@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/adapters/http/ui/account-console/module.d.ts

@@ -0,0 +1,28 @@
+import type { IAppEvent } from 'routup';
+import type { AccountConsoleServeOptions } from './types.ts';
+/**
+ * Point the resolution at a substituted package (config
+ * `accountConsolePath`) instead of the node_modules walk. Called once at
+ * boot.
+ */
+export declare function setAccountConsolePackagePath(value: string | undefined): void;
+/**
+ * Locate the built account console bundle. The SPA ships as the
+ * `@authup/client-account-console` package (a server-core dependency), so
+ * the node_modules ancestor walk from server-core's own package root
+ * (locter's `locateUp`) finds it for the workspace (symlink onto
+ * apps/client-account-console) and for a published install alike. Only a
+ * positive result is cached — a dev building the app after boot is picked
+ * up on the next request.
+ */
+export declare function resolveAccountConsoleDistPath(): string | undefined;
+/**
+ * Serve the account console SPA shell: the package's built index.html with
+ * the runtime configuration injected (replacing the `<!--account-config-->`
+ * marker), the color-mode/lang attributes stamped from the shared cookies
+ * (no flash), and asset hrefs rebased when publicUrl carries a sub-path.
+ * Client-side routing owns everything below /account — the shell is the
+ * same for every sub-path.
+ */
+export declare function serveAccountConsolePage(event: IAppEvent, options: AccountConsoleServeOptions): Promise<string>;
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/ui/account-console/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/account-console/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAcxC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAQ7D;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAI,IAAI,CAI7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,IAAK,MAAM,GAAG,SAAS,CAmBnE;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CACzC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,0BAA0B,GACnC,OAAO,CAAC,MAAM,CAAC,CAsDlB"}

