@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/server-core",
     "type": "module",
-    "version": "1.0.0-beta.57",
+    "version": "1.0.0-beta.59",
     "description": "This is a standalone application.",
     "license": "AGPL-3.0-only",
     "main": "dist/index.mjs",
@@ -15,14 +15,11 @@
         "cli-dev": "npm run build:server && npm run cli",
         "cli-dev-src": "nodemon --watch src --exec \"npm run build:server && node dist/cli/index.mjs\"",
         "cli-dev-dist": "nodemon --watch dist --exec \"node dist/cli/index.mjs\"",
-        "build:ui:client": "vite build --config ui/vite.config.ts --ssrManifest .vite/ssr-manifest.json --outDir ../dist/ui/client ui",
-        "build:ui:server": "vite build --config ui/vite.config.ts --ssr src/server.ts --outDir ../dist/ui/server ui",
-        "build:ui": "npm run build:ui:server && npm run build:ui:client",
         "build:server:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
         "build:server:js": "tsdown",
         "build:server": "npm run build:server:js && npm run build:server:types && npm run build:swagger",
         "build:swagger": "trapi generate",
-        "build": "rimraf ./dist && npm run build:server && npm run build:ui",
+        "build": "rimraf ./dist && npm run build:server",
         "test": "cross-env NODE_ENV=test vitest run --config test/vitest.config.ts",
         "test:mysql": "cross-env DB_TYPE=mysql DB_HOST=127.0.0.1 DB_USERNAME=root DB_PASSWORD=start123 DB_DATABASE=app vitest run --config test/vitest.config.ts",
         "test:psql": "cross-env DB_TYPE=postgres DB_HOST=127.0.0.1 DB_USERNAME=postgres DB_PASSWORD=start123 DB_DATABASE=app vitest run --config test/vitest.config.ts",
@@ -68,22 +65,24 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/access": "^1.0.0-beta.57",
-        "@authup/core-http-kit": "^1.0.0-beta.57",
-        "@authup/core-kit": "^1.0.0-beta.57",
-        "@authup/errors": "^1.0.0-beta.57",
-        "@authup/i18n": "^1.0.0-beta.57",
-        "@authup/kit": "^1.0.0-beta.57",
-        "@authup/server-kit": "^1.0.0-beta.57",
-        "@authup/specs": "^1.0.0-beta.57",
+        "@authup/access": "^1.0.0-beta.59",
+        "@authup/client-account-console": "^1.0.0-beta.59",
+        "@authup/client-auth-console": "^1.0.0-beta.59",
+        "@authup/core-http-kit": "^1.0.0-beta.59",
+        "@authup/core-kit": "^1.0.0-beta.59",
+        "@authup/errors": "^1.0.0-beta.59",
+        "@authup/i18n": "^1.0.0-beta.59",
+        "@authup/kit": "^1.0.0-beta.59",
+        "@authup/server-kit": "^1.0.0-beta.59",
+        "@authup/specs": "^1.0.0-beta.59",
         "@ebec/http": "^4.2.0",
         "@hapic/oauth2": "^4.0.1",
         "@peculiar/x509": "^2.0.0",
-        "@rapiq/adapter-memory": "^2.0.0-beta.13",
-        "@rapiq/adapter-sql": "^2.0.0-beta.13",
-        "@rapiq/adapter-typeorm": "^2.0.0-beta.13",
-        "@rapiq/codec-url": "^2.0.0-beta.13",
-        "@rapiq/core": "^2.0.0-beta.13",
+        "@rapiq/adapter-memory": "^2.0.0-beta.15",
+        "@rapiq/adapter-sql": "^2.0.0-beta.15",
+        "@rapiq/adapter-typeorm": "^2.0.0-beta.15",
+        "@rapiq/codec-url": "^2.0.0-beta.15",
+        "@rapiq/core": "^2.0.0-beta.15",
         "@routup/assets": "^5.0.0",
         "@routup/basic": "^3.0.0",
         "@routup/cors": "^2.0.0",
@@ -93,17 +92,17 @@
         "@routup/rate-limit": "^4.0.0",
         "@routup/swagger-ui": "^4.0.0",
         "@simplewebauthn/server": "^13.3.2",
-        "@validup/zod": "^0.3.3",
-        "better-sqlite3": "^13.0.1",
+        "@validup/zod": "^1.0.0",
+        "better-sqlite3": "^13.0.2",
         "change-case": "^5.4.4",
         "citty": "^0.2.2",
-        "confinity": "^2.0.0",
+        "confinity": "^2.0.1",
         "dotenv": "^17.4.1",
         "dycraft": "^1.1.0",
-        "eldin": "^1.2.0",
+        "eldin": "^1.3.0",
         "envix": "^1.5.0",
         "hapic": "^3.0.1",
-        "ilingo": "^6.0.0",
+        "ilingo": "^6.1.0",
         "ldapjs": "^3.0.7",
         "locter": "^4.0.0",
         "mysql2": "^3.23.2",
@@ -121,61 +120,25 @@
         "typeorm": "1.1.0",
         "typeorm-extension": "^4.0.0-beta.1",
         "uncrypto": "^0.1.3",
-        "validup": "^0.5.1",
+        "validup": "^1.0.0",
         "zod": "^4.4.3"
     },
     "devDependencies": {
-        "@authup/client-web-kit": "^1.0.0-beta.57",
-        "@authup/client-web-kit-theme": "^1.0.0-beta.57",
-        "@authup/client-web-theme": "^1.0.0-beta.57",
-        "@authup/server-test-kit": "^1.0.0-beta.57",
+        "@authup/server-test-kit": "^1.0.0-beta.59",
         "@faker-js/faker": "^10.5.0",
-        "@fontsource/asap": "^5.3.0",
-        "@fontsource/nunito": "^5.3.0",
-        "@iconify-json/fa6-brands": "^1.2.0",
-        "@iconify-json/fa6-solid": "^1.2.0",
-        "@iconify/vue": "^5.0.0",
-        "@ilingo/validup": "^1.0.1",
-        "@ilingo/validup-vue": "^1.0.1",
-        "@ilingo/vue": "^6.0.0",
-        "@tailwindcss/vite": "^4.3.3",
-        "@trapi/cli": "^2.0.3",
+        "@trapi/cli": "^2.0.4",
         "@types/ldapjs": "^3.0.6",
         "@types/nodemailer": "^8.0.0",
         "@types/qrcode": "^1.5.6",
         "@types/supertest": "^7.2.1",
-        "@validup/vue": "^0.3.3",
-        "@vitejs/plugin-vue": "^6.0.8",
-        "@vuecs/button": "^1.4.0",
-        "@vuecs/core": "^3.5.0",
-        "@vuecs/countdown": "^2.1.0",
-        "@vuecs/design": "^1.1.0",
-        "@vuecs/elements": "^1.5.0",
-        "@vuecs/forms": "^5.4.0",
-        "@vuecs/icon": "^1.1.0",
-        "@vuecs/icons-font-awesome": "^1.3.0",
-        "@vuecs/link": "^2.1.0",
-        "@vuecs/list": "^1.2.0",
-        "@vuecs/locale": "^1.1.0",
-        "@vuecs/navigation": "^4.4.0",
-        "@vuecs/overlays": "^1.3.0",
-        "@vuecs/pagination": "^2.2.0",
-        "@vuecs/placeholder": "^1.1.0",
-        "@vuecs/table": "^1.6.0",
-        "@vuecs/theme-tailwind": "^6.4.0",
-        "@vuecs/timeago": "^2.2.0",
         "jest-serial-runner": "^1.2.1",
         "nodemon": "^3.1.14",
-        "pinia": "^3.0.0",
         "supertest": "^7.2.2",
-        "tailwindcss": "^4.3.1",
         "testcontainers": "^12.0.4",
         "ts-node": "^10.8.2",
         "unplugin-swc": "^1.5.9",
         "vite": "^8.1.3",
-        "vitest": "^4.0.14",
-        "vue": "^3.5.40",
-        "vue-router": "^5.0.7"
+        "vitest": "^4.0.14"
     },
     "publishConfig": {
         "access": "public"

