAIA,UAAUE,SAAS,IAAA,GACnB;CAER;CAEA,OAAOR;AACX"}

package/dist/adapters/http/request/helpers/scopes.d.ts

@@ -0,0 +1,4 @@
+import type { IAppEvent } from 'routup';
+export declare function useRequestScopes(event: IAppEvent): string[];
+export declare function setRequestScopes(event: IAppEvent, scopes: string[]): void;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/adapters/http/request/helpers/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/scopes.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAI,MAAM,EAAE,CAI5D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAElE"}

package/dist/adapters/http/request/helpers/scopes.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/scopes.ts
+const sym = Symbol("Scopes");
+function useRequestScopes(event) {
+	return event.store[sym] || [];
+}
+function setRequestScopes(event, scopes) {
+	event.store[sym] = scopes;
+}
+//#endregion
+export { setRequestScopes, useRequestScopes };
+
+//# sourceMappingURL=scopes.mjs.map

package/dist/adapters/http/request/helpers/scopes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.mjs","names":["sym","Symbol","useRequestScopes","event","scopes","store","setRequestScopes"],"sources":["../../../../../src/adapters/http/request/helpers/scopes.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('Scopes');\n\nexport function useRequestScopes(event: IAppEvent) : string[] {\n    const scopes = event.store[sym] as string[] | undefined;\n\n    return scopes || [];\n}\n\nexport function setRequestScopes(event: IAppEvent, scopes: string[]) {\n    event.store[sym] = scopes;\n}\n"],"mappings":";;;;AASA,MAAMA,MAAMC,OAAO,QAAA;AAEnB,SAAgBC,iBAAiBC,OAAgB;CAG7C,OAFeA,MAAME,MAAML,QAEV,CAAA;AACrB;AAEA,SAAgBM,iBAAiBH,OAAkBC,QAAgB;CAC/DD,MAAME,MAAML,OAAOI;AACvB"}

package/dist/adapters/http/request/helpers/token.d.ts

@@ -0,0 +1,4 @@
+import type { IAppEvent } from 'routup';
+export declare function useRequestToken(event: IAppEvent): string | undefined;
+export declare function setRequestToken(event: IAppEvent, token: string): void;
+//# sourceMappingURL=token.d.ts.map

package/dist/adapters/http/request/helpers/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GACjB,MAAM,GAAG,SAAS,CAChD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,QAE9D"}

package/dist/adapters/http/request/helpers/token.mjs

@@ -0,0 +1,15 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/helpers/token.ts
+const sym = Symbol("Token");
+function useRequestToken(event) {
+	return event.store[sym];
+}
+function setRequestToken(event, token) {
+	event.store[sym] = token;
+}
+//#endregion
+export { setRequestToken, useRequestToken };
+
+//# sourceMappingURL=token.mjs.map

package/dist/adapters/http/request/helpers/token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.mjs","names":["sym","Symbol","useRequestToken","event","store","setRequestToken","token"],"sources":["../../../../../src/adapters/http/request/helpers/token.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\n\nconst sym = Symbol('Token');\n\nexport function useRequestToken(event: IAppEvent) {\n    return event.store[sym] as string | undefined;\n}\n\nexport function setRequestToken(event: IAppEvent, token: string) {\n    event.store[sym] = token;\n}\n"],"mappings":";;;;AASA,MAAMA,MAAMC,OAAO,OAAA;AAEnB,SAAgBC,gBAAgBC,OAAgB;CAC5C,OAAOA,MAAMC,MAAMJ;AACvB;AAEA,SAAgBK,gBAAgBF,OAAkBG,OAAa;CAC3DH,MAAMC,MAAMJ,OAAOM;AACvB"}

package/dist/adapters/http/request/index.d.ts

@@ -0,0 +1,4 @@
+export * from './constants.ts';
+export * from './helpers/index.ts';
+export * from './permission/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/request/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC"}

package/dist/adapters/http/request/index.mjs

@@ -0,0 +1,19 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RequestHandlerOperation } from "./constants.mjs";
+import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./permission/helper.mjs";
+import { RequestIdentity, isRequestIdentityMasterRealmMember, setRequestIdentity, useRequestIdentity, useRequestIdentityOrFail } from "./helpers/identity.mjs";
+import { buildActorContext } from "./helpers/actor.mjs";
+import { getBodyRealmID } from "./helpers/body-realm-id.mjs";
+import { LOCALE_COOKIE, useRequestLocale } from "./helpers/locale.mjs";
+import { readFromLocations } from "./helpers/locations.mjs";
+import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./helpers/param-id.mjs";
+import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./helpers/realm-id.mjs";
+import { sanitizeRelativeRedirect } from "./helpers/redirect.mjs";
+import { setRequestScopes, useRequestScopes } from "./helpers/scopes.mjs";
+import { setRequestToken, useRequestToken } from "./helpers/token.mjs";
+import "./helpers/index.mjs";
+import { RequestPermissionEvaluator } from "./permission/module.mjs";
+import "./permission/index.mjs";
+export { LOCALE_COOKIE, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, applyRouteRealmIDToBody, buildActorContext, getBodyRealmID, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, isRequestIdentityMasterRealmMember, readFromLocations, sanitizeRelativeRedirect, setRequestIdentity, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestToken, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestToken };

package/dist/adapters/http/request/permission/helper.d.ts

@@ -0,0 +1,5 @@
+import type { IAppEvent } from 'routup';
+import type { RequestPermissionEvaluator } from './module.ts';
+export declare function useRequestPermissionEvaluator(event: IAppEvent): RequestPermissionEvaluator;
+export declare function setRequestPermissionEvaluator(event: IAppEvent, ctx: RequestPermissionEvaluator): void;
+//# sourceMappingURL=helper.d.ts.map

package/dist/adapters/http/request/permission/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/helper.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAI9D,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,SAAS,GAAI,0BAA0B,CAO3F;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,0BAA0B,QAE9F"}

package/dist/adapters/http/request/permission/helper.mjs

@@ -0,0 +1,17 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/request/permission/helper.ts
+const sym = Symbol("RequestPermissionEvaluator");
+function useRequestPermissionEvaluator(event) {
+	const instance = event.store[sym];
+	if (!instance) throw new Error("The request permission evaluator is not initialised.");
+	return instance;
+}
+function setRequestPermissionEvaluator(event, ctx) {
+	event.store[sym] = ctx;
+}
+//#endregion
+export { setRequestPermissionEvaluator, useRequestPermissionEvaluator };
+
+//# sourceMappingURL=helper.mjs.map

package/dist/adapters/http/request/permission/helper.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.mjs","names":["sym","Symbol","useRequestPermissionEvaluator","event","instance","store","Error","setRequestPermissionEvaluator","ctx"],"sources":["../../../../../src/adapters/http/request/permission/helper.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IAppEvent } from 'routup';\nimport type { RequestPermissionEvaluator } from './module.ts';\n\nconst sym = Symbol('RequestPermissionEvaluator');\n\nexport function useRequestPermissionEvaluator(event: IAppEvent) : RequestPermissionEvaluator {\n    const instance = event.store[sym];\n    if (!instance) {\n        throw new Error('The request permission evaluator is not initialised.');\n    }\n\n    return instance as RequestPermissionEvaluator;\n}\n\nexport function setRequestPermissionEvaluator(event: IAppEvent, ctx: RequestPermissionEvaluator) {\n    event.store[sym] = ctx;\n}\n"],"mappings":";;;;AAUA,MAAMA,MAAMC,OAAO,4BAAA;AAEnB,SAAgBC,8BAA8BC,OAAgB;CAC1D,MAAMC,WAAWD,MAAME,MAAML;CAC7B,IAAI,CAACI,UACD,MAAM,IAAIE,MAAM,sDAAA;CAGpB,OAAOF;AACX;AAEA,SAAgBG,8BAA8BJ,OAAkBK,KAA+B;CAC3FL,MAAME,MAAML,OAAOQ;AACvB"}

package/dist/adapters/http/request/permission/index.d.ts

@@ -0,0 +1,3 @@
+export * from './helper.ts';
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/request/permission/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/adapters/http/request/permission/index.mjs