package/dist/adapters/http/ui/account-console/module.mjs

@@ -0,0 +1,80 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PACKAGE_PATH } from "../../../../path.mjs";
+import { applyUIPageHeaders, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampHtmlAttributes } from "../shared/html.mjs";
+import "../shared/index.mjs";
+import { applyTheme } from "../theme/apply.mjs";
+import "../theme/index.mjs";
+import { useRequestTheme } from "../../middleware/built-in/theme.mjs";
+import "../../middleware/index.mjs";
+import { resolveAccountConsoleRef } from "./ref.mjs";
+import { getURLBasePath } from "@authup/kit";
+import { InternalError } from "@authup/errors";
+import path from "node:path";
+import { useRequestQuery } from "@routup/basic/query";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
+import { locateUpSync } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/account-console/module.ts
+const CONFIG_MARKER = "<!--account-config-->";
+let cachedDistPath;
+let cachedHtml;
+let overridePackagePath;
+/**
+* Point the resolution at a substituted package (config
+* `accountConsolePath`) instead of the node_modules walk. Called once at
+* boot.
+*/ function setAccountConsolePackagePath(value) {
+	overridePackagePath = value || void 0;
+	cachedDistPath = void 0;
+	cachedHtml = void 0;
+}
+/**
+* Locate the built account console bundle. The SPA ships as the
+* `@authup/client-account-console` package (a server-core dependency), so
+* the node_modules ancestor walk from server-core's own package root
+* (locter's `locateUp`) finds it for the workspace (symlink onto
+* apps/client-account-console) and for a published install alike. Only a
+* positive result is cached — a dev building the app after boot is picked
+* up on the next request.
+*/ function resolveAccountConsoleDistPath() {
+	if (cachedDistPath) return cachedDistPath;
+	const packagePath = overridePackagePath ?? locateUpSync("node_modules/@authup/client-account-console/package.json", { cwd: PACKAGE_PATH })?.directory;
+	if (packagePath) {
+		const distPath = path.join(packagePath, "dist");
+		if (fs.existsSync(path.join(distPath, "index.html"))) cachedDistPath = distPath;
+	}
+	return cachedDistPath;
+}
+/**
+* Serve the account console SPA shell: the package's built index.html with
+* the runtime configuration injected (replacing the `<!--account-config-->`
+* marker), the color-mode/lang attributes stamped from the shared cookies
+* (no flash), and asset hrefs rebased when publicUrl carries a sub-path.
+* Client-side routing owns everything below /account — the shell is the
+* same for every sub-path.
+*/ async function serveAccountConsolePage(event, options) {
+	const distPath = resolveAccountConsoleDistPath();
+	if (!distPath) throw new InternalError("The account console bundle (@authup/client-account-console) is not built or installed.");
+	let html;
+	if (isCodeTransformation(CodeTransformation.JUST_IN_TIME)) html = await fs.promises.readFile(path.join(distPath, "index.html"), "utf-8");
+	else html = cachedHtml ??= await fs.promises.readFile(path.join(distPath, "index.html"), "utf-8");
+	const basePath = getURLBasePath(options.baseURL);
+	const config = {
+		apiUrl: options.baseURL,
+		basePath: `${basePath}/account`,
+		features: options.features,
+		ref: resolveAccountConsoleRef(useRequestQuery(event, "ref"), options.trustedOrigins)
+	};
+	let body = replaceTemplateMarker(html, CONFIG_MARKER, `<script>window.__AUTHUP__ = ${serializeInlineScriptJSON(config)};<\/script>`);
+	body = stampHtmlAttributes(body, readUIClientPreferences(event));
+	body = rebaseAssetURLs(body, basePath, "/account/");
+	body = await applyTheme(body, useRequestTheme(event), basePath);
+	applyUIPageHeaders(event);
+	return body;
+}
+//#endregion
+export { resolveAccountConsoleDistPath, serveAccountConsolePage, setAccountConsolePackagePath };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/ui/account-console/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["InternalError","getURLBasePath","useRequestQuery","locateUpSync","fs","path","CodeTransformation","isCodeTransformation","PACKAGE_PATH","useRequestTheme","applyTheme","applyUIPageHeaders","readUIClientPreferences","rebaseAssetURLs","replaceTemplateMarker","serializeInlineScriptJSON","stampHtmlAttributes","resolveAccountConsoleRef","CONFIG_MARKER","cachedDistPath","cachedHtml","overridePackagePath","setAccountConsolePackagePath","value","undefined","resolveAccountConsoleDistPath","packagePath","cwd","directory","distPath","join","existsSync","serveAccountConsolePage","event","options","html","JUST_IN_TIME","promises","readFile","basePath","baseURL","config","apiUrl","features","ref","trustedOrigins","body"],"sources":["../../../../../src/adapters/http/ui/account-console/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { InternalError } from '@authup/errors';\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { PACKAGE_PATH } from '../../../../path.ts';\nimport { useRequestTheme } from '../../middleware/index.ts';\nimport { applyTheme } from '../theme/index.ts';\nimport {\n    applyUIPageHeaders,\n    readUIClientPreferences,\n    rebaseAssetURLs,\n    replaceTemplateMarker,\n    serializeInlineScriptJSON,\n    stampHtmlAttributes,\n} from '../shared/index.ts';\nimport { resolveAccountConsoleRef } from './ref.ts';\nimport type { AccountConsoleServeOptions } from './types.ts';\n\nconst CONFIG_MARKER = '<!--account-config-->';\n\nlet cachedDistPath: string | undefined;\nlet cachedHtml: string | undefined;\nlet overridePackagePath: string | undefined;\n\n/**\n * Point the resolution at a substituted package (config\n * `accountConsolePath`) instead of the node_modules walk. Called once at\n * boot.\n */\nexport function setAccountConsolePackagePath(value: string | undefined) : void {\n    overridePackagePath = value || undefined;\n    cachedDistPath = undefined;\n    cachedHtml = undefined;\n}\n\n/**\n * Locate the built account console bundle. The SPA ships as the\n * `@authup/client-account-console` package (a server-core dependency), so\n * the node_modules ancestor walk from server-core's own package root\n * (locter's `locateUp`) finds it for the workspace (symlink onto\n * apps/client-account-console) and for a published install alike. Only a\n * positive result is cached — a dev building the app after boot is picked\n * up on the next request.\n */\nexport function resolveAccountConsoleDistPath() : string | undefined {\n    if (cachedDistPath) {\n        return cachedDistPath;\n    }\n\n    const packagePath = overridePackagePath ?? locateUpSync(\n        'node_modules/@authup/client-account-console/package.json',\n        { cwd: PACKAGE_PATH },\n    )?.directory;\n\n    if (packagePath) {\n        const distPath = path.join(packagePath, 'dist');\n\n        if (fs.existsSync(path.join(distPath, 'index.html'))) {\n            cachedDistPath = distPath;\n        }\n    }\n\n    return cachedDistPath;\n}\n\n/**\n * Serve the account console SPA shell: the package's built index.html with\n * the runtime configuration injected (replacing the `<!--account-config-->`\n * marker), the color-mode/lang attributes stamped from the shared cookies\n * (no flash), and asset hrefs rebased when publicUrl carries a sub-path.\n * Client-side routing owns everything below /account — the shell is the\n * same for every sub-path.\n */\nexport async function serveAccountConsolePage(\n    event: IAppEvent,\n    options: AccountConsoleServeOptions,\n) : Promise<string> {\n    const distPath = resolveAccountConsoleDistPath();\n    if (!distPath) {\n        throw new InternalError(\n            'The account console bundle (@authup/client-account-console) is not built or installed.',\n        );\n    }\n\n    let html : string;\n    if (isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        // dev: re-read so a rebuilt bundle is picked up without a restart\n        html = await fs.promises.readFile(path.join(distPath, 'index.html'), 'utf-8');\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(distPath, 'index.html'),\n            'utf-8',\n        ));\n    }\n\n    const basePath = getURLBasePath(options.baseURL);\n\n    // publicUrl and the feature flags are operator config, but `ref` is\n    // request-reflected, so it is validated against the trusted app\n    // origins before it goes anywhere near the page.\n    //\n    // The splice below MUST stay `replaceTemplateMarker`. A plain\n    // String.prototype.replace expands `$&`, \"$`\", `$'` and `$$` inside the\n    // REPLACEMENT value, so a crafted `ref` could splice the template's own\n    // tail into the payload and break the inline script. That is the exact\n    // bug that killed the auth console's hydration payload.\n    const config = {\n        apiUrl: options.baseURL,\n        basePath: `${basePath}/account`,\n        features: options.features,\n        ref: resolveAccountConsoleRef(\n            useRequestQuery(event, 'ref'),\n            options.trustedOrigins,\n        ),\n    };\n\n    let body = replaceTemplateMarker(\n        html,\n        CONFIG_MARKER,\n        `<script>window.__AUTHUP__ = ${serializeInlineScriptJSON(config)};</script>`,\n    );\n\n    body = stampHtmlAttributes(body, readUIClientPreferences(event));\n    body = rebaseAssetURLs(body, basePath, '/account/');\n\n    body = await applyTheme(body, useRequestTheme(event), basePath);\n\n    applyUIPageHeaders(event);\n\n    return body;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,MAAMkB,gBAAgB;AAEtB,IAAIC;AACJ,IAAIC;AACJ,IAAIC;;;;;GAOJ,SAAgBC,6BAA6BC,OAAyB;CAClEF,sBAAsBE,SAASC,KAAAA;CAC/BL,iBAAiBK,KAAAA;CACjBJ,aAAaI,KAAAA;AACjB;;;;;;;;;GAWA,SAAgBC,gCAAAA;CACZ,IAAIN,gBACA,OAAOA;CAGX,MAAMO,cAAcL,uBAAuBlB,aACvC,4DACA,EAAEwB,KAAKnB,aAAa,CAAA,CAAA,EACrBoB;CAEH,IAAIF,aAAa;EACb,MAAMG,WAAWxB,KAAKyB,KAAKJ,aAAa,MAAA;EAExC,IAAItB,GAAG2B,WAAW1B,KAAKyB,KAAKD,UAAU,YAAA,CAAA,GAClCV,iBAAiBU;CAEzB;CAEA,OAAOV;AACX;;;;;;;;GAUA,eAAsBa,wBAClBC,OACAC,SAAmC;CAEnC,MAAML,WAAWJ,8BAAAA;CACjB,IAAI,CAACI,UACD,MAAM,IAAI7B,cACN,wFAAA;CAIR,IAAImC;CACJ,IAAI5B,qBAAqBD,mBAAmB8B,YAAY,GAEpDD,OAAO,MAAM/B,GAAGiC,SAASC,SAASjC,KAAKyB,KAAKD,UAAU,YAAA,GAAe,OAAA;MAErEM,OAAQf,eAAe,MAAMhB,GAAGiC,SAASC,SACrCjC,KAAKyB,KAAKD,UAAU,YAAA,GACpB,OAAA;CAIR,MAAMU,WAAWtC,eAAeiC,QAAQM,OAAO;CAW/C,MAAMC,SAAS;EACXC,QAAQR,QAAQM;EAChBD,UAAU,GAAGA,SAAS;EACtBI,UAAUT,QAAQS;EAClBC,KAAK3B,yBACDf,gBAAgB+B,OAAO,KAAA,GACvBC,QAAQW,cAAc;CAE9B;CAEA,IAAIC,OAAOhC,sBACPqB,MACAjB,eACA,+BAA+BH,0BAA0B0B,MAAAA,EAAQ,YAAW;CAGhFK,OAAO9B,oBAAoB8B,MAAMlC,wBAAwBqB,KAAAA,CAAAA;CACzDa,OAAOjC,gBAAgBiC,MAAMP,UAAU,WAAA;CAEvCO,OAAO,MAAMpC,WAAWoC,MAAMrC,gBAAgBwB,KAAAA,GAAQM,QAAAA;CAEtD5B,mBAAmBsB,KAAAA;CAEnB,OAAOa;AACX"}