package/dist/adapters/http/ui/base-path.d.ts

@@ -1,9 +0,0 @@
-/**
- * Rewrite root-absolute /public/ asset references (script/link/preload tags
- * emitted with the fixed vite base) so they carry the path prefix under which
- * authup is publicly served (e.g. /auth/public/...). The reverse proxy is
- * expected to strip the prefix before the request reaches authup, so the
- * assets middleware keeps serving at /public.
- */
-export declare function rebasePublicAssetURLs(html: string, basePath: string): string;
-//# sourceMappingURL=base-path.d.ts.map

package/dist/adapters/http/ui/base-path.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-path.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/base-path.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,MAAM,CAM7E"}

package/dist/adapters/http/ui/base-path.mjs

@@ -1,18 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-//#region src/adapters/http/ui/base-path.ts
-/**
-* Rewrite root-absolute /public/ asset references (script/link/preload tags
-* emitted with the fixed vite base) so they carry the path prefix under which
-* authup is publicly served (e.g. /auth/public/...). The reverse proxy is
-* expected to strip the prefix before the request reaches authup, so the
-* assets middleware keeps serving at /public.
-*/ function rebasePublicAssetURLs(html, basePath) {
-	if (!basePath) return html;
-	return html.replace(/(src|href)="\/public\//g, `$1="${basePath}/public/`);
-}
-//#endregion
-export { rebasePublicAssetURLs };
-
-//# sourceMappingURL=base-path.mjs.map

package/dist/adapters/http/ui/base-path.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-path.mjs","names":["rebasePublicAssetURLs","html","basePath","replace"],"sources":["../../../../src/adapters/http/ui/base-path.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Rewrite root-absolute /public/ asset references (script/link/preload tags\n * emitted with the fixed vite base) so they carry the path prefix under which\n * authup is publicly served (e.g. /auth/public/...). The reverse proxy is\n * expected to strip the prefix before the request reaches authup, so the\n * assets middleware keeps serving at /public.\n */\nexport function rebasePublicAssetURLs(html: string, basePath: string) : string {\n    if (!basePath) {\n        return html;\n    }\n\n    return html.replace(/(src|href)=\"\\/public\\//g, `$1=\"${basePath}/public/`);\n}\n"],"mappings":";;;;;;;;;;GAcA,SAAgBA,sBAAsBC,MAAcC,UAAgB;CAChE,IAAI,CAACA,UACD,OAAOD;CAGX,OAAOA,KAAKE,QAAQ,2BAA2B,OAAOD,SAAS,SAAS;AAC5E"}