@@ -0,0 +1,6 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { setRequestPermissionEvaluator, useRequestPermissionEvaluator } from "./helper.mjs";
+import { RequestPermissionEvaluator } from "./module.mjs";
+export { RequestPermissionEvaluator, setRequestPermissionEvaluator, useRequestPermissionEvaluator };

package/dist/adapters/http/request/permission/module.d.ts

@@ -0,0 +1,13 @@
+import type { IPermissionEvaluator, PermissionEvaluationContext } from '@authup/access';
+import type { IAppEvent } from 'routup';
+export declare class RequestPermissionEvaluator implements IPermissionEvaluator {
+    protected event: IAppEvent;
+    protected evaluator: IPermissionEvaluator;
+    constructor(event: IAppEvent, evaluator: IPermissionEvaluator);
+    evaluate(ctx: PermissionEvaluationContext): Promise<void>;
+    preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
+    preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
+    evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
+    protected extendContext(ctx: PermissionEvaluationContext): PermissionEvaluationContext;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/request/permission/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/permission/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,qBAAa,0BAA2B,YAAW,oBAAoB;IACnE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAE3B,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC;gBAE9B,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB;IAOvD,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAI1D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAM7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAIlE,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAMrE,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,2BAA2B;CAS3D"}

package/dist/adapters/http/request/permission/module.mjs

@@ -0,0 +1,40 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { useRequestIdentity } from "../helpers/identity.mjs";
+import { useRequestScopes } from "../helpers/scopes.mjs";
+import "../helpers/index.mjs";
+import { ScopeName } from "@authup/core-kit";
+import { BuiltInPolicyType, PolicyData } from "@authup/access";
+//#region src/adapters/http/request/permission/module.ts
+var RequestPermissionEvaluator = class {
+	event;
+	evaluator;
+	constructor(event, evaluator) {
+		this.event = event;
+		this.evaluator = evaluator;
+	}
+	async evaluate(ctx) {
+		return this.evaluator.evaluate(this.extendContext(ctx));
+	}
+	async preEvaluate(ctx) {
+		return this.evaluator.preEvaluate(this.extendContext(ctx));
+	}
+	async preEvaluateOneOf(ctx) {
+		return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));
+	}
+	async evaluateOneOf(ctx) {
+		return this.evaluator.evaluateOneOf(this.extendContext(ctx));
+	}
+	extendContext(ctx) {
+		if (useRequestScopes(this.event).includes(ScopeName.GLOBAL)) {
+			ctx.input = ctx.input || new PolicyData();
+			ctx.input.set(BuiltInPolicyType.IDENTITY, useRequestIdentity(this.event));
+		}
+		return ctx;
+	}
+};
+//#endregion
+export { RequestPermissionEvaluator };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/request/permission/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["ScopeName","BuiltInPolicyType","PolicyData","useRequestIdentity","useRequestScopes","RequestPermissionEvaluator","event","evaluator","evaluate","ctx","extendContext","preEvaluate","preEvaluateOneOf","evaluateOneOf","scopes","includes","GLOBAL","input","set","IDENTITY"],"sources":["../../../../../src/adapters/http/request/permission/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { ScopeName } from '@authup/core-kit';\nimport type {\n    IPermissionEvaluator,\n    PermissionEvaluationContext,\n} from '@authup/access';\nimport { BuiltInPolicyType, PolicyData } from '@authup/access';\nimport type { IAppEvent } from 'routup';\nimport { useRequestIdentity, useRequestScopes } from '../helpers/index.ts';\n\nexport class RequestPermissionEvaluator implements IPermissionEvaluator {\n    protected event: IAppEvent;\n\n    protected evaluator: IPermissionEvaluator;\n\n    constructor(event: IAppEvent, evaluator: IPermissionEvaluator) {\n        this.event = event;\n        this.evaluator = evaluator;\n    }\n\n    // --------------------------------------------------------------\n\n    async evaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluate(this.extendContext(ctx));\n    }\n\n    async preEvaluate(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluate(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    async preEvaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.preEvaluateOneOf(this.extendContext(ctx));\n    }\n\n    async evaluateOneOf(ctx: PermissionEvaluationContext) : Promise<void> {\n        return this.evaluator.evaluateOneOf(this.extendContext(ctx));\n    }\n\n    // --------------------------------------------------------------\n\n    protected extendContext(ctx: PermissionEvaluationContext) {\n        const scopes = useRequestScopes(this.event);\n        if (scopes.includes(ScopeName.GLOBAL)) {\n            ctx.input = ctx.input || new PolicyData();\n            ctx.input.set(BuiltInPolicyType.IDENTITY, useRequestIdentity(this.event));\n        }\n\n        return ctx;\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAaK,6BAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYD,OAAkBC,WAAiC;EAC3D,KAAKD,QAAQA;EACb,KAAKC,YAAYA;CACrB;CAIA,MAAMC,SAASC,KAAkD;EAC7D,OAAO,KAAKF,UAAUC,SAAS,KAAKE,cAAcD,GAAAA,CAAAA;CACtD;CAEA,MAAME,YAAYF,KAAkD;EAChE,OAAO,KAAKF,UAAUI,YAAY,KAAKD,cAAcD,GAAAA,CAAAA;CACzD;CAIA,MAAMG,iBAAiBH,KAAkD;EACrE,OAAO,KAAKF,UAAUK,iBAAiB,KAAKF,cAAcD,GAAAA,CAAAA;CAC9D;CAEA,MAAMI,cAAcJ,KAAkD;EAClE,OAAO,KAAKF,UAAUM,cAAc,KAAKH,cAAcD,GAAAA,CAAAA;CAC3D;CAIUC,cAAcD,KAAkC;EAEtD,IADeL,iBAAiB,KAAKE,KACjCQ,CAAAA,CAAOC,SAASf,UAAUgB,MAAM,GAAG;GACnCP,IAAIQ,QAAQR,IAAIQ,SAAS,IAAIf,WAAAA;GAC7BO,IAAIQ,MAAMC,IAAIjB,kBAAkBkB,UAAUhB,mBAAmB,KAAKG,KAAK,CAAA;EAC3E;EAEA,OAAOG;CACX;AACJ"}

package/dist/adapters/http/ui/base-path.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Rewrite root-absolute /public/ asset references (script/link/preload tags
+ * emitted with the fixed vite base) so they carry the path prefix under which
+ * authup is publicly served (e.g. /auth/public/...). The reverse proxy is
+ * expected to strip the prefix before the request reaches authup, so the
+ * assets middleware keeps serving at /public.
+ */
+export declare function rebasePublicAssetURLs(html: string, basePath: string): string;
+//# sourceMappingURL=base-path.d.ts.map

package/dist/adapters/http/ui/base-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-path.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/base-path.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,MAAM,CAM7E"}

package/dist/adapters/http/ui/base-path.mjs

@@ -0,0 +1,18 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/ui/base-path.ts
+/**
+* Rewrite root-absolute /public/ asset references (script/link/preload tags
+* emitted with the fixed vite base) so they carry the path prefix under which
+* authup is publicly served (e.g. /auth/public/...). The reverse proxy is
+* expected to strip the prefix before the request reaches authup, so the
+* assets middleware keeps serving at /public.
+*/ function rebasePublicAssetURLs(html, basePath) {
+	if (!basePath) return html;
+	return html.replace(/(src|href)="\/public\//g, `$1="${basePath}/public/`);
+}
+//#endregion
+export { rebasePublicAssetURLs };
+
+//# sourceMappingURL=base-path.mjs.map

package/dist/adapters/http/ui/base-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-path.mjs","names":["rebasePublicAssetURLs","html","basePath","replace"],"sources":["../../../../src/adapters/http/ui/base-path.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Rewrite root-absolute /public/ asset references (script/link/preload tags\n * emitted with the fixed vite base) so they carry the path prefix under which\n * authup is publicly served (e.g. /auth/public/...). The reverse proxy is\n * expected to strip the prefix before the request reaches authup, so the\n * assets middleware keeps serving at /public.\n */\nexport function rebasePublicAssetURLs(html: string, basePath: string) : string {\n    if (!basePath) {\n        return html;\n    }\n\n    return html.replace(/(src|href)=\"\\/public\\//g, `$1=\"${basePath}/public/`);\n}\n"],"mappings":";;;;;;;;;;GAcA,SAAgBA,sBAAsBC,MAAcC,UAAgB;CAChE,IAAI,CAACA,UACD,OAAOD;CAGX,OAAOA,KAAKE,QAAQ,2BAA2B,OAAOD,SAAS,SAAS;AAC5E"}

package/dist/adapters/http/ui/index.d.ts

@@ -0,0 +1,5 @@
+export * from './base-path.ts';
+export * from './render.ts';
+export * from './serve.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/index.mjs