package/dist/adapters/http/ui/account-console/ref.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Upper bound on an accepted `ref`, matching the cap
+ * `OAuth2EndSessionRequestValidator` applies to `post_logout_redirect_uri`.
+ */
+export declare const ACCOUNT_CONSOLE_REF_MAX_LENGTH = 2000;
+/**
+ * Resolve the `ref` back-link parameter against the trusted app origins.
+ *
+ * `ref` names the application the visitor came from, so the account console
+ * can render a link back to it. It is attacker-supplied, and it is rendered
+ * on an authenticated first-party page, so an unvalidated value would be a
+ * phishing surface. The check mirrors the client redirect allowlist: each
+ * trusted origin becomes an `<origin>/**` pattern, which admits the bare
+ * origin and any path below it while rejecting a foreign origin, a
+ * suffix-extended host (`admin.example.com.evil.test`), a userinfo-prefixed
+ * host (`admin.example.com@evil.test`) and a scheme downgrade.
+ *
+ * The value is canonicalized through `URL` before matching, so a host
+ * differing only in case still matches (the matcher is case-sensitive, while
+ * a host is not). The canonical form is what gets returned, and it is what
+ * the page embeds. `isSimpleURLMatch` canonicalizes as well, which is what
+ * keeps a wildcard in a trusted origin from escaping the authority; doing it
+ * here too is what lets this function RETURN the canonical form.
+ *
+ * Returns undefined for anything that does not pass. The caller drops it
+ * silently, the way `sanitizeRelativeRedirect` drops a bad workflow
+ * redirect.
+ */
+export declare function resolveAccountConsoleRef(value: unknown, trustedOrigins: string[]): string | undefined;
+//# sourceMappingURL=ref.d.ts.map

package/dist/adapters/http/ui/account-console/ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/account-console/ref.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CACpC,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,MAAM,EAAE,GACxB,MAAM,GAAG,SAAS,CA4BrB"}

package/dist/adapters/http/ui/account-console/ref.mjs

@@ -0,0 +1,50 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isSimpleURLMatch } from "@authup/kit";
+//#region src/adapters/http/ui/account-console/ref.ts
+/**
+* Upper bound on an accepted `ref`, matching the cap
+* `OAuth2EndSessionRequestValidator` applies to `post_logout_redirect_uri`.
+*/ const ACCOUNT_CONSOLE_REF_MAX_LENGTH = 2e3;
+/**
+* Resolve the `ref` back-link parameter against the trusted app origins.
+*
+* `ref` names the application the visitor came from, so the account console
+* can render a link back to it. It is attacker-supplied, and it is rendered
+* on an authenticated first-party page, so an unvalidated value would be a
+* phishing surface. The check mirrors the client redirect allowlist: each
+* trusted origin becomes an `<origin>/**` pattern, which admits the bare
+* origin and any path below it while rejecting a foreign origin, a
+* suffix-extended host (`admin.example.com.evil.test`), a userinfo-prefixed
+* host (`admin.example.com@evil.test`) and a scheme downgrade.
+*
+* The value is canonicalized through `URL` before matching, so a host
+* differing only in case still matches (the matcher is case-sensitive, while
+* a host is not). The canonical form is what gets returned, and it is what
+* the page embeds. `isSimpleURLMatch` canonicalizes as well, which is what
+* keeps a wildcard in a trusted origin from escaping the authority; doing it
+* here too is what lets this function RETURN the canonical form.
+*
+* Returns undefined for anything that does not pass. The caller drops it
+* silently, the way `sanitizeRelativeRedirect` drops a bad workflow
+* redirect.
+*/ function resolveAccountConsoleRef(value, trustedOrigins) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	if (trimmed.length === 0 || trimmed.length > 2e3) return;
+	let url;
+	try {
+		url = new URL(trimmed);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return;
+	const candidate = `${url.origin}${url.pathname}${url.search}${url.hash}`;
+	if (!isSimpleURLMatch(candidate, trustedOrigins.map((origin) => `${origin}/**`))) return;
+	return candidate;
+}
+//#endregion
+export { ACCOUNT_CONSOLE_REF_MAX_LENGTH, resolveAccountConsoleRef };
+
+//# sourceMappingURL=ref.mjs.map