package/dist/adapters/http/ui/internal-http-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"internal-http-client.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GACnB,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAmC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAOrF"}

package/dist/adapters/http/ui/internal-http-client.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"internal-http-client.mjs","names":["Client","FetchTransport","fetch","createPublicToInternalURLRewriter","publicURL","internalURL","publicParsed","URL","internalParsed","hostname","basePath","pathname","replace","url","parsed","origin","startsWith","substring","length","search","href","createInternalUIHttpClient","ctx","rewriteURL","baseURL","transport","input","init"],"sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport type { IClient } from '@authup/core-http-kit';\nimport { FetchTransport, fetch } from 'hapic';\nimport type { InternalUIHttpClientContext } from './types.ts';\n\n/**\n * Build a rewriter that maps URLs under the public base URL\n * (scheme://host[/prefix]) onto the server's own listen address. URLs\n * outside the public origin/prefix pass through untouched.\n */\nexport function createPublicToInternalURLRewriter(\n    publicURL: string,\n    internalURL: string,\n) : (url: string) => string {\n    const publicParsed = new URL(publicURL);\n    const internalParsed = new URL(internalURL);\n    // a wildcard listen address (0.0.0.0 / [::]) is not reliably dialable —\n    // loop back explicitly\n    if (internalParsed.hostname === '0.0.0.0' || internalParsed.hostname === '[::]') {\n        internalParsed.hostname = '127.0.0.1';\n    }\n    const basePath = publicParsed.pathname.replace(/\\/+$/, '');\n\n    return (url: string) => {\n        let parsed : URL;\n        try {\n            parsed = new URL(url);\n        } catch {\n            return url;\n        }\n\n        if (parsed.origin !== publicParsed.origin) {\n            return url;\n        }\n\n        let { pathname } = parsed;\n        if (basePath) {\n            if (pathname === basePath) {\n                pathname = '/';\n            } else if (pathname.startsWith(`${basePath}/`)) {\n                pathname = pathname.substring(basePath.length);\n            } else {\n                return url;\n            }\n        }\n\n        return new URL(pathname + parsed.search, internalParsed.origin).href;\n    };\n}\n\n/**\n * HTTP client for the SSR'd UI pages: the render's API calls target the\n * server itself, so they are dispatched against its own listen address —\n * no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate\n * would otherwise fail Node's fetch), no dependency on the public hostname\n * resolving from inside the deployment.\n *\n * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the\n * public URL because the rendered HTML derives user-facing URLs from it\n * (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and\n * hydration does not patch attribute mismatches.\n */\nexport function createInternalUIHttpClient(ctx: InternalUIHttpClientContext) : IClient {\n    const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);\n\n    return new Client({\n        baseURL: ctx.publicURL,\n        transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) }),\n    });\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBG,kCACZC,WACAC,aAAmB;CAEnB,MAAMC,eAAe,IAAIC,IAAIH,SAAAA;CAC7B,MAAMI,iBAAiB,IAAID,IAAIF,WAAAA;CAG/B,IAAIG,eAAeC,aAAa,aAAaD,eAAeC,aAAa,QACrED,eAAeC,WAAW;CAE9B,MAAMC,WAAWJ,aAAaK,SAASC,QAAQ,QAAQ,EAAA;CAEvD,QAAQC,QAAAA;EACJ,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIP,IAAIM,GAAAA;EACrB,QAAQ;GACJ,OAAOA;EACX;EAEA,IAAIC,OAAOC,WAAWT,aAAaS,QAC/B,OAAOF;EAGX,IAAI,EAAEF,aAAaG;EACnB,IAAIJ,UACA,IAAIC,aAAaD,UACbC,WAAW;OACR,IAAIA,SAASK,WAAW,GAAGN,SAAS,EAAE,GACzCC,WAAWA,SAASM,UAAUP,SAASQ,MAAM;OAE7C,OAAOL;EAIf,OAAO,IAAIN,IAAII,WAAWG,OAAOK,QAAQX,eAAeO,MAAM,CAAA,CAAEK;CACpE;AACJ;;;;;;;;;;;;GAcA,SAAgBC,2BAA2BC,KAAgC;CACvE,MAAMC,aAAapB,kCAAkCmB,IAAIlB,WAAWkB,IAAIjB,WAAW;CAEnF,OAAO,IAAIL,OAAO;EACdwB,SAASF,IAAIlB;EACbqB,WAAW,IAAIxB,eAAe,EAAEC,QAAQwB,OAAOC,SAASzB,MAAMqB,WAAWG,KAAAA,GAAQC,IAAAA,EAAM,CAAA;CAC3F,CAAA;AACJ"}

package/dist/adapters/http/ui/render.d.ts

@@ -1,4 +0,0 @@
-import type { IAppEvent } from 'routup';
-import type { UIRenderContext } from './types.ts';
-export declare function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string>;
-//# sourceMappingURL=render.d.ts.map

package/dist/adapters/http/ui/render.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAqF1F"}

package/dist/adapters/http/ui/render.mjs

@@ -1,63 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
-import { rebasePublicAssetURLs } from "./base-path.mjs";
-import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
-import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
-import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
-import "../middleware/index.mjs";
-import { getURLBasePath } from "@authup/kit";
-import path from "node:path";
-import { useRequestCookie } from "@routup/basic/cookie";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
-import { read } from "locter";
-import fs from "node:fs";
-//#region src/adapters/http/ui/render.ts
-const COLOR_MODE_COOKIE = "vc-color-mode";
-let cachedHtml;
-let cachedManifest;
-let cachedRender;
-async function renderUIPage(event, ctx) {
-	const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);
-	const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);
-	ctx.payload.config.colorMode = colorMode;
-	const locale = useRequestCookie(event, LOCALE_COOKIE);
-	ctx.payload.config.locale = locale;
-	let html;
-	let manifest;
-	let render;
-	if (isJIT) {
-		const vite = event.store[VITE_SERVER_STORE_KEY];
-		html = await fs.promises.readFile(path.join(UI_SOURCE_PATH, "index.html"), "utf-8");
-		html = await vite.transformIndexHtml("/", html);
-		manifest = {};
-		render = (await vite.ssrLoadModule("/src/server.ts")).render;
-	} else {
-		html = cachedHtml ??= await fs.promises.readFile(path.join(UI_DIST_PATH, "client", "index.html"), "utf-8");
-		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(UI_DIST_PATH, "client", ".vite", "ssr-manifest.json"), "utf-8"));
-		render = cachedRender ??= (await read(path.join(UI_DIST_PATH, "server", "server.js"))).render;
-	}
-	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
-	const [appHtml, preloadLinks] = await render({
-		url: ctx.url,
-		manifest,
-		payload: ctx.payload,
-		httpClient: httpClientFactory ? httpClientFactory() : void 0
-	});
-	let body = html.replace("<!--preload-links-->", preloadLinks).replace("<!--app-html-->", appHtml);
-	let htmlAttrs = "lang=\"en\"";
-	if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) htmlAttrs = `lang="${locale}"`;
-	if (colorMode === "dark" || colorMode === "light") htmlAttrs += ` class="${colorMode}"`;
-	body = body.replace(/<html\b[^>]*>/i, `<html ${htmlAttrs}>`);
-	body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));
-	event.response.headers.set("content-type", "text/html; charset=utf-8");
-	event.response.headers.set("content-security-policy", "frame-ancestors 'none'");
-	event.response.headers.set("x-frame-options", "DENY");
-	event.response.headers.set("referrer-policy", "no-referrer");
-	return body;
-}
-//#endregion
-export { renderUIPage };
-
-//# sourceMappingURL=render.mjs.map

package/dist/adapters/http/ui/render.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","read","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await read(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n    // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n    // logout) mutate state behind explicit clicks and hydrate the logged-in\n    // session from first-party cookies. Framing them would make click-gating\n    // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n    // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n\n    // The auth pages' URLs routinely carry sensitive query params\n    // (id_token_hint, code, redirect, state) — never leak them via Referer.\n    event.response.headers.set('referrer-policy', 'no-referrer');\n\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}

package/dist/adapters/http/ui/serve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/adapters/http/ui/serve.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YAAY;EACpB,MAAMC,UAAU,OAAOL,MAAMK,YAAY,WAAWL,MAAMK,UAAUL,MAAMM;EAC1EL,KAAKI,UAAU,OAAOA,YAAY,WAAWA,UAAUE,KAAAA;CAC3D;CAEA,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/adapters/http/ui/types.d.ts

@@ -1,20 +0,0 @@
-export type UIRenderContext = {
-    url: string;
-    payload: {
-        config: Record<string, any>;
-        data: Record<string, any>;
-    };
-};
-export type InternalUIHttpClientContext = {
-    /**
-     * The public base URL (config `publicUrl`) — stays the client's
-     * `baseURL` so URLs rendered into the HTML remain user-facing.
-     */
-    publicURL: string;
-    /**
-     * The server's own listen address (e.g. http://localhost:3010/) —
-     * where the transport actually dispatches requests.
-     */
-    internalURL: string;
-};
-//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/core/entities/client/web-client.d.ts

@@ -1,72 +0,0 @@
-import type { Client, Realm } from '@authup/core-kit';
-import type { Logger } from '@authup/server-kit';
-import type { IClientScopeRepository } from '../client-scope/types.ts';
-import type { IScopeRepository } from '../scope/types.ts';
-import type { IClientRepository, IWebClientProvisioner } from './types.ts';
-export type WebClientProvisionerContext = {
-    clientRepository: IClientRepository;
-    scopeRepository: IScopeRepository;
-    clientScopeRepository: IClientScopeRepository;
-    appOrigins: string[];
-    logger?: Logger;
-};
-/**
- * The scopes a realm's public `web` client is granted.
- *
- * `global` lets the issued token drive the management API (parity with the
- * legacy password-grant admin login); `openid` yields the id-token.
- */
-export declare const WEB_CLIENT_SCOPE_NAMES: string[];
-/**
- * Build the attribute set for a realm's public `web` client.
- *
- * Public (PKCE) client used by authup's own client-web and any downstream
- * UI embedding client-web-kit. `builtIn` makes it auto-consent in the
- * /authorize flow and protects it from the API reserved-name guard.
- *
- * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
- * /token grants and the /authorize code-request verifier; null = allow-all),
- * so it must list every flow the client uses. `redirectUri` and
- * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
- * origin (matched by isSimpleMatch).
- *
- * The `scope` column is descriptive only. Scope authorization resolves
- * through the `auth_client_scopes` junction, which
- * `WebClientProvisioner.ensureForRealm` fills from
- * {@see WEB_CLIENT_SCOPE_NAMES}.
- */
-export declare function buildWebClientAttributes(realm: Realm | {
-    id: string;
-}, appOrigins: string[]): Partial<Client>;
-export declare class WebClientProvisioner implements IWebClientProvisioner {
-    protected clientRepository: IClientRepository;
-    protected scopeRepository: IScopeRepository;
-    protected clientScopeRepository: IClientScopeRepository;
-    protected appOrigins: string[];
-    protected logger?: Logger;
-    constructor(ctx: WebClientProvisionerContext);
-    ensureForRealm(realm: Realm | {
-        id: string;
-    }): Promise<void>;
-    /**
-     * Upsert the client row itself.
-     *
-     * `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row
-     * belongs to the system whatever state it is in. A non-built-in one
-     * predates the reservation and is taken over rather than left to shadow
-     * the realm's login client.
-     */
-    protected ensureClient(realm: Realm | {
-        id: string;
-    }): Promise<Client>;
-    /**
-     * Bind the built-in global scopes through `auth_client_scopes`. That
-     * junction is the only source the /authorize code-request verifier reads
-     * scopes from.
-     *
-     * Additive like the attribute MERGE above: an extra scope an admin bound
-     * by hand is left in place.
-     */
-    protected ensureScopes(client: Client): Promise<void>;
-}
-//# sourceMappingURL=web-client.d.ts.map

package/dist/core/entities/client/web-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"web-client.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/web-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,EAAE,sBAAsB,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAG1C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,KAAK,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7B,UAAU,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qBAAa,oBAAqB,YAAW,qBAAqB;IAC9D,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;IAExD,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE/B,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,2BAA2B;IAQtC,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASlE;;;;;;;OAOG;cACa,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAsD5E;;;;;;;OAOG;cACa,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiC9D"}

package/dist/core/entities/client/web-client.mjs

@@ -1,123 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { CLIENT_WEB_NAME, ClientAuthMethod, ClientTokenBindingMethod, ScopeName } from "@authup/core-kit";
-//#region src/core/entities/client/web-client.ts
-/**
-* The scopes a realm's public `web` client is granted.
-*
-* `global` lets the issued token drive the management API (parity with the
-* legacy password-grant admin login); `openid` yields the id-token.
-*/ const WEB_CLIENT_SCOPE_NAMES = [ScopeName.GLOBAL, ScopeName.OPEN_ID];
-/**
-* Build the attribute set for a realm's public `web` client.
-*
-* Public (PKCE) client used by authup's own client-web and any downstream
-* UI embedding client-web-kit. `builtIn` makes it auto-consent in the
-* /authorize flow and protects it from the API reserved-name guard.
-*
-* `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the
-* /token grants and the /authorize code-request verifier; null = allow-all),
-* so it must list every flow the client uses. `redirectUri` and
-* `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted
-* origin (matched by isSimpleMatch).
-*
-* The `scope` column is descriptive only. Scope authorization resolves
-* through the `auth_client_scopes` junction, which
-* `WebClientProvisioner.ensureForRealm` fills from
-* {@see WEB_CLIENT_SCOPE_NAMES}.
-*/ function buildWebClientAttributes(realm, appOrigins) {
-	const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(",");
-	return {
-		name: CLIENT_WEB_NAME,
-		realmId: realm.id,
-		authMethod: ClientAuthMethod.NONE,
-		tokenBindingMethod: ClientTokenBindingMethod.NONE,
-		builtIn: true,
-		active: true,
-		grantTypes: "authorization_code refresh_token",
-		scope: WEB_CLIENT_SCOPE_NAMES.join(" "),
-		redirectUri: originPatterns,
-		postLogoutRedirectUri: originPatterns
-	};
-}
-var WebClientProvisioner = class {
-	clientRepository;
-	scopeRepository;
-	clientScopeRepository;
-	appOrigins;
-	logger;
-	constructor(ctx) {
-		this.clientRepository = ctx.clientRepository;
-		this.scopeRepository = ctx.scopeRepository;
-		this.clientScopeRepository = ctx.clientScopeRepository;
-		this.appOrigins = ctx.appOrigins;
-		this.logger = ctx.logger;
-	}
-	async ensureForRealm(realm) {
-		const client = await this.ensureClient(realm);
-		await this.ensureScopes(client);
-	}
-	/**
-	* Upsert the client row itself.
-	*
-	* `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row
-	* belongs to the system whatever state it is in. A non-built-in one
-	* predates the reservation and is taken over rather than left to shadow
-	* the realm's login client.
-	*/ async ensureClient(realm) {
-		const attributes = buildWebClientAttributes(realm, this.appOrigins);
-		const existing = await this.clientRepository.findOneBy({
-			name: CLIENT_WEB_NAME,
-			realmId: realm.id
-		});
-		if (existing) {
-			if (!Object.keys(attributes).some((key) => existing[key] !== attributes[key])) return existing;
-			let target = existing;
-			if (!existing.builtIn) {
-				if (this.logger) this.logger.warn(`Taking over the non-built-in client named '${CLIENT_WEB_NAME}' in realm ${realm.id}: the name is reserved for the built-in web client.`);
-				target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;
-				target.secret = null;
-				target.secretHashed = false;
-				target.secretEncrypted = false;
-			}
-			const merged = this.clientRepository.merge(target, attributes);
-			return this.clientRepository.save(merged);
-		}
-		const entity = this.clientRepository.create(attributes);
-		return this.clientRepository.save(entity);
-	}
-	/**
-	* Bind the built-in global scopes through `auth_client_scopes`. That
-	* junction is the only source the /authorize code-request verifier reads
-	* scopes from.
-	*
-	* Additive like the attribute MERGE above: an extra scope an admin bound
-	* by hand is left in place.
-	*/ async ensureScopes(client) {
-		for (const name of WEB_CLIENT_SCOPE_NAMES) {
-			const scope = await this.scopeRepository.findOneBy({
-				name,
-				realmId: null
-			});
-			if (!scope) {
-				if (this.logger) this.logger.warn(`Skipping scope '${name}' for the web client of realm ${client.realmId}: the scope is not provisioned.`);
-				continue;
-			}
-			if (await this.clientScopeRepository.findOneBy({
-				clientId: client.id,
-				scopeId: scope.id
-			})) continue;
-			await this.clientScopeRepository.save(this.clientScopeRepository.create({
-				clientId: client.id,
-				clientRealmId: client.realmId,
-				scopeId: scope.id,
-				scopeRealmId: scope.realmId
-			}));
-		}
-	}
-};
-//#endregion
-export { WEB_CLIENT_SCOPE_NAMES, WebClientProvisioner, buildWebClientAttributes };
-
-//# sourceMappingURL=web-client.mjs.map

package/dist/core/entities/client/web-client.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"web-client.mjs","names":["CLIENT_WEB_NAME","ClientAuthMethod","ClientTokenBindingMethod","ScopeName","WEB_CLIENT_SCOPE_NAMES","GLOBAL","OPEN_ID","buildWebClientAttributes","realm","appOrigins","originPatterns","map","origin","join","name","realmId","id","authMethod","NONE","tokenBindingMethod","builtIn","active","grantTypes","scope","redirectUri","postLogoutRedirectUri","WebClientProvisioner","clientRepository","scopeRepository","clientScopeRepository","logger","ctx","ensureForRealm","client","ensureClient","ensureScopes","attributes","existing","findOneBy","isDirty","Object","keys","some","key","target","warn","findOneWithSecret","secret","secretHashed","secretEncrypted","merged","merge","save","entity","create","clientId","scopeId","clientRealmId","scopeRealmId"],"sources":["../../../../src/core/entities/client/web-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    CLIENT_WEB_NAME,\n    ClientAuthMethod,\n    ClientTokenBindingMethod,\n    ScopeName,\n} from '@authup/core-kit';\nimport type { Client, Realm } from '@authup/core-kit';\nimport type { Logger } from '@authup/server-kit';\nimport type { IClientScopeRepository } from '../client-scope/types.ts';\nimport type { IScopeRepository } from '../scope/types.ts';\nimport type { IClientRepository, IWebClientProvisioner } from './types.ts';\n\nexport type WebClientProvisionerContext = {\n    clientRepository: IClientRepository;\n    scopeRepository: IScopeRepository;\n    clientScopeRepository: IClientScopeRepository;\n    appOrigins: string[];\n    logger?: Logger;\n};\n\n/**\n * The scopes a realm's public `web` client is granted.\n *\n * `global` lets the issued token drive the management API (parity with the\n * legacy password-grant admin login); `openid` yields the id-token.\n */\nexport const WEB_CLIENT_SCOPE_NAMES: string[] = [\n    ScopeName.GLOBAL,\n    ScopeName.OPEN_ID,\n];\n\n/**\n * Build the attribute set for a realm's public `web` client.\n *\n * Public (PKCE) client used by authup's own client-web and any downstream\n * UI embedding client-web-kit. `builtIn` makes it auto-consent in the\n * /authorize flow and protects it from the API reserved-name guard.\n *\n * `grantTypes` is an enforced allowlist (`assertClientGrantAllowed` at the\n * /token grants and the /authorize code-request verifier; null = allow-all),\n * so it must list every flow the client uses. `redirectUri` and\n * `postLogoutRedirectUri` are each one `<origin>/**` wildcard per trusted\n * origin (matched by isSimpleMatch).\n *\n * The `scope` column is descriptive only. Scope authorization resolves\n * through the `auth_client_scopes` junction, which\n * `WebClientProvisioner.ensureForRealm` fills from\n * {@see WEB_CLIENT_SCOPE_NAMES}.\n */\nexport function buildWebClientAttributes(\n    realm: Realm | { id: string },\n    appOrigins: string[],\n): Partial<Client> {\n    const originPatterns = appOrigins.map((origin) => `${origin}/**`).join(',');\n\n    return {\n        name: CLIENT_WEB_NAME,\n        realmId: realm.id,\n        authMethod: ClientAuthMethod.NONE,\n        tokenBindingMethod: ClientTokenBindingMethod.NONE,\n        builtIn: true,\n        active: true,\n        grantTypes: 'authorization_code refresh_token',\n        scope: WEB_CLIENT_SCOPE_NAMES.join(' '),\n        redirectUri: originPatterns,\n        postLogoutRedirectUri: originPatterns,\n    };\n}\n\nexport class WebClientProvisioner implements IWebClientProvisioner {\n    protected clientRepository: IClientRepository;\n\n    protected scopeRepository: IScopeRepository;\n\n    protected clientScopeRepository: IClientScopeRepository;\n\n    protected appOrigins: string[];\n\n    protected logger?: Logger;\n\n    constructor(ctx: WebClientProvisionerContext) {\n        this.clientRepository = ctx.clientRepository;\n        this.scopeRepository = ctx.scopeRepository;\n        this.clientScopeRepository = ctx.clientScopeRepository;\n        this.appOrigins = ctx.appOrigins;\n        this.logger = ctx.logger;\n    }\n\n    async ensureForRealm(realm: Realm | { id: string }): Promise<void> {\n        const client = await this.ensureClient(realm);\n\n        // Always run, even when the attributes were already up to date: an\n        // instance provisioned before the junction rows existed carries a\n        // steady-state client with no scopes at all.\n        await this.ensureScopes(client);\n    }\n\n    /**\n     * Upsert the client row itself.\n     *\n     * `web` is a reserved client name (`CLIENT_RESERVED_NAMES`), so the row\n     * belongs to the system whatever state it is in. A non-built-in one\n     * predates the reservation and is taken over rather than left to shadow\n     * the realm's login client.\n     */\n    protected async ensureClient(realm: Realm | { id: string }): Promise<Client> {\n        const attributes = buildWebClientAttributes(realm, this.appOrigins);\n\n        const existing = await this.clientRepository.findOneBy({\n            name: CLIENT_WEB_NAME,\n            realmId: realm.id,\n        });\n\n        if (existing) {\n            // MERGE: refresh attributes (e.g. redirectUri) when config\n            // changes. Dirty-check first — the attributes are deterministic\n            // from config, so a steady-state boot would otherwise issue one\n            // redundant UPDATE (bumping updatedAt) per realm.\n            const isDirty = (Object.keys(attributes) as (keyof Client)[])\n                .some((key) => existing[key] !== attributes[key]);\n            if (!isDirty) {\n                return existing;\n            }\n\n            let target = existing;\n\n            if (!existing.builtIn) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Taking over the non-built-in client named '${CLIENT_WEB_NAME}' in realm ${realm.id}: the name is reserved for the built-in web client.`,\n                    );\n                }\n\n                // The takeover makes the client public, so a secret it carried\n                // as a confidential client can never authenticate it again.\n                // Drop it instead of leaving the material at rest.\n                //\n                // The row has to be re-read WITH the secret for that: `secret`\n                // is a `select: false` column, so the loaded entity carries no\n                // value for it and typeorm's changed-column diff would not\n                // emit the null. Re-reading is confined to this branch, and\n                // the secret stays out of `buildWebClientAttributes` for the\n                // same reason (an undefined-vs-null compare would read as\n                // dirty on every boot).\n                target = await this.clientRepository.findOneWithSecret({ id: existing.id }) || existing;\n                target.secret = null;\n                target.secretHashed = false;\n                target.secretEncrypted = false;\n            }\n\n            const merged = this.clientRepository.merge(target, attributes);\n\n            return this.clientRepository.save(merged);\n        }\n\n        const entity = this.clientRepository.create(attributes);\n        return this.clientRepository.save(entity);\n    }\n\n    /**\n     * Bind the built-in global scopes through `auth_client_scopes`. That\n     * junction is the only source the /authorize code-request verifier reads\n     * scopes from.\n     *\n     * Additive like the attribute MERGE above: an extra scope an admin bound\n     * by hand is left in place.\n     */\n    protected async ensureScopes(client: Client): Promise<void> {\n        for (const name of WEB_CLIENT_SCOPE_NAMES) {\n            const scope = await this.scopeRepository.findOneBy({\n                name,\n                realmId: null,\n            });\n\n            if (!scope) {\n                if (this.logger) {\n                    this.logger.warn(\n                        `Skipping scope '${name}' for the web client of realm ${client.realmId}: the scope is not provisioned.`,\n                    );\n                }\n                continue;\n            }\n\n            const existing = await this.clientScopeRepository.findOneBy({\n                clientId: client.id,\n                scopeId: scope.id,\n            });\n\n            if (existing) {\n                continue;\n            }\n\n            await this.clientScopeRepository.save(this.clientScopeRepository.create({\n                clientId: client.id,\n                clientRealmId: client.realmId,\n                scopeId: scope.id,\n                scopeRealmId: scope.realmId,\n            }));\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;GAiCA,MAAaI,yBAAmC,CAC5CD,UAAUE,QACVF,UAAUG,OACb;;;;;;;;;;;;;;;;;;GAoBD,SAAgBC,yBACZC,OACAC,YAAoB;CAEpB,MAAMC,iBAAiBD,WAAWE,KAAKC,WAAW,GAAGA,OAAO,IAAI,CAAA,CAAEC,KAAK,GAAA;CAEvE,OAAO;EACHC,MAAMd;EACNe,SAASP,MAAMQ;EACfC,YAAYhB,iBAAiBiB;EAC7BC,oBAAoBjB,yBAAyBgB;EAC7CE,SAAS;EACTC,QAAQ;EACRC,YAAY;EACZC,OAAOnB,uBAAuBS,KAAK,GAAA;EACnCW,aAAad;EACbe,uBAAuBf;CAC3B;AACJ;AAEA,IAAagB,uBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEApB;CAEAqB;CAEV,YAAYC,KAAkC;EAC1C,KAAKJ,mBAAmBI,IAAIJ;EAC5B,KAAKC,kBAAkBG,IAAIH;EAC3B,KAAKC,wBAAwBE,IAAIF;EACjC,KAAKpB,aAAasB,IAAItB;EACtB,KAAKqB,SAASC,IAAID;CACtB;CAEA,MAAME,eAAexB,OAA8C;EAC/D,MAAMyB,SAAS,MAAM,KAAKC,aAAa1B,KAAAA;EAKvC,MAAM,KAAK2B,aAAaF,MAAAA;CAC5B;;;;;;;;IAUA,MAAgBC,aAAa1B,OAAgD;EACzE,MAAM4B,aAAa7B,yBAAyBC,OAAO,KAAKC,UAAU;EAElE,MAAM4B,WAAW,MAAM,KAAKV,iBAAiBW,UAAU;GACnDxB,MAAMd;GACNe,SAASP,MAAMQ;EACnB,CAAA;EAEA,IAAIqB,UAAU;GAOV,IAAI,CAFY,OAAQI,KAAKL,UAAAA,CAAAA,CACxBM,MAAMC,QAAQN,SAASM,SAASP,WAAWO,IAC3CJ,GACD,OAAOF;GAGX,IAAIO,SAASP;GAEb,IAAI,CAACA,SAASjB,SAAS;IACnB,IAAI,KAAKU,QACL,KAAKA,OAAOe,KACR,8CAA8C7C,gBAAgB,aAAaQ,MAAMQ,GAAG,oDAAoD;IAehJ4B,SAAS,MAAM,KAAKjB,iBAAiBmB,kBAAkB,EAAE9B,IAAIqB,SAASrB,GAAG,CAAA,KAAMqB;IAC/EO,OAAOG,SAAS;IAChBH,OAAOI,eAAe;IACtBJ,OAAOK,kBAAkB;GAC7B;GAEA,MAAMC,SAAS,KAAKvB,iBAAiBwB,MAAMP,QAAQR,UAAAA;GAEnD,OAAO,KAAKT,iBAAiByB,KAAKF,MAAAA;EACtC;EAEA,MAAMG,SAAS,KAAK1B,iBAAiB2B,OAAOlB,UAAAA;EAC5C,OAAO,KAAKT,iBAAiByB,KAAKC,MAAAA;CACtC;;;;;;;;IAUA,MAAgBlB,aAAaF,QAA+B;EACxD,KAAK,MAAMnB,QAAQV,wBAAwB;GACvC,MAAMmB,QAAQ,MAAM,KAAKK,gBAAgBU,UAAU;IAC/CxB;IACAC,SAAS;GACb,CAAA;GAEA,IAAI,CAACQ,OAAO;IACR,IAAI,KAAKO,QACL,KAAKA,OAAOe,KACR,mBAAmB/B,KAAK,gCAAgCmB,OAAOlB,QAAQ,gCAAgC;IAG/G;GACJ;GAOA,IAAIsB,MALmB,KAAKR,sBAAsBS,UAAU;IACxDiB,UAAUtB,OAAOjB;IACjBwC,SAASjC,MAAMP;GACnB,CAAA,GAGI;GAGJ,MAAM,KAAKa,sBAAsBuB,KAAK,KAAKvB,sBAAsByB,OAAO;IACpEC,UAAUtB,OAAOjB;IACjByC,eAAexB,OAAOlB;IACtByC,SAASjC,MAAMP;IACf0C,cAAcnC,MAAMR;GACxB,CAAA,CAAA;EACJ;CACJ;AACJ"}