@@ -0,0 +1,7 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { rebasePublicAssetURLs } from "./base-path.mjs";
+import { renderUIPage } from "./render.mjs";
+import { serveWorkflowPage } from "./serve.mjs";
+export { rebasePublicAssetURLs, renderUIPage, serveWorkflowPage };

package/dist/adapters/http/ui/render.d.ts

@@ -0,0 +1,4 @@
+import type { IAppEvent } from 'routup';
+import type { UIRenderContext } from './types.ts';
+export declare function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string>;
+//# sourceMappingURL=render.d.ts.map

package/dist/adapters/http/ui/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAwE1F"}

package/dist/adapters/http/ui/render.mjs

@@ -0,0 +1,60 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
+import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
+import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
+import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
+import "../middleware/index.mjs";
+import { rebasePublicAssetURLs } from "./base-path.mjs";
+import { getURLBasePath } from "@authup/kit";
+import path from "node:path";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
+import { useRequestCookie } from "@routup/basic/cookie";
+import { load } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/render.ts
+const COLOR_MODE_COOKIE = "vc-color-mode";
+let cachedHtml;
+let cachedManifest;
+let cachedRender;
+async function renderUIPage(event, ctx) {
+	const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);
+	const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);
+	ctx.payload.config.colorMode = colorMode;
+	const locale = useRequestCookie(event, LOCALE_COOKIE);
+	ctx.payload.config.locale = locale;
+	let html;
+	let manifest;
+	let render;
+	if (isJIT) {
+		const vite = event.store[VITE_SERVER_STORE_KEY];
+		html = await fs.promises.readFile(path.join(UI_SOURCE_PATH, "index.html"), "utf-8");
+		html = await vite.transformIndexHtml("/", html);
+		manifest = {};
+		render = (await vite.ssrLoadModule("/src/server.ts")).render;
+	} else {
+		html = cachedHtml ??= await fs.promises.readFile(path.join(UI_DIST_PATH, "client", "index.html"), "utf-8");
+		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(UI_DIST_PATH, "client", ".vite", "ssr-manifest.json"), "utf-8"));
+		render = cachedRender ??= (await load(path.join(UI_DIST_PATH, "server", "server.js"))).render;
+	}
+	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
+	const [appHtml, preloadLinks] = await render({
+		url: ctx.url,
+		manifest,
+		payload: ctx.payload,
+		httpClient: httpClientFactory ? httpClientFactory() : void 0
+	});
+	let body = html.replace("<!--preload-links-->", preloadLinks).replace("<!--app-html-->", appHtml);
+	let htmlAttrs = "lang=\"en\"";
+	if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) htmlAttrs = `lang="${locale}"`;
+	if (colorMode === "dark" || colorMode === "light") htmlAttrs += ` class="${colorMode}"`;
+	body = body.replace(/<html\b[^>]*>/i, `<html ${htmlAttrs}>`);
+	body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));
+	event.response.headers.set("content-type", "text/html; charset=utf-8");
+	return body;
+}
+//#endregion
+export { renderUIPage };
+
+//# sourceMappingURL=render.mjs.map

package/dist/adapters/http/ui/render.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","load","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { load } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await load(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAC3C,OAAOP;AACX"}

package/dist/adapters/http/ui/serve.d.ts

@@ -0,0 +1,16 @@
+import type { StatusResponseFeatures } from '@authup/core-http-kit';
+import type { IAppEvent } from 'routup';
+export type ServeWorkflowPageOptions = {
+    url: string;
+    baseURL: string;
+    features: StatusResponseFeatures;
+    realmAware?: boolean;
+    tokenAware?: boolean;
+};
+/**
+ * Single SSR payload-assembly path for the auth workflow GET routes:
+ * whitelists query params, applies the open-redirect guard, and renders.
+ * Keeps the four workflow controllers as thin POST adapters.
+ */
+export declare function serveWorkflowPage(event: IAppEvent, options: ServeWorkflowPageOptions): Promise<string>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/adapters/http/ui/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/dist/adapters/http/ui/serve.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sanitizeRelativeRedirect } from "../request/helpers/redirect.mjs";
+import "../request/index.mjs";
+import { renderUIPage } from "./render.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+//#region src/adapters/http/ui/serve.ts
+/**
+* Single SSR payload-assembly path for the auth workflow GET routes:
+* whitelists query params, applies the open-redirect guard, and renders.
+* Keeps the four workflow controllers as thin POST adapters.
+*/ function serveWorkflowPage(event, options) {
+	const query = useRequestQuery(event);
+	const data = {
+		features: options.features,
+		redirect: sanitizeRelativeRedirect(query.redirect)
+	};
+	if (options.realmAware) data.realmId = typeof query.realm_id === "string" ? query.realm_id : void 0;
+	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
+	return renderUIPage(event, {
+		url: options.url,
+		payload: {
+			config: { baseURL: options.baseURL },
+			data
+		}
+	});
+}
+//#endregion
+export { serveWorkflowPage };
+
+//# sourceMappingURL=serve.mjs.map

package/dist/adapters/http/ui/serve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realm_id` / `token` query params (e.g.\n    // prefill from an email deep link). Off by default so a page never\n    // reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        data.realmId = typeof query.realm_id === 'string' ? query.realm_id : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YACRH,KAAKI,UAAU,OAAOL,MAAMM,aAAa,WAAWN,MAAMM,WAAWC,KAAAA;CAGzE,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/adapters/http/ui/types.d.ts

@@ -0,0 +1,8 @@
+export type UIRenderContext = {
+    url: string;
+    payload: {
+        config: Record<string, any>;
+        data: Record<string, any>;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC7B,CAAC;CACL,CAAC"}

package/dist/adapters/http/ui/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/adapters/shared/ldap/factory.d.ts

@@ -0,0 +1,6 @@
+import type { ILdapClient, ILdapClientFactory } from '../../../core/index.ts';
+import type { LdapClientOptions } from './types.ts';
+export declare class LdapClientFactory implements ILdapClientFactory {
+    create(options: LdapClientOptions): ILdapClient;
+}
+//# sourceMappingURL=factory.d.ts.map

package/dist/adapters/shared/ldap/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../src/adapters/shared/ldap/factory.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,qBAAa,iBAAkB,YAAW,kBAAkB;IACxD,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW;CAGlD"}

package/dist/adapters/shared/ldap/factory.mjs

@@ -0,0 +1,14 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LdapClient } from "./module.mjs";
+//#region src/adapters/shared/ldap/factory.ts
+var LdapClientFactory = class {
+	create(options) {
+		return new LdapClient(options);
+	}
+};
+//#endregion
+export { LdapClientFactory };
+
+//# sourceMappingURL=factory.mjs.map

package/dist/adapters/shared/ldap/factory.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.mjs","names":["LdapClient","LdapClientFactory","create","options"],"sources":["../../../../src/adapters/shared/ldap/factory.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ILdapClient, ILdapClientFactory } from '../../../core/index.ts';\nimport { LdapClient } from './module.ts';\nimport type { LdapClientOptions } from './types.ts';\n\nexport class LdapClientFactory implements ILdapClientFactory {\n    create(options: LdapClientOptions): ILdapClient {\n        return new LdapClient(options);\n    }\n}\n"],"mappings":";;;;;AAWA,IAAaC,oBAAb,MAAaA;CACTC,OAAOC,SAAyC;EAC5C,OAAO,IAAIH,WAAWG,OAAAA;CAC1B;AACJ"}

package/dist/adapters/shared/ldap/index.d.ts

@@ -0,0 +1,4 @@
+export * from './factory.ts';
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map