package/dist/adapters/http/ui/account-console/ref.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref.mjs","names":["isSimpleURLMatch","ACCOUNT_CONSOLE_REF_MAX_LENGTH","resolveAccountConsoleRef","value","trustedOrigins","undefined","trimmed","trim","length","url","URL","protocol","candidate","origin","pathname","search","hash","map"],"sources":["../../../../../src/adapters/http/ui/account-console/ref.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isSimpleURLMatch } from '@authup/kit';\n\n/**\n * Upper bound on an accepted `ref`, matching the cap\n * `OAuth2EndSessionRequestValidator` applies to `post_logout_redirect_uri`.\n */\nexport const ACCOUNT_CONSOLE_REF_MAX_LENGTH = 2000;\n\n/**\n * Resolve the `ref` back-link parameter against the trusted app origins.\n *\n * `ref` names the application the visitor came from, so the account console\n * can render a link back to it. It is attacker-supplied, and it is rendered\n * on an authenticated first-party page, so an unvalidated value would be a\n * phishing surface. The check mirrors the client redirect allowlist: each\n * trusted origin becomes an `<origin>/**` pattern, which admits the bare\n * origin and any path below it while rejecting a foreign origin, a\n * suffix-extended host (`admin.example.com.evil.test`), a userinfo-prefixed\n * host (`admin.example.com@evil.test`) and a scheme downgrade.\n *\n * The value is canonicalized through `URL` before matching, so a host\n * differing only in case still matches (the matcher is case-sensitive, while\n * a host is not). The canonical form is what gets returned, and it is what\n * the page embeds. `isSimpleURLMatch` canonicalizes as well, which is what\n * keeps a wildcard in a trusted origin from escaping the authority; doing it\n * here too is what lets this function RETURN the canonical form.\n *\n * Returns undefined for anything that does not pass. The caller drops it\n * silently, the way `sanitizeRelativeRedirect` drops a bad workflow\n * redirect.\n */\nexport function resolveAccountConsoleRef(\n    value: unknown,\n    trustedOrigins: string[],\n) : string | undefined {\n    if (typeof value !== 'string') {\n        return undefined;\n    }\n\n    const trimmed = value.trim();\n    if (trimmed.length === 0 || trimmed.length > ACCOUNT_CONSOLE_REF_MAX_LENGTH) {\n        return undefined;\n    }\n\n    let url : URL;\n    try {\n        url = new URL(trimmed);\n    } catch {\n        return undefined;\n    }\n\n    if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n        return undefined;\n    }\n\n    const candidate = `${url.origin}${url.pathname}${url.search}${url.hash}`;\n\n    if (!isSimpleURLMatch(candidate, trustedOrigins.map((origin) => `${origin}/**`))) {\n        return undefined;\n    }\n\n    return candidate;\n}\n"],"mappings":";;;;;;;;GAaA,MAAaC,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;GAyB9C,SAAgBC,yBACZC,OACAC,gBAAwB;CAExB,IAAI,OAAOD,UAAU,UACjB;CAGJ,MAAMG,UAAUH,MAAMI,KAAI;CAC1B,IAAID,QAAQE,WAAW,KAAKF,QAAQE,SAAAA,KAChC;CAGJ,IAAIC;CACJ,IAAI;EACAA,MAAM,IAAIC,IAAIJ,OAAAA;CAClB,QAAQ;EACJ;CACJ;CAEA,IAAIG,IAAIE,aAAa,WAAWF,IAAIE,aAAa,UAC7C;CAGJ,MAAMC,YAAY,GAAGH,IAAII,SAASJ,IAAIK,WAAWL,IAAIM,SAASN,IAAIO;CAElE,IAAI,CAAChB,iBAAiBY,WAAWR,eAAea,KAAKJ,WAAW,GAAGA,OAAO,IAAI,CAAA,GAC1E;CAGJ,OAAOD;AACX"}

package/dist/adapters/http/ui/account-console/types.d.ts

@@ -0,0 +1,11 @@
+import type { StatusResponseFeatures } from '@authup/core-http-kit';
+export type AccountConsoleServeOptions = {
+    baseURL: string;
+    features: StatusResponseFeatures;
+    /**
+     * Trusted application origins (`getAppOrigins(config)`). The allowlist
+     * the `ref` back-link parameter is validated against.
+     */
+    trustedOrigins: string[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/account-console/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/account-console/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,MAAM,0BAA0B,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC"}

package/dist/adapters/http/ui/account-console/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/adapters/http/ui/{internal-http-client.d.ts → auth-console/http-client.d.ts}

@@ -19,4 +19,4 @@ export declare function createPublicToInternalURLRewriter(publicURL: string, int
  * hydration does not patch attribute mismatches.
  */
 export declare function createInternalUIHttpClient(ctx: InternalUIHttpClientContext): IClient;
-//# sourceMappingURL=internal-http-client.d.ts.map
+//# sourceMappingURL=http-client.d.ts.map

package/dist/adapters/http/ui/auth-console/http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/http-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GACnB,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAmC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAOrF"}

package/dist/adapters/http/ui/{internal-http-client.mjs → auth-console/http-client.mjs}

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { Client } from "@authup/core-http-kit";
 import { FetchTransport, fetch } from "hapic";
-//#region src/adapters/http/ui/internal-http-client.ts
+//#region src/adapters/http/ui/auth-console/http-client.ts
 /**
 * Build a rewriter that maps URLs under the public base URL
 * (scheme://host[/prefix]) onto the server's own listen address. URLs
@@ -49,4 +49,4 @@ import { FetchTransport, fetch } from "hapic";
 //#endregion
 export { createInternalUIHttpClient, createPublicToInternalURLRewriter };
 
-//# sourceMappingURL=internal-http-client.mjs.map
+//# sourceMappingURL=http-client.mjs.map

package/dist/adapters/http/ui/auth-console/http-client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.mjs","names":["Client","FetchTransport","fetch","createPublicToInternalURLRewriter","publicURL","internalURL","publicParsed","URL","internalParsed","hostname","basePath","pathname","replace","url","parsed","origin","startsWith","substring","length","search","href","createInternalUIHttpClient","ctx","rewriteURL","baseURL","transport","input","init"],"sources":["../../../../../src/adapters/http/ui/auth-console/http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport type { IClient } from '@authup/core-http-kit';\nimport { FetchTransport, fetch } from 'hapic';\nimport type { InternalUIHttpClientContext } from './types.ts';\n\n/**\n * Build a rewriter that maps URLs under the public base URL\n * (scheme://host[/prefix]) onto the server's own listen address. URLs\n * outside the public origin/prefix pass through untouched.\n */\nexport function createPublicToInternalURLRewriter(\n    publicURL: string,\n    internalURL: string,\n) : (url: string) => string {\n    const publicParsed = new URL(publicURL);\n    const internalParsed = new URL(internalURL);\n    // a wildcard listen address (0.0.0.0 / [::]) is not reliably dialable —\n    // loop back explicitly\n    if (internalParsed.hostname === '0.0.0.0' || internalParsed.hostname === '[::]') {\n        internalParsed.hostname = '127.0.0.1';\n    }\n    const basePath = publicParsed.pathname.replace(/\\/+$/, '');\n\n    return (url: string) => {\n        let parsed : URL;\n        try {\n            parsed = new URL(url);\n        } catch {\n            return url;\n        }\n\n        if (parsed.origin !== publicParsed.origin) {\n            return url;\n        }\n\n        let { pathname } = parsed;\n        if (basePath) {\n            if (pathname === basePath) {\n                pathname = '/';\n            } else if (pathname.startsWith(`${basePath}/`)) {\n                pathname = pathname.substring(basePath.length);\n            } else {\n                return url;\n            }\n        }\n\n        return new URL(pathname + parsed.search, internalParsed.origin).href;\n    };\n}\n\n/**\n * HTTP client for the SSR'd UI pages: the render's API calls target the\n * server itself, so they are dispatched against its own listen address —\n * no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate\n * would otherwise fail Node's fetch), no dependency on the public hostname\n * resolving from inside the deployment.\n *\n * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the\n * public URL because the rendered HTML derives user-facing URLs from it\n * (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and\n * hydration does not patch attribute mismatches.\n */\nexport function createInternalUIHttpClient(ctx: InternalUIHttpClientContext) : IClient {\n    const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);\n\n    return new Client({\n        baseURL: ctx.publicURL,\n        transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) }),\n    });\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBG,kCACZC,WACAC,aAAmB;CAEnB,MAAMC,eAAe,IAAIC,IAAIH,SAAAA;CAC7B,MAAMI,iBAAiB,IAAID,IAAIF,WAAAA;CAG/B,IAAIG,eAAeC,aAAa,aAAaD,eAAeC,aAAa,QACrED,eAAeC,WAAW;CAE9B,MAAMC,WAAWJ,aAAaK,SAASC,QAAQ,QAAQ,EAAA;CAEvD,QAAQC,QAAAA;EACJ,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIP,IAAIM,GAAAA;EACrB,QAAQ;GACJ,OAAOA;EACX;EAEA,IAAIC,OAAOC,WAAWT,aAAaS,QAC/B,OAAOF;EAGX,IAAI,EAAEF,aAAaG;EACnB,IAAIJ,UACA,IAAIC,aAAaD,UACbC,WAAW;OACR,IAAIA,SAASK,WAAW,GAAGN,SAAS,EAAE,GACzCC,WAAWA,SAASM,UAAUP,SAASQ,MAAM;OAE7C,OAAOL;EAIf,OAAO,IAAIN,IAAII,WAAWG,OAAOK,QAAQX,eAAeO,MAAM,CAAA,CAAEK;CACpE;AACJ;;;;;;;;;;;;GAcA,SAAgBC,2BAA2BC,KAAgC;CACvE,MAAMC,aAAapB,kCAAkCmB,IAAIlB,WAAWkB,IAAIjB,WAAW;CAEnF,OAAO,IAAIL,OAAO;EACdwB,SAASF,IAAIlB;EACbqB,WAAW,IAAIxB,eAAe,EAAEC,QAAQwB,OAAOC,SAASzB,MAAMqB,WAAWG,KAAAA,GAAQC,IAAAA,EAAM,CAAA;CAC3F,CAAA;AACJ"}

package/dist/adapters/http/ui/auth-console/index.d.ts

@@ -0,0 +1,6 @@
+export * from './http-client.ts';
+export * from './module.ts';
+export * from './resolve.ts';
+export * from './serve.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/auth-console/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/index.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC;AACjC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/auth-console/index.mjs

@@ -0,0 +1,8 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createInternalUIHttpClient, createPublicToInternalURLRewriter } from "./http-client.mjs";
+import { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, setAuthConsolePackagePath } from "./resolve.mjs";
+import { renderAuthConsolePage } from "./module.mjs";
+import { serveWorkflowPage } from "./serve.mjs";
+export { createInternalUIHttpClient, createPublicToInternalURLRewriter, renderAuthConsolePage, resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, serveWorkflowPage, setAuthConsolePackagePath };

package/dist/adapters/http/ui/auth-console/module.d.ts

@@ -0,0 +1,4 @@
+import type { IAppEvent } from 'routup';
+import type { AuthConsoleRenderContext } from './types.ts';
+export declare function renderAuthConsolePage(event: IAppEvent, ctx: AuthConsoleRenderContext): Promise<string>;
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/ui/auth-console/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAcxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAU3D,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8F5G"}

package/dist/adapters/http/ui/auth-console/module.mjs

@@ -0,0 +1,73 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { applyUIPageHeaders, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, stampHtmlAttributes } from "../shared/html.mjs";
+import "../shared/index.mjs";
+import { applyTheme } from "../theme/apply.mjs";
+import "../theme/index.mjs";
+import { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from "./resolve.mjs";
+import { useRequestTheme } from "../../middleware/built-in/theme.mjs";
+import { VITE_SERVER_STORE_KEY } from "../../middleware/built-in/assets.mjs";
+import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../../middleware/built-in/ui-http-client.mjs";
+import "../../middleware/index.mjs";
+import { getURLBasePath } from "@authup/kit";
+import { InternalError, isError } from "@authup/errors";
+import path from "node:path";
+import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
+import { read } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/auth-console/module.ts
+let cachedHtml;
+let cachedManifest;
+let cachedRender;
+async function renderAuthConsolePage(event, ctx) {
+	const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);
+	const preferences = readUIClientPreferences(event);
+	ctx.payload.config.colorMode = preferences.colorMode;
+	ctx.payload.config.locale = preferences.locale;
+	let html;
+	let manifest;
+	let render;
+	let vite;
+	if (isJIT) {
+		const packagePath = resolveAuthConsolePackagePath();
+		if (!packagePath) throw new InternalError("The auth console package (@authup/client-auth-console) is not installed.");
+		vite = event.store[VITE_SERVER_STORE_KEY];
+		html = await fs.promises.readFile(path.join(packagePath, "index.html"), "utf-8");
+		html = await vite.transformIndexHtml(ctx.url, html);
+		manifest = {};
+		render = (await vite.ssrLoadModule("/src/server.ts")).render;
+	} else {
+		const distPath = resolveAuthConsoleDistPath();
+		if (!distPath) throw new InternalError("The auth console bundle (@authup/client-auth-console) is not built or installed.");
+		html = cachedHtml ??= await fs.promises.readFile(path.join(distPath, "client", "index.html"), "utf-8");
+		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(distPath, "client", ".vite", "ssr-manifest.json"), "utf-8"));
+		render = cachedRender ??= (await read(path.join(distPath, "server", "server.js"))).render;
+	}
+	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
+	let appHtml;
+	let preloadLinks;
+	try {
+		[appHtml, preloadLinks] = await render({
+			url: ctx.url,
+			manifest,
+			payload: ctx.payload,
+			httpClient: httpClientFactory ? httpClientFactory() : void 0
+		});
+	} catch (e) {
+		if (vite && isError(e)) vite.ssrFixStacktrace(e);
+		throw e;
+	}
+	let body = replaceTemplateMarker(html, "<!--preload-links-->", preloadLinks);
+	body = replaceTemplateMarker(body, "<!--app-html-->", appHtml);
+	body = stampHtmlAttributes(body, preferences);
+	const basePath = getURLBasePath(ctx.payload.config.baseURL);
+	body = rebaseAssetURLs(body, basePath, "/public/");
+	body = await applyTheme(body, useRequestTheme(event), basePath);
+	applyUIPageHeaders(event);
+	return body;
+}
+//#endregion
+export { renderAuthConsolePage };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/ui/auth-console/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["InternalError","isError","getURLBasePath","read","fs","path","CodeTransformation","isCodeTransformation","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","useRequestTheme","applyUIPageHeaders","readUIClientPreferences","rebaseAssetURLs","replaceTemplateMarker","stampHtmlAttributes","applyTheme","resolveAuthConsoleDistPath","resolveAuthConsolePackagePath","cachedHtml","cachedManifest","cachedRender","renderAuthConsolePage","event","ctx","isJIT","JUST_IN_TIME","preferences","payload","config","colorMode","locale","html","manifest","render","vite","packagePath","store","promises","readFile","join","transformIndexHtml","url","ssrLoadModule","distPath","JSON","parse","httpClientFactory","appHtml","preloadLinks","httpClient","undefined","e","ssrFixStacktrace","body","basePath","baseURL"],"sources":["../../../../../src/adapters/http/ui/auth-console/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { RenderFunction } from '@authup/client-auth-console';\nimport { InternalError, isError } from '@authup/errors';\nimport { getURLBasePath } from '@authup/kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, useRequestTheme } from '../../middleware/index.ts';\nimport {\n    applyUIPageHeaders,\n    readUIClientPreferences,\n    rebaseAssetURLs,\n    replaceTemplateMarker,\n    stampHtmlAttributes,\n} from '../shared/index.ts';\nimport { applyTheme } from '../theme/index.ts';\nimport { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from './resolve.ts';\nimport type { AuthConsoleRenderContext } from './types.ts';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: RenderFunction | undefined;\n\nexport async function renderAuthConsolePage(event: IAppEvent, ctx: AuthConsoleRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // The client app hydrates locale + color-mode from the payload, so it\n    // adopts the same values the HTML shell is stamped with below.\n    const preferences = readUIClientPreferences(event);\n    ctx.payload.config.colorMode = preferences.colorMode;\n    ctx.payload.config.locale = preferences.locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : RenderFunction;\n    let vite : ViteDevServer | undefined;\n\n    if (isJIT) {\n        const packagePath = resolveAuthConsolePackagePath();\n        if (!packagePath) {\n            throw new InternalError(\n                'The auth console package (@authup/client-auth-console) is not installed.',\n            );\n        }\n\n        vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(packagePath, 'index.html'),\n            'utf-8',\n        );\n        // The URL reaches every transformIndexHtml hook as its context.\n        // Pass the rendered route rather than a fixed '/', as vite's own SSR\n        // guide does.\n        html = await vite.transformIndexHtml(ctx.url, html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render as RenderFunction;\n    } else {\n        const distPath = resolveAuthConsoleDistPath();\n        if (!distPath) {\n            throw new InternalError(\n                'The auth console bundle (@authup/client-auth-console) is not built or installed.',\n            );\n        }\n\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(distPath, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(distPath, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await read(\n            path.join(distPath, 'server', 'server.js'),\n        )).render as RenderFunction);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    let appHtml : string;\n    let preloadLinks : string;\n\n    try {\n        [appHtml, preloadLinks] = await render({\n            url: ctx.url,\n            manifest,\n            payload: ctx.payload,\n            httpClient: httpClientFactory ? httpClientFactory() : undefined,\n        });\n    } catch (e) {\n        // Map the bundled frames back onto the source files before the error\n        // reaches the logger. Only the dev server can do this, so a production\n        // render rethrows untouched.\n        if (vite && isError(e)) {\n            vite.ssrFixStacktrace(e);\n        }\n\n        throw e;\n    }\n\n    let body = replaceTemplateMarker(html, '<!--preload-links-->', preloadLinks);\n    body = replaceTemplateMarker(body, '<!--app-html-->', appHtml);\n\n    body = stampHtmlAttributes(body, preferences);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    const basePath = getURLBasePath(ctx.payload.config.baseURL);\n    body = rebaseAssetURLs(body, basePath, '/public/');\n\n    body = await applyTheme(body, useRequestTheme(event), basePath);\n\n    applyUIPageHeaders(event);\n\n    return body;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiCA,IAAImB;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,sBAAsBC,OAAkBC,KAA6B;CACvF,MAAMC,QAAQlB,qBAAqBD,mBAAmBoB,YAAY;CAIlE,MAAMC,cAAcf,wBAAwBW,KAAAA;CAC5CC,IAAII,QAAQC,OAAOC,YAAYH,YAAYG;CAC3CN,IAAII,QAAQC,OAAOE,SAASJ,YAAYI;CAExC,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIV,OAAO;EACP,MAAMW,cAAclB,8BAAAA;EACpB,IAAI,CAACkB,aACD,MAAM,IAAIpC,cACN,0EAAA;EAIRmC,OAAOZ,MAAMc,MAAM5B;EAEnBuB,OAAO,MAAM5B,GAAGkC,SAASC,SACrBlC,KAAKmC,KAAKJ,aAAa,YAAA,GACvB,OAAA;EAKJJ,OAAO,MAAMG,KAAKM,mBAAmBjB,IAAIkB,KAAKV,IAAAA;EAC9CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKQ,cAAc,gBAAA,EAAA,CAAmBT;CAC1D,OAAO;EACH,MAAMU,WAAW3B,2BAAAA;EACjB,IAAI,CAAC2B,UACD,MAAM,IAAI5C,cACN,kFAAA;EAIRgC,OAAQb,eAAe,MAAMf,GAAGkC,SAASC,SACrClC,KAAKmC,KAAKI,UAAU,UAAU,YAAA,GAC9B,OAAA;EAEJX,WAAYb,mBAAmByB,KAAKC,MAAM,MAAM1C,GAAGkC,SAASC,SACxDlC,KAAKmC,KAAKI,UAAU,UAAU,SAAS,mBAAA,GACvC,OAAA,CAAA;EAEJV,SAAUb,kBAAkB,MAAMlB,KAC9BE,KAAKmC,KAAKI,UAAU,UAAU,WAAA,CAAA,EAAA,CAC/BV;CACP;CAEA,MAAMa,oBAAoBxB,MAAMc,MAAM7B;CAEtC,IAAIwC;CACJ,IAAIC;CAEJ,IAAI;EACA,CAACD,SAASC,gBAAgB,MAAMf,OAAO;GACnCQ,KAAKlB,IAAIkB;GACTT;GACAL,SAASJ,IAAII;GACbsB,YAAYH,oBAAoBA,kBAAAA,IAAsBI,KAAAA;EAC1D,CAAA;CACJ,SAASC,GAAG;EAIR,IAAIjB,QAAQlC,QAAQmD,CAAAA,GAChBjB,KAAKkB,iBAAiBD,CAAAA;EAG1B,MAAMA;CACV;CAEA,IAAIE,OAAOxC,sBAAsBkB,MAAM,wBAAwBiB,YAAAA;CAC/DK,OAAOxC,sBAAsBwC,MAAM,mBAAmBN,OAAAA;CAEtDM,OAAOvC,oBAAoBuC,MAAM3B,WAAAA;CAKjC,MAAM4B,WAAWrD,eAAesB,IAAII,QAAQC,OAAO2B,OAAO;CAC1DF,OAAOzC,gBAAgByC,MAAMC,UAAU,UAAA;CAEvCD,OAAO,MAAMtC,WAAWsC,MAAM5C,gBAAgBa,KAAAA,GAAQgC,QAAAA;CAEtD5C,mBAAmBY,KAAAA;CAEnB,OAAO+B;AACX"}

package/dist/adapters/http/ui/auth-console/resolve.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Point the resolution at a substituted package (config `authConsolePath`)
+ * instead of the node_modules walk. Called once at boot.
+ */
+export declare function setAuthConsolePackagePath(value: string | undefined): void;
+/**
+ * Locate the auth console package. The SSR auth workflow UI ships as
+ * `@authup/client-auth-console` (a server-core dependency), so the
+ * node_modules ancestor walk from server-core's own package root (locter's
+ * `locateUp`) finds it for the workspace (symlink onto
+ * apps/client-auth-console) and for a published install alike. Only a
+ * positive result is cached.
+ */
+export declare function resolveAuthConsolePackagePath(): string | undefined;
+/**
+ * Locate the BUILT auth console bundle (`dist/client` template + assets,
+ * `dist/server/server.js` render entry). Only a positive result is cached —
+ * a dev building the package after boot is picked up on the next request.
+ */
+export declare function resolveAuthConsoleDistPath(): string | undefined;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/adapters/http/ui/auth-console/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/resolve.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAI,IAAI,CAI1E;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,IAAK,MAAM,GAAG,SAAS,CAoBnE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAK,MAAM,GAAG,SAAS,CAehE"}

package/dist/adapters/http/ui/auth-console/resolve.mjs

@@ -0,0 +1,53 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PACKAGE_PATH } from "../../../../path.mjs";
+import path from "node:path";
+import { locateUpSync } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/auth-console/resolve.ts
+let cachedPackagePath;
+let cachedDistPath;
+let overridePackagePath;
+/**
+* Point the resolution at a substituted package (config `authConsolePath`)
+* instead of the node_modules walk. Called once at boot.
+*/ function setAuthConsolePackagePath(value) {
+	overridePackagePath = value || void 0;
+	cachedPackagePath = void 0;
+	cachedDistPath = void 0;
+}
+/**
+* Locate the auth console package. The SSR auth workflow UI ships as
+* `@authup/client-auth-console` (a server-core dependency), so the
+* node_modules ancestor walk from server-core's own package root (locter's
+* `locateUp`) finds it for the workspace (symlink onto
+* apps/client-auth-console) and for a published install alike. Only a
+* positive result is cached.
+*/ function resolveAuthConsolePackagePath() {
+	if (cachedPackagePath) return cachedPackagePath;
+	if (overridePackagePath) {
+		cachedPackagePath = overridePackagePath;
+		return cachedPackagePath;
+	}
+	const manifest = locateUpSync("node_modules/@authup/client-auth-console/package.json", { cwd: PACKAGE_PATH });
+	if (manifest) cachedPackagePath = manifest.directory;
+	return cachedPackagePath;
+}
+/**
+* Locate the BUILT auth console bundle (`dist/client` template + assets,
+* `dist/server/server.js` render entry). Only a positive result is cached —
+* a dev building the package after boot is picked up on the next request.
+*/ function resolveAuthConsoleDistPath() {
+	if (cachedDistPath) return cachedDistPath;
+	const packagePath = resolveAuthConsolePackagePath();
+	if (packagePath) {
+		const distPath = path.join(packagePath, "dist");
+		if (fs.existsSync(path.join(distPath, "client", "index.html"))) cachedDistPath = distPath;
+	}
+	return cachedDistPath;
+}
+//#endregion
+export { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, setAuthConsolePackagePath };
+
+//# sourceMappingURL=resolve.mjs.map

package/dist/adapters/http/ui/auth-console/resolve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.mjs","names":["locateUpSync","fs","path","PACKAGE_PATH","cachedPackagePath","cachedDistPath","overridePackagePath","setAuthConsolePackagePath","value","undefined","resolveAuthConsolePackagePath","manifest","cwd","directory","resolveAuthConsoleDistPath","packagePath","distPath","join","existsSync"],"sources":["../../../../../src/adapters/http/ui/auth-console/resolve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from '../../../../path.ts';\n\nlet cachedPackagePath: string | undefined;\nlet cachedDistPath: string | undefined;\nlet overridePackagePath: string | undefined;\n\n/**\n * Point the resolution at a substituted package (config `authConsolePath`)\n * instead of the node_modules walk. Called once at boot.\n */\nexport function setAuthConsolePackagePath(value: string | undefined) : void {\n    overridePackagePath = value || undefined;\n    cachedPackagePath = undefined;\n    cachedDistPath = undefined;\n}\n\n/**\n * Locate the auth console package. The SSR auth workflow UI ships as\n * `@authup/client-auth-console` (a server-core dependency), so the\n * node_modules ancestor walk from server-core's own package root (locter's\n * `locateUp`) finds it for the workspace (symlink onto\n * apps/client-auth-console) and for a published install alike. Only a\n * positive result is cached.\n */\nexport function resolveAuthConsolePackagePath() : string | undefined {\n    if (cachedPackagePath) {\n        return cachedPackagePath;\n    }\n\n    if (overridePackagePath) {\n        cachedPackagePath = overridePackagePath;\n\n        return cachedPackagePath;\n    }\n\n    const manifest = locateUpSync(\n        'node_modules/@authup/client-auth-console/package.json',\n        { cwd: PACKAGE_PATH },\n    );\n    if (manifest) {\n        cachedPackagePath = manifest.directory;\n    }\n\n    return cachedPackagePath;\n}\n\n/**\n * Locate the BUILT auth console bundle (`dist/client` template + assets,\n * `dist/server/server.js` render entry). Only a positive result is cached —\n * a dev building the package after boot is picked up on the next request.\n */\nexport function resolveAuthConsoleDistPath() : string | undefined {\n    if (cachedDistPath) {\n        return cachedDistPath;\n    }\n\n    const packagePath = resolveAuthConsolePackagePath();\n    if (packagePath) {\n        const distPath = path.join(packagePath, 'dist');\n\n        if (fs.existsSync(path.join(distPath, 'client', 'index.html'))) {\n            cachedDistPath = distPath;\n        }\n    }\n\n    return cachedDistPath;\n}\n"],"mappings":";;;;;;;;AAYA,IAAII;AACJ,IAAIC;AACJ,IAAIC;;;;GAMJ,SAAgBC,0BAA0BC,OAAyB;CAC/DF,sBAAsBE,SAASC,KAAAA;CAC/BL,oBAAoBK,KAAAA;CACpBJ,iBAAiBI,KAAAA;AACrB;;;;;;;;GAUA,SAAgBC,gCAAAA;CACZ,IAAIN,mBACA,OAAOA;CAGX,IAAIE,qBAAqB;EACrBF,oBAAoBE;EAEpB,OAAOF;CACX;CAEA,MAAMO,WAAWX,aACb,yDACA,EAAEY,KAAKT,aAAa,CAAA;CAExB,IAAIQ,UACAP,oBAAoBO,SAASE;CAGjC,OAAOT;AACX;;;;;GAOA,SAAgBU,6BAAAA;CACZ,IAAIT,gBACA,OAAOA;CAGX,MAAMU,cAAcL,8BAAAA;CACpB,IAAIK,aAAa;EACb,MAAMC,WAAWd,KAAKe,KAAKF,aAAa,MAAA;EAExC,IAAId,GAAGiB,WAAWhB,KAAKe,KAAKD,UAAU,UAAU,YAAA,CAAA,GAC5CX,iBAAiBW;CAEzB;CAEA,OAAOX;AACX"}

package/dist/adapters/http/ui/{serve.d.ts → auth-console/serve.d.ts}

@@ -1,12 +1,5 @@
-import type { StatusResponseFeatures } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
-export type ServeWorkflowPageOptions = {
-    url: string;
-    baseURL: string;
-    features: StatusResponseFeatures;
-    realmAware?: boolean;
-    tokenAware?: boolean;
-};
+import type { ServeWorkflowPageOptions } from './types.ts';
 /**
  * Single SSR payload-assembly path for the auth workflow GET routes:
  * whitelists query params, applies the open-redirect guard, and renders.

package/dist/adapters/http/ui/auth-console/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/serve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/adapters/http/ui/{serve.mjs → auth-console/serve.mjs}

@@ -1,11 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { sanitizeRelativeRedirect } from "../request/helpers/redirect.mjs";
-import "../request/index.mjs";
-import { renderUIPage } from "./render.mjs";
+import { sanitizeRelativeRedirect } from "../../request/helpers/redirect.mjs";
+import "../../request/index.mjs";
+import { renderAuthConsolePage } from "./module.mjs";
 import { useRequestQuery } from "@routup/basic/query";
-//#region src/adapters/http/ui/serve.ts
+//#region src/adapters/http/ui/auth-console/serve.ts
 /**
 * Single SSR payload-assembly path for the auth workflow GET routes:
 * whitelists query params, applies the open-redirect guard, and renders.
@@ -21,7 +21,7 @@ import { useRequestQuery } from "@routup/basic/query";
 		data.realmId = typeof realmId === "string" ? realmId : void 0;
 	}
 	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
-	return renderUIPage(event, {
+	return renderAuthConsolePage(event, {
 		url: options.url,
 		payload: {
 			config: { baseURL: options.baseURL },

package/dist/adapters/http/ui/auth-console/serve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderAuthConsolePage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../../src/adapters/http/ui/auth-console/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../../request/index.ts';\nimport { renderAuthConsolePage } from './module.ts';\nimport type { ServeWorkflowPageOptions } from './types.ts';\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderAuthConsolePage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GAkBA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YAAY;EACpB,MAAMC,UAAU,OAAOL,MAAMK,YAAY,WAAWL,MAAMK,UAAUL,MAAMM;EAC1EL,KAAKI,UAAU,OAAOA,YAAY,WAAWA,UAAUE,KAAAA;CAC3D;CAEA,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,sBAAsBE,OAAO;EAChCY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/adapters/http/ui/auth-console/types.d.ts

@@ -0,0 +1,26 @@
+import type { HydrationPayload } from '@authup/client-auth-console';
+import type { StatusResponseFeatures } from '@authup/core-http-kit';
+export type AuthConsoleRenderContext = {
+    url: string;
+    payload: HydrationPayload;
+};
+export type ServeWorkflowPageOptions = {
+    url: string;
+    baseURL: string;
+    features: StatusResponseFeatures;
+    realmAware?: boolean;
+    tokenAware?: boolean;
+};
+export type InternalUIHttpClientContext = {
+    /**
+     * The public base URL (config `publicUrl`) — stays the client's
+     * `baseURL` so URLs rendered into the HTML remain user-facing.
+     */
+    publicURL: string;
+    /**
+     * The server's own listen address (e.g. http://localhost:3010/) —
+     * where the transport actually dispatches requests.
+     */
+    internalURL: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/auth-console/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/adapters/http/ui/auth-console/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/adapters/http/ui/console-packages/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/console-packages/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/console-packages/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/console-packages/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages } from "./module.mjs";
+export { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages };