@authup/server-core 1.0.0-beta.57 → 1.0.0-beta.59

package/dist/adapters/http/ui/theme/contract/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/ui/theme/contract/utils.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAI,MAAM,CAS1D"}

package/dist/adapters/http/ui/theme/contract/utils.mjs

@@ -0,0 +1,22 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/ui/theme/contract/utils.ts
+/**
+* Lowercased file extension of a theme-relative path, including the dot
+* (`assets/logo.SVG` -> `.svg`); empty when there is none.
+*
+* Hand-rolled rather than `node:path`'s extname so this folder stays free
+* of node APIs and can be consumed by a browser-side theme editor.
+* Manifest paths are always POSIX and already grammar-checked, so the
+* separator handling extname does is not needed here.
+*/ function themeAssetExtension(value) {
+	const name = value.slice(value.lastIndexOf("/") + 1);
+	const index = name.lastIndexOf(".");
+	if (index <= 0) return "";
+	return name.slice(index).toLowerCase();
+}
+//#endregion
+export { themeAssetExtension };
+
+//# sourceMappingURL=utils.mjs.map

package/dist/adapters/http/ui/theme/contract/utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.mjs","names":["themeAssetExtension","value","name","slice","lastIndexOf","index","toLowerCase"],"sources":["../../../../../../src/adapters/http/ui/theme/contract/utils.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Lowercased file extension of a theme-relative path, including the dot\n * (`assets/logo.SVG` -> `.svg`); empty when there is none.\n *\n * Hand-rolled rather than `node:path`'s extname so this folder stays free\n * of node APIs and can be consumed by a browser-side theme editor.\n * Manifest paths are always POSIX and already grammar-checked, so the\n * separator handling extname does is not needed here.\n */\nexport function themeAssetExtension(value: string) : string {\n    const name = value.slice(value.lastIndexOf('/') + 1);\n    const index = name.lastIndexOf('.');\n\n    if (index <= 0) {\n        return '';\n    }\n\n    return name.slice(index).toLowerCase();\n}\n"],"mappings":";;;;;;;;;;;;GAgBA,SAAgBA,oBAAoBC,OAAa;CAC7C,MAAMC,OAAOD,MAAME,MAAMF,MAAMG,YAAY,GAAA,IAAO,CAAA;CAClD,MAAMC,QAAQH,KAAKE,YAAY,GAAA;CAE/B,IAAIC,SAAS,GACT,OAAO;CAGX,OAAOH,KAAKC,MAAME,KAAAA,CAAAA,CAAOC,YAAW;AACxC"}

package/dist/adapters/http/ui/theme/index.d.ts

@@ -0,0 +1,7 @@
+export * from './contract/index.ts';
+export * from './apply.ts';
+export * from './assets.ts';
+export * from './constants.ts';
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/theme/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AAEpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/theme/index.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH } from "./contract/constants.mjs";
+import { buildThemeHead, escapeHtml } from "./contract/head.mjs";
+import { themeAssetExtension } from "./contract/utils.mjs";
+import { ThemeManifestValidator, parseThemeManifest } from "./contract/manifest.mjs";
+import "./contract/index.mjs";
+import { applyTheme } from "./apply.mjs";
+import { THEME_ASSET_CSP, THEME_MANIFEST_REVALIDATE_INTERVAL } from "./constants.mjs";
+import { createThemeAssetsHandler } from "./assets.mjs";
+import { ThemeProvider } from "./module.mjs";
+export { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_CSP, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_REVALIDATE_INTERVAL, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH, ThemeManifestValidator, ThemeProvider, applyTheme, buildThemeHead, createThemeAssetsHandler, escapeHtml, parseThemeManifest, themeAssetExtension };

package/dist/adapters/http/ui/theme/module.d.ts

@@ -0,0 +1,79 @@
+import type { Logger } from '@authup/server-kit';
+import type { ThemeManifest } from './contract/index.ts';
+import type { IThemeProvider, ThemeProviderContext } from './types.ts';
+/**
+ * Owns the operator theme directory: manifest loading + validation, the
+ * realpathed servable asset root, and the memoized head markup.
+ *
+ * Failure posture is deliberately asymmetric, and inverts the
+ * FileProvisioningSource precedent for the request path:
+ * - at BOOT an invalid manifest throws, so a typo is reported once, loudly,
+ *   with the file path and every issue.
+ * - AFTER boot a manifest that becomes invalid keeps the last good value and
+ *   logs. Provisioning seeds authorization data; a theme is decoration, and
+ *   a broken logo must never take down the login page of an identity
+ *   provider.
+ */
+export declare class ThemeProvider implements IThemeProvider {
+    protected readonly directoryPath: string;
+    protected readonly manifestPath: string;
+    protected readonly fragmentPath: string;
+    protected readonly fragmentsEnabled: boolean;
+    protected readonly logger: Logger | undefined;
+    protected manifest: ThemeManifest | undefined;
+    protected headFragment: string | undefined;
+    protected assetsPath: string | undefined;
+    protected manifestSignature: string | undefined;
+    protected fragmentSignature: string | undefined;
+    protected revalidatedAt: number;
+    protected headCache: Map<string, string>;
+    constructor(ctx: ThemeProviderContext);
+    load(): Promise<void>;
+    getManifest(): Promise<ThemeManifest | undefined>;
+    getAssetsPath(): Promise<string | undefined>;
+    getHead(basePath: string): Promise<string>;
+    /**
+     * The mount root is `<root>/assets`, never the theme root, so the
+     * manifest is unreachable over HTTP by construction.
+     *
+     * Returns the LOGICAL path, deliberately not a realpath. A Kubernetes
+     * ConfigMap volume is a symlink farm whose update swaps `..data` to a
+     * NEW timestamped directory and deletes the old one, so a realpath
+     * captured here would dangle after the first update and every asset
+     * would 404 until the pod restarts. The asset handler resolves and
+     * re-asserts containment per request instead.
+     */
+    protected resolveAssetsPath(): Promise<string | undefined>;
+    /**
+     * Read + decode the manifest through locter, the same loader
+     * FileProvisioningSource uses for its operator files. Its JSON reader
+     * is a plain read-and-parse with no content cache, so the live reload
+     * below still sees an edited file.
+     */
+    protected readManifest(): Promise<unknown>;
+    protected readSignature(filePath: string): string | undefined;
+    /**
+     * Read `fragments/head.html`. Never called when the operator has not
+     * opted in, so dropping the file into the directory does nothing on
+     * its own.
+     */
+    protected readFragment(): string | undefined;
+    /**
+     * Re-read the manifest when it changed on disk, at most once per
+     * interval. One stat per console render is negligible next to the SSR
+     * pass it precedes, and it is what makes an edit visible without a
+     * restart (the property every operator asks about first).
+     */
+    protected revalidate(): Promise<void>;
+    protected revalidateManifest(): Promise<void>;
+    protected revalidateFragment(): void;
+    /**
+     * Always logged. The dominant failure mode of this feature is silence:
+     * mount the wrong path and the page looks exactly like an un-themed
+     * page. An enumerable boot summary is both the cheapest debugging
+     * affordance and the cheapest way to notice a file that should not be
+     * in the volume.
+     */
+    protected logInventory(): void;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/ui/theme/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAejD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,YAAW,cAAc;IAChD,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAG,MAAM,CAAC;IAE1C,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAG,MAAM,CAAC;IAEzC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAG,MAAM,CAAC;IAEzC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAG,OAAO,CAAC;IAE9C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAG,MAAM,GAAG,SAAS,CAAC;IAE/C,SAAS,CAAC,QAAQ,EAAG,aAAa,GAAG,SAAS,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAG,MAAM,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,MAAM,GAAG,SAAS,CAAC;IAE1C,SAAS,CAAC,iBAAiB,EAAG,MAAM,GAAG,SAAS,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,MAAM,GAAG,SAAS,CAAC;IAEjD,SAAS,CAAC,aAAa,SAAK;IAE5B,SAAS,CAAC,SAAS,sBAA6B;gBAEpC,GAAG,EAAE,oBAAoB;IAY/B,IAAI,IAAK,OAAO,CAAC,IAAI,CAAC;IAsBtB,WAAW,IAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAMlD,aAAa,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAM7C,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAqBjD;;;;;;;;;;OAUG;cACa,iBAAiB,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAajE;;;;;OAKG;cACa,YAAY,IAAK,OAAO,CAAC,OAAO,CAAC;IAYjD,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;IAU9D;;;;OAIG;IACH,SAAS,CAAC,YAAY,IAAK,MAAM,GAAG,SAAS;IAqB7C;;;;;OAKG;cACa,UAAU,IAAK,OAAO,CAAC,IAAI,CAAC;cAkB5B,kBAAkB,IAAK,OAAO,CAAC,IAAI,CAAC;IA2BpD,SAAS,CAAC,kBAAkB,IAAK,IAAI;IAiBrC;;;;;;OAMG;IACH,SAAS,CAAC,YAAY,IAAK,IAAI;CAoDlC"}

package/dist/adapters/http/ui/theme/module.mjs

@@ -0,0 +1,206 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { THEME_ASSETS_DIRECTORY_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_MANIFEST_FILE_NAME } from "./contract/constants.mjs";
+import { buildThemeHead } from "./contract/head.mjs";
+import { parseThemeManifest } from "./contract/manifest.mjs";
+import "./contract/index.mjs";
+import "./constants.mjs";
+import { AuthupError, normalizeError } from "@authup/errors";
+import path from "node:path";
+import { read } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/theme/module.ts
+/**
+* Owns the operator theme directory: manifest loading + validation, the
+* realpathed servable asset root, and the memoized head markup.
+*
+* Failure posture is deliberately asymmetric, and inverts the
+* FileProvisioningSource precedent for the request path:
+* - at BOOT an invalid manifest throws, so a typo is reported once, loudly,
+*   with the file path and every issue.
+* - AFTER boot a manifest that becomes invalid keeps the last good value and
+*   logs. Provisioning seeds authorization data; a theme is decoration, and
+*   a broken logo must never take down the login page of an identity
+*   provider.
+*/ var ThemeProvider = class {
+	directoryPath;
+	manifestPath;
+	fragmentPath;
+	fragmentsEnabled;
+	logger;
+	manifest;
+	headFragment;
+	assetsPath;
+	manifestSignature;
+	fragmentSignature;
+	revalidatedAt = 0;
+	headCache = /* @__PURE__ */ new Map();
+	constructor(ctx) {
+		this.directoryPath = ctx.directoryPath;
+		this.fragmentsEnabled = ctx.fragmentsEnabled ?? false;
+		this.logger = ctx.logger;
+		this.manifestPath = path.join(ctx.directoryPath, THEME_MANIFEST_FILE_NAME);
+		this.fragmentPath = path.join(ctx.directoryPath, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME);
+	}
+	async load() {
+		this.assetsPath = await this.resolveAssetsPath();
+		this.manifestSignature = this.readSignature(this.manifestPath);
+		if (this.manifestSignature) this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);
+		if (this.fragmentsEnabled) {
+			this.headFragment = this.readFragment();
+			this.fragmentSignature = this.readSignature(this.fragmentPath);
+		}
+		this.revalidatedAt = Date.now();
+		this.headCache.clear();
+		this.logInventory();
+	}
+	async getManifest() {
+		await this.revalidate();
+		return this.manifest;
+	}
+	async getAssetsPath() {
+		await this.revalidate();
+		return this.assetsPath;
+	}
+	async getHead(basePath) {
+		const manifest = await this.getManifest();
+		const cached = this.headCache.get(basePath);
+		if (typeof cached === "string") return cached;
+		const head = buildThemeHead(manifest ?? { version: 1 }, basePath, this.headFragment);
+		this.headCache.set(basePath, head);
+		return head;
+	}
+	/**
+	* The mount root is `<root>/assets`, never the theme root, so the
+	* manifest is unreachable over HTTP by construction.
+	*
+	* Returns the LOGICAL path, deliberately not a realpath. A Kubernetes
+	* ConfigMap volume is a symlink farm whose update swaps `..data` to a
+	* NEW timestamped directory and deletes the old one, so a realpath
+	* captured here would dangle after the first update and every asset
+	* would 404 until the pod restarts. The asset handler resolves and
+	* re-asserts containment per request instead.
+	*/ async resolveAssetsPath() {
+		const assetsPath = path.join(this.directoryPath, THEME_ASSETS_DIRECTORY_NAME);
+		try {
+			return (await fs.promises.stat(assetsPath)).isDirectory() ? assetsPath : void 0;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Read + decode the manifest through locter, the same loader
+	* FileProvisioningSource uses for its operator files. Its JSON reader
+	* is a plain read-and-parse with no content cache, so the live reload
+	* below still sees an edited file.
+	*/ async readManifest() {
+		try {
+			return await read(this.manifestPath);
+		} catch (e) {
+			const reason = normalizeError(e).message;
+			throw new AuthupError(`The theme manifest "${this.manifestPath}" could not be read.\n  ${reason}`);
+		}
+	}
+	readSignature(filePath) {
+		try {
+			const stats = fs.statSync(filePath);
+			return `${stats.size}-${stats.mtimeMs}`;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Read `fragments/head.html`. Never called when the operator has not
+	* opted in, so dropping the file into the directory does nothing on
+	* its own.
+	*/ readFragment() {
+		let raw;
+		try {
+			raw = fs.readFileSync(this.fragmentPath, "utf-8");
+		} catch {
+			return;
+		}
+		if (raw.length > 65536) {
+			this.logger?.warn(`The head fragment "${this.fragmentPath}" exceeds ${THEME_HEAD_FRAGMENT_MAX_LENGTH} bytes and is ignored.`);
+			return;
+		}
+		const trimmed = raw.trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	}
+	/**
+	* Re-read the manifest when it changed on disk, at most once per
+	* interval. One stat per console render is negligible next to the SSR
+	* pass it precedes, and it is what makes an edit visible without a
+	* restart (the property every operator asks about first).
+	*/ async revalidate() {
+		const now = Date.now();
+		if (now - this.revalidatedAt < 1e3) return;
+		this.revalidatedAt = now;
+		this.assetsPath = await this.resolveAssetsPath();
+		await this.revalidateManifest();
+		this.revalidateFragment();
+	}
+	async revalidateManifest() {
+		const signature = this.readSignature(this.manifestPath);
+		if (signature === this.manifestSignature) return;
+		if (typeof signature === "undefined") {
+			this.manifestSignature = void 0;
+			this.manifest = void 0;
+			this.headCache.clear();
+			return;
+		}
+		this.manifestSignature = signature;
+		try {
+			this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);
+			this.headCache.clear();
+		} catch (e) {
+			const reason = normalizeError(e).message;
+			this.logger?.warn(`The theme manifest changed but is invalid, keeping the previous one.\n${reason}`);
+		}
+	}
+	revalidateFragment() {
+		if (!this.fragmentsEnabled) return;
+		const signature = this.readSignature(this.fragmentPath);
+		if (signature === this.fragmentSignature) return;
+		this.fragmentSignature = signature;
+		this.headFragment = typeof signature === "undefined" ? void 0 : this.readFragment();
+		this.headCache.clear();
+	}
+	/**
+	* Always logged. The dominant failure mode of this feature is silence:
+	* mount the wrong path and the page looks exactly like an un-themed
+	* page. An enumerable boot summary is both the cheapest debugging
+	* affordance and the cheapest way to notice a file that should not be
+	* in the volume.
+	*/ logInventory() {
+		if (!this.logger) return;
+		this.logger.info(`Theme directory: ${this.directoryPath} (theming is EXPERIMENTAL and may change in a minor release)`);
+		if (this.manifest) {
+			const tokens = Object.keys(this.manifest.tokens ?? {}).length;
+			const tokensDark = Object.keys(this.manifest.tokensDark ?? {}).length;
+			this.logger.info(`Theme manifest: loaded (${tokens} token(s), ${tokensDark} dark token(s))`);
+		} else this.logger.info(`Theme manifest: none (no ${THEME_MANIFEST_FILE_NAME})`);
+		if (!this.fragmentsEnabled) this.logger.info("Theme head fragment: disabled (themeFragmentsEnabled is off)");
+		else if (this.headFragment) this.logger.info(`Theme head fragment: loaded (${this.headFragment.length} bytes from ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`);
+		else this.logger.info(`Theme head fragment: none (no ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`);
+		if (!this.assetsPath) {
+			this.logger.info(`Theme assets: none (no ${THEME_ASSETS_DIRECTORY_NAME}/ directory)`);
+			return;
+		}
+		let files;
+		try {
+			files = fs.readdirSync(this.assetsPath, {
+				recursive: true,
+				withFileTypes: true
+			}).filter((entry) => entry.isFile()).map((entry) => path.relative(this.assetsPath, path.join(entry.parentPath, entry.name)).split(path.sep).join("/")).sort();
+		} catch {
+			files = [];
+		}
+		this.logger.info(`Theme assets (${files.length}): ${files.join(", ") || "-"}`);
+	}
+};
+//#endregion
+export { ThemeProvider };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/ui/theme/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["AuthupError","normalizeError","read","fs","path","THEME_MANIFEST_REVALIDATE_INTERVAL","THEME_ASSETS_DIRECTORY_NAME","THEME_FRAGMENTS_DIRECTORY_NAME","THEME_HEAD_FRAGMENT_FILE_NAME","THEME_HEAD_FRAGMENT_MAX_LENGTH","THEME_MANIFEST_FILE_NAME","THEME_MANIFEST_VERSION","buildThemeHead","parseThemeManifest","ThemeProvider","directoryPath","manifestPath","fragmentPath","fragmentsEnabled","logger","manifest","headFragment","assetsPath","manifestSignature","fragmentSignature","revalidatedAt","headCache","Map","ctx","join","load","resolveAssetsPath","readSignature","readManifest","readFragment","Date","now","clear","logInventory","getManifest","revalidate","getAssetsPath","getHead","basePath","cached","get","head","version","set","stats","promises","stat","isDirectory","undefined","e","reason","message","filePath","statSync","size","mtimeMs","raw","readFileSync","length","warn","trimmed","trim","revalidateManifest","revalidateFragment","signature","info","tokens","Object","keys","tokensDark","files","readdirSync","recursive","withFileTypes","filter","entry","isFile","map","relative","parentPath","name","split","sep","sort"],"sources":["../../../../../src/adapters/http/ui/theme/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, normalizeError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { THEME_MANIFEST_REVALIDATE_INTERVAL } from './constants.ts';\nimport {\n    THEME_ASSETS_DIRECTORY_NAME,\n    THEME_FRAGMENTS_DIRECTORY_NAME,\n    THEME_HEAD_FRAGMENT_FILE_NAME,\n    THEME_HEAD_FRAGMENT_MAX_LENGTH,\n    THEME_MANIFEST_FILE_NAME,\n    THEME_MANIFEST_VERSION,\n    buildThemeHead,\n    parseThemeManifest,\n} from './contract/index.ts';\nimport type { ThemeManifest } from './contract/index.ts';\nimport type { IThemeProvider, ThemeProviderContext } from './types.ts';\n\n/**\n * Owns the operator theme directory: manifest loading + validation, the\n * realpathed servable asset root, and the memoized head markup.\n *\n * Failure posture is deliberately asymmetric, and inverts the\n * FileProvisioningSource precedent for the request path:\n * - at BOOT an invalid manifest throws, so a typo is reported once, loudly,\n *   with the file path and every issue.\n * - AFTER boot a manifest that becomes invalid keeps the last good value and\n *   logs. Provisioning seeds authorization data; a theme is decoration, and\n *   a broken logo must never take down the login page of an identity\n *   provider.\n */\nexport class ThemeProvider implements IThemeProvider {\n    protected readonly directoryPath : string;\n\n    protected readonly manifestPath : string;\n\n    protected readonly fragmentPath : string;\n\n    protected readonly fragmentsEnabled : boolean;\n\n    protected readonly logger : Logger | undefined;\n\n    protected manifest : ThemeManifest | undefined;\n\n    protected headFragment : string | undefined;\n\n    protected assetsPath : string | undefined;\n\n    protected manifestSignature : string | undefined;\n\n    protected fragmentSignature : string | undefined;\n\n    protected revalidatedAt = 0;\n\n    protected headCache = new Map<string, string>();\n\n    constructor(ctx: ThemeProviderContext) {\n        this.directoryPath = ctx.directoryPath;\n        this.fragmentsEnabled = ctx.fragmentsEnabled ?? false;\n        this.logger = ctx.logger;\n        this.manifestPath = path.join(ctx.directoryPath, THEME_MANIFEST_FILE_NAME);\n        this.fragmentPath = path.join(\n            ctx.directoryPath,\n            THEME_FRAGMENTS_DIRECTORY_NAME,\n            THEME_HEAD_FRAGMENT_FILE_NAME,\n        );\n    }\n\n    async load() : Promise<void> {\n        this.assetsPath = await this.resolveAssetsPath();\n\n        // Stat first: it doubles as the existence probe (no manifest is a\n        // valid theme — the operator may ship only a stylesheet) and as the\n        // revalidation signature.\n        this.manifestSignature = this.readSignature(this.manifestPath);\n        if (this.manifestSignature) {\n            this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);\n        }\n\n        if (this.fragmentsEnabled) {\n            this.headFragment = this.readFragment();\n            this.fragmentSignature = this.readSignature(this.fragmentPath);\n        }\n\n        this.revalidatedAt = Date.now();\n        this.headCache.clear();\n\n        this.logInventory();\n    }\n\n    async getManifest() : Promise<ThemeManifest | undefined> {\n        await this.revalidate();\n\n        return this.manifest;\n    }\n\n    async getAssetsPath() : Promise<string | undefined> {\n        await this.revalidate();\n\n        return this.assetsPath;\n    }\n\n    async getHead(basePath: string) : Promise<string> {\n        // Drives the revalidation for both files.\n        const manifest = await this.getManifest();\n\n        const cached = this.headCache.get(basePath);\n        if (typeof cached === 'string') {\n            return cached;\n        }\n\n        const head = buildThemeHead(\n            manifest ?? { version: THEME_MANIFEST_VERSION },\n            basePath,\n            this.headFragment,\n        );\n        this.headCache.set(basePath, head);\n\n        return head;\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * The mount root is `<root>/assets`, never the theme root, so the\n     * manifest is unreachable over HTTP by construction.\n     *\n     * Returns the LOGICAL path, deliberately not a realpath. A Kubernetes\n     * ConfigMap volume is a symlink farm whose update swaps `..data` to a\n     * NEW timestamped directory and deletes the old one, so a realpath\n     * captured here would dangle after the first update and every asset\n     * would 404 until the pod restarts. The asset handler resolves and\n     * re-asserts containment per request instead.\n     */\n    protected async resolveAssetsPath() : Promise<string | undefined> {\n        const assetsPath = path.join(this.directoryPath, THEME_ASSETS_DIRECTORY_NAME);\n\n        try {\n            // stat follows the symlink, so this still rejects a non-directory.\n            const stats = await fs.promises.stat(assetsPath);\n\n            return stats.isDirectory() ? assetsPath : undefined;\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Read + decode the manifest through locter, the same loader\n     * FileProvisioningSource uses for its operator files. Its JSON reader\n     * is a plain read-and-parse with no content cache, so the live reload\n     * below still sees an edited file.\n     */\n    protected async readManifest() : Promise<unknown> {\n        try {\n            return await read(this.manifestPath);\n        } catch (e) {\n            const reason = normalizeError(e).message;\n\n            throw new AuthupError(\n                `The theme manifest \"${this.manifestPath}\" could not be read.\\n  ${reason}`,\n            );\n        }\n    }\n\n    protected readSignature(filePath: string) : string | undefined {\n        try {\n            const stats = fs.statSync(filePath);\n\n            return `${stats.size}-${stats.mtimeMs}`;\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Read `fragments/head.html`. Never called when the operator has not\n     * opted in, so dropping the file into the directory does nothing on\n     * its own.\n     */\n    protected readFragment() : string | undefined {\n        let raw : string;\n        try {\n            raw = fs.readFileSync(this.fragmentPath, 'utf-8');\n        } catch {\n            return undefined;\n        }\n\n        if (raw.length > THEME_HEAD_FRAGMENT_MAX_LENGTH) {\n            this.logger?.warn(\n                `The head fragment \"${this.fragmentPath}\" exceeds ${THEME_HEAD_FRAGMENT_MAX_LENGTH} bytes and is ignored.`,\n            );\n\n            return undefined;\n        }\n\n        const trimmed = raw.trim();\n\n        return trimmed.length > 0 ? trimmed : undefined;\n    }\n\n    /**\n     * Re-read the manifest when it changed on disk, at most once per\n     * interval. One stat per console render is negligible next to the SSR\n     * pass it precedes, and it is what makes an edit visible without a\n     * restart (the property every operator asks about first).\n     */\n    protected async revalidate() : Promise<void> {\n        const now = Date.now();\n        if (now - this.revalidatedAt < THEME_MANIFEST_REVALIDATE_INTERVAL) {\n            return;\n        }\n        this.revalidatedAt = now;\n\n        // Re-resolved with the manifest, not captured at boot: a directory\n        // that carried no `assets/` when the process started would otherwise\n        // 404 every asset forever, even though the manifest hot-reloads and\n        // can start referencing them. One stat, on the interval that already\n        // pays for two.\n        this.assetsPath = await this.resolveAssetsPath();\n\n        await this.revalidateManifest();\n        this.revalidateFragment();\n    }\n\n    protected async revalidateManifest() : Promise<void> {\n        const signature = this.readSignature(this.manifestPath);\n        if (signature === this.manifestSignature) {\n            return;\n        }\n\n        if (typeof signature === 'undefined') {\n            this.manifestSignature = undefined;\n            this.manifest = undefined;\n            this.headCache.clear();\n\n            return;\n        }\n\n        // Stamped before the parse attempt so a persistently broken file is\n        // re-parsed once per edit, not once per render.\n        this.manifestSignature = signature;\n\n        try {\n            this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);\n            this.headCache.clear();\n        } catch (e) {\n            const reason = normalizeError(e).message;\n            this.logger?.warn(`The theme manifest changed but is invalid, keeping the previous one.\\n${reason}`);\n        }\n    }\n\n    protected revalidateFragment() : void {\n        if (!this.fragmentsEnabled) {\n            return;\n        }\n\n        const signature = this.readSignature(this.fragmentPath);\n        if (signature === this.fragmentSignature) {\n            return;\n        }\n\n        this.fragmentSignature = signature;\n        this.headFragment = typeof signature === 'undefined' ?\n            undefined :\n            this.readFragment();\n        this.headCache.clear();\n    }\n\n    /**\n     * Always logged. The dominant failure mode of this feature is silence:\n     * mount the wrong path and the page looks exactly like an un-themed\n     * page. An enumerable boot summary is both the cheapest debugging\n     * affordance and the cheapest way to notice a file that should not be\n     * in the volume.\n     */\n    protected logInventory() : void {\n        if (!this.logger) {\n            return;\n        }\n\n        this.logger.info(\n            `Theme directory: ${this.directoryPath} (theming is EXPERIMENTAL and may change in a minor release)`,\n        );\n\n        if (this.manifest) {\n            const tokens = Object.keys(this.manifest.tokens ?? {}).length;\n            const tokensDark = Object.keys(this.manifest.tokensDark ?? {}).length;\n            this.logger.info(\n                `Theme manifest: loaded (${tokens} token(s), ${tokensDark} dark token(s))`,\n            );\n        } else {\n            this.logger.info(`Theme manifest: none (no ${THEME_MANIFEST_FILE_NAME})`);\n        }\n\n        if (!this.fragmentsEnabled) {\n            this.logger.info('Theme head fragment: disabled (themeFragmentsEnabled is off)');\n        } else if (this.headFragment) {\n            this.logger.info(\n                `Theme head fragment: loaded (${this.headFragment.length} bytes from ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`,\n            );\n        } else {\n            this.logger.info(\n                `Theme head fragment: none (no ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`,\n            );\n        }\n\n        if (!this.assetsPath) {\n            this.logger.info(`Theme assets: none (no ${THEME_ASSETS_DIRECTORY_NAME}/ directory)`);\n\n            return;\n        }\n\n        let files : string[];\n        try {\n            files = fs.readdirSync(this.assetsPath, { recursive: true, withFileTypes: true })\n                .filter((entry) => entry.isFile())\n                .map((entry) => path\n                    .relative(this.assetsPath as string, path.join(entry.parentPath, entry.name))\n                    .split(path.sep)\n                    .join('/'))\n                .sort();\n        } catch {\n            files = [];\n        }\n\n        this.logger.info(`Theme assets (${files.length}): ${files.join(', ') || '-'}`);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAuCA,IAAac,gBAAb,MAAaA;CACUC;CAEAC;CAEAC;CAEAC;CAEAC;CAETC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC,gBAAgB;CAEhBC,4BAAY,IAAIC,IAAAA;CAE1B,YAAYC,KAA2B;EACnC,KAAKb,gBAAgBa,IAAIb;EACzB,KAAKG,mBAAmBU,IAAIV,oBAAoB;EAChD,KAAKC,SAASS,IAAIT;EAClB,KAAKH,eAAeZ,KAAKyB,KAAKD,IAAIb,eAAeL,wBAAAA;EACjD,KAAKO,eAAeb,KAAKyB,KACrBD,IAAIb,eACJR,gCACAC,6BAAAA;CAER;CAEA,MAAMsB,OAAuB;EACzB,KAAKR,aAAa,MAAM,KAAKS,kBAAiB;EAK9C,KAAKR,oBAAoB,KAAKS,cAAc,KAAKhB,YAAY;EAC7D,IAAI,KAAKO,mBACL,KAAKH,WAAW,MAAMP,mBAAmB,MAAM,KAAKoB,aAAY,GAAI,KAAKjB,YAAY;EAGzF,IAAI,KAAKE,kBAAkB;GACvB,KAAKG,eAAe,KAAKa,aAAY;GACrC,KAAKV,oBAAoB,KAAKQ,cAAc,KAAKf,YAAY;EACjE;EAEA,KAAKQ,gBAAgBU,KAAKC,IAAG;EAC7B,KAAKV,UAAUW,MAAK;EAEpB,KAAKC,aAAY;CACrB;CAEA,MAAMC,cAAmD;EACrD,MAAM,KAAKC,WAAU;EAErB,OAAO,KAAKpB;CAChB;CAEA,MAAMqB,gBAA8C;EAChD,MAAM,KAAKD,WAAU;EAErB,OAAO,KAAKlB;CAChB;CAEA,MAAMoB,QAAQC,UAAoC;EAE9C,MAAMvB,WAAW,MAAM,KAAKmB,YAAW;EAEvC,MAAMK,SAAS,KAAKlB,UAAUmB,IAAIF,QAAAA;EAClC,IAAI,OAAOC,WAAW,UAClB,OAAOA;EAGX,MAAME,OAAOlC,eACTQ,YAAY,EAAE2B,SAAAA,EAAgC,GAC9CJ,UACA,KAAKtB,YAAY;EAErB,KAAKK,UAAUsB,IAAIL,UAAUG,IAAAA;EAE7B,OAAOA;CACX;;;;;;;;;;;IAeA,MAAgBf,oBAAkD;EAC9D,MAAMT,aAAalB,KAAKyB,KAAK,KAAKd,eAAeT,2BAAAA;EAEjD,IAAI;GAIA,QAAO2C,MAFa9C,GAAG+C,SAASC,KAAK7B,UAAAA,EAAAA,CAExB8B,YAAW,IAAK9B,aAAa+B,KAAAA;EAC9C,QAAQ;GACJ;EACJ;CACJ;;;;;;IAQA,MAAgBpB,eAAkC;EAC9C,IAAI;GACA,OAAO,MAAM/B,KAAK,KAAKc,YAAY;EACvC,SAASsC,GAAG;GACR,MAAMC,SAAStD,eAAeqD,CAAAA,CAAAA,CAAGE;GAEjC,MAAM,IAAIxD,YACN,uBAAuB,KAAKgB,aAAa,0BAA0BuC,QAAQ;EAEnF;CACJ;CAEUvB,cAAcyB,UAAuC;EAC3D,IAAI;GACA,MAAMR,QAAQ9C,GAAGuD,SAASD,QAAAA;GAE1B,OAAO,GAAGR,MAAMU,KAAK,GAAGV,MAAMW;EAClC,QAAQ;GACJ;EACJ;CACJ;;;;;IAOA,eAA8C;EAC1C,IAAIC;EACJ,IAAI;GACAA,MAAM1D,GAAG2D,aAAa,KAAK7C,cAAc,OAAA;EAC7C,QAAQ;GACJ;EACJ;EAEA,IAAI4C,IAAIE,SAAAA,OAAyC;GAC7C,KAAK5C,QAAQ6C,KACT,sBAAsB,KAAK/C,aAAa,YAAYR,+BAA+B,uBAAuB;GAG9G;EACJ;EAEA,MAAMwD,UAAUJ,IAAIK,KAAI;EAExB,OAAOD,QAAQF,SAAS,IAAIE,UAAUZ,KAAAA;CAC1C;;;;;;IAQA,MAAgBb,aAA6B;EACzC,MAAMJ,MAAMD,KAAKC,IAAG;EACpB,IAAIA,MAAM,KAAKX,gBAAAA,KACX;EAEJ,KAAKA,gBAAgBW;EAOrB,KAAKd,aAAa,MAAM,KAAKS,kBAAiB;EAE9C,MAAM,KAAKoC,mBAAkB;EAC7B,KAAKC,mBAAkB;CAC3B;CAEA,MAAgBD,qBAAqC;EACjD,MAAME,YAAY,KAAKrC,cAAc,KAAKhB,YAAY;EACtD,IAAIqD,cAAc,KAAK9C,mBACnB;EAGJ,IAAI,OAAO8C,cAAc,aAAa;GAClC,KAAK9C,oBAAoB8B,KAAAA;GACzB,KAAKjC,WAAWiC,KAAAA;GAChB,KAAK3B,UAAUW,MAAK;GAEpB;EACJ;EAIA,KAAKd,oBAAoB8C;EAEzB,IAAI;GACA,KAAKjD,WAAW,MAAMP,mBAAmB,MAAM,KAAKoB,aAAY,GAAI,KAAKjB,YAAY;GACrF,KAAKU,UAAUW,MAAK;EACxB,SAASiB,GAAG;GACR,MAAMC,SAAStD,eAAeqD,CAAAA,CAAAA,CAAGE;GACjC,KAAKrC,QAAQ6C,KAAK,yEAAyET,QAAQ;EACvG;CACJ;CAEUa,qBAA4B;EAClC,IAAI,CAAC,KAAKlD,kBACN;EAGJ,MAAMmD,YAAY,KAAKrC,cAAc,KAAKf,YAAY;EACtD,IAAIoD,cAAc,KAAK7C,mBACnB;EAGJ,KAAKA,oBAAoB6C;EACzB,KAAKhD,eAAe,OAAOgD,cAAc,cACrChB,KAAAA,IACA,KAAKnB,aAAY;EACrB,KAAKR,UAAUW,MAAK;CACxB;;;;;;;IASA,eAAgC;EAC5B,IAAI,CAAC,KAAKlB,QACN;EAGJ,KAAKA,OAAOmD,KACR,oBAAoB,KAAKvD,cAAc,6DAA6D;EAGxG,IAAI,KAAKK,UAAU;GACf,MAAMmD,SAASC,OAAOC,KAAK,KAAKrD,SAASmD,UAAU,CAAC,CAAA,CAAA,CAAGR;GACvD,MAAMW,aAAaF,OAAOC,KAAK,KAAKrD,SAASsD,cAAc,CAAC,CAAA,CAAA,CAAGX;GAC/D,KAAK5C,OAAOmD,KACR,2BAA2BC,OAAO,aAAaG,WAAW,gBAAgB;EAElF,OACI,KAAKvD,OAAOmD,KAAK,4BAA4B5D,yBAAyB,EAAE;EAG5E,IAAI,CAAC,KAAKQ,kBACN,KAAKC,OAAOmD,KAAK,8DAAA;OACd,IAAI,KAAKjD,cACZ,KAAKF,OAAOmD,KACR,gCAAgC,KAAKjD,aAAa0C,OAAO,cAAcxD,+BAA+B,GAAGC,8BAA8B,EAAE;OAG7I,KAAKW,OAAOmD,KACR,iCAAiC/D,+BAA+B,GAAGC,8BAA8B,EAAE;EAI3G,IAAI,CAAC,KAAKc,YAAY;GAClB,KAAKH,OAAOmD,KAAK,0BAA0BhE,4BAA4B,aAAa;GAEpF;EACJ;EAEA,IAAIqE;EACJ,IAAI;GACAA,QAAQxE,GAAGyE,YAAY,KAAKtD,YAAY;IAAEuD,WAAW;IAAMC,eAAe;GAAK,CAAA,CAAA,CAC1EC,QAAQC,UAAUA,MAAMC,OAAM,CAAA,CAAA,CAC9BC,KAAKF,UAAU5E,KACX+E,SAAS,KAAK7D,YAAsBlB,KAAKyB,KAAKmD,MAAMI,YAAYJ,MAAMK,IAAI,CAAA,CAAA,CAC1EC,MAAMlF,KAAKmF,GAAG,CAAA,CACd1D,KAAK,GAAA,CAAA,CAAA,CACT2D,KAAI;EACb,QAAQ;GACJb,QAAQ,CAAA;EACZ;EAEA,KAAKxD,OAAOmD,KAAK,iBAAiBK,MAAMZ,OAAO,KAAKY,MAAM9C,KAAK,IAAA,KAAS,KAAK;CACjF;AACJ"}

package/dist/adapters/http/ui/theme/types.d.ts

@@ -0,0 +1,42 @@
+import type { Logger } from '@authup/server-kit';
+import type { ThemeManifest } from './contract/index.ts';
+export type ThemeProviderContext = {
+    /**
+     * Absolute path of the theme root (normalizeConfig resolves a relative
+     * value against the rootPath).
+     */
+    directoryPath: string;
+    /**
+     * Opt in to reading `fragments/head.html`. Default off: the fragment
+     * is unsanitized markup served on the IdP origin.
+     */
+    fragmentsEnabled?: boolean;
+    logger?: Logger;
+};
+export interface IThemeProvider {
+    /**
+     * Read + validate the manifest and resolve the servable asset root.
+     * Throws on an invalid manifest, so a typo fails the boot rather than
+     * silently rendering an un-themed page.
+     */
+    load(): Promise<void>;
+    /**
+     * The current manifest, re-read when the file changed on disk. Returns
+     * undefined when the directory carries no manifest (Layer 2 only).
+     *
+     * Async because validation runs through validup. The re-read is
+     * debounced and the head is memoized, so a steady-state render awaits
+     * an already-resolved value.
+     */
+    getManifest(): Promise<ThemeManifest | undefined>;
+    /**
+     * The realpathed `<root>/assets` directory, or undefined when absent.
+     * Every served path is re-checked against this value.
+     */
+    getAssetsPath(): Promise<string | undefined>;
+    /**
+     * The markup injected before `</head>`, memoized per base path.
+     */
+    getHead(basePath: string): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/theme/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,cAAc;IAC3B;;;;OAIG;IACH,IAAI,IAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;;OAOG;IACH,WAAW,IAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAEnD;;;OAGG;IACH,aAAa,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE9C;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C"}

package/dist/adapters/http/ui/theme/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/app/index.mjs

@@ -57,6 +57,8 @@ import { LDAPInjectionKey } from "./modules/ldap/constants.mjs";
 import { LdapModule } from "./modules/ldap/module.mjs";
 import { IdentityModule } from "./modules/identity/module.mjs";
 import { OAuth2Module } from "./modules/oauth2/module.mjs";
+import { ProvisioningInjectionKey } from "./modules/provisioning/constants.mjs";
+import { LazyWildcardRealmProvisioner } from "./modules/provisioning/lazy-wildcard.mjs";
 import { MailInjectionKey, MailTemplateRendererInjectionKey } from "./modules/mail/constants.mjs";
 import { MailModule } from "./modules/mail/module.mjs";
 import { HTTPModule } from "./modules/http/module.mjs";
@@ -68,4 +70,4 @@ import { RuntimeModule } from "./modules/runtime/module.mjs";
 import "./modules/index.mjs";
 import { ApplicationBuilder } from "./builder.mjs";
 import { createApplication } from "./factory.mjs";
-export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };
+export { ApplicationBuilder, AuthenticationInjectionKey, AuthenticationModule, CacheInjectionKey, CacheModule, ClientIdentityRepository, ClientPermissionRepositoryAdapter, ClientRepositoryAdapter, ClientRoleRepositoryAdapter, ClientScopeRepositoryAdapter, ComponentsModule, CompositeProvisioningSource, ConfigEnvironmentVariableName, ConfigInjectionKey, ConfigModule, DatabaseInjectionKey, DatabaseModule, DefaultProvisioningSource, EventRepositoryAdapter, FileProvisioningSource, HTTPInjectionKey, HTTPModule, IdentityInjectionKey, IdentityModule, IdentityProviderAccountRepository, IdentityProviderAttributeMappingRepository, IdentityProviderPermissionMappingRepository, IdentityProviderRepositoryAdapter, IdentityProviderRoleMappingRepository, IdentityProviderRoleMappingRepositoryAdapter, KeyRepositoryAdapter, LDAPInjectionKey, LazyWildcardRealmProvisioner, LdapModule, LoggerInjectionKey, LoggerModule, MailInjectionKey, MailModule, MailTemplateRendererInjectionKey, MetricsInjectionKey, ModuleName, OAuth2InjectionToken, OAuth2Module, PermissionDatabaseProvider, PermissionPolicyRepositoryAdapter, PermissionRepositoryAdapter, PolicyRepositoryAdapter, PromAuthFlowMetrics, ProvisionerModule, ProvisioningInjectionKey, RealmRepositoryAdapter, RoleAttributeRepositoryAdapter, RolePermissionRepositoryAdapter, RoleRepositoryAdapter, RuntimeModule, ScopeRepositoryAdapter, SessionRepository, TrustAnchorRepositoryAdapter, UserAttributeRepositoryAdapter, UserAuthenticatorRepositoryAdapter, UserIdentityRepository, UserPermissionRepositoryAdapter, UserRepositoryAdapter, UserRoleRepositoryAdapter, createApplication, expandToOrigins, getAppOrigins, readConfig, readConfigRaw, readConfigRawFromEnv, readConfigRawFromFS };

package/dist/app/modules/authentication/module.mjs

@@ -27,15 +27,18 @@ var AuthenticationModule = class {
 	}
 	async setup(container) {
 		container.register(AuthenticationInjectionKey.SessionRepository, { useFactory: (c) => {
+			const cache = c.resolve(CacheInjectionKey);
+			const repository = c.resolve(SessionEntity);
 			return new SessionRepository({
-				cache: c.resolve(CacheInjectionKey),
-				repository: c.resolve(SessionEntity)
+				cache,
+				repository
 			});
 		} });
 		container.register(AuthenticationInjectionKey.SessionManager, { useFactory: (c) => {
 			const config = c.resolve(ConfigInjectionKey);
+			const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);
 			return new SessionManager({
-				repository: c.resolve(AuthenticationInjectionKey.SessionRepository),
+				repository,
 				options: { maxAge: config.tokenRefreshMaxAge + 3600 }
 			});
 		} });

package/dist/app/modules/authentication/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["SessionEntity","SessionManager","CacheInjectionKey","ConfigInjectionKey","ModuleName","AuthenticationInjectionKey","SessionRepository","AuthenticationModule","name","dependencies","AUTHENTICATION","DATABASE","CACHE","CONFIG","setup","container","register","useFactory","c","cache","resolve","repository","config","options","maxAge","tokenRefreshMaxAge"],"sources":["../../../../src/app/modules/authentication/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport { SessionEntity } from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport { SessionManager } from '../../../core/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { AuthenticationInjectionKey } from './constants.ts';\nimport { SessionRepository } from './repositories/index.ts';\n\nexport class AuthenticationModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.AUTHENTICATION;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        container.register(AuthenticationInjectionKey.SessionRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                const repository = c.resolve<Repository<Session>>(SessionEntity);\n                return new SessionRepository({\n                    cache,\n                    repository,\n                });\n            },\n        });\n\n        container.register(AuthenticationInjectionKey.SessionManager, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n                const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);\n                return new SessionManager({\n                    repository,\n                    options: { maxAge: config.tokenRefreshMaxAge + 3_600 },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,IAAaO,uBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe;GAACL,WAAWO;GAAUP,WAAWQ;GAAOR,WAAWS;EAAO;CAClF;CAEA,MAAMC,MAAMC,WAAsC;EAC9CA,UAAUC,SAASX,2BAA2BC,mBAAmB,EAC7DW,aAAaC,MAAAA;GAGT,OAAO,IAAIZ,kBAAkB;IACzBa,OAHUD,EAAEE,QAAQlB,iBAGpBiB;IACAE,YAHeH,EAAEE,QAA6BpB,aAG9CqB;GACJ,CAAA;EACJ,EACJ,CAAA;EAEAN,UAAUC,SAASX,2BAA2BJ,gBAAgB,EAC1DgB,aAAaC,MAAAA;GACT,MAAMI,SAASJ,EAAEE,QAAQjB,kBAAAA;GAEzB,OAAO,IAAIF,eAAe;IACtBoB,YAFeH,EAAEE,QAAQf,2BAA2BC,iBAEpDe;IACAE,SAAS,EAAEC,QAAQF,OAAOG,qBAAqB,KAAM;GACzD,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["SessionEntity","SessionManager","CacheInjectionKey","ConfigInjectionKey","ModuleName","AuthenticationInjectionKey","SessionRepository","AuthenticationModule","name","dependencies","AUTHENTICATION","DATABASE","CACHE","CONFIG","setup","container","register","useFactory","c","cache","resolve","repository","config","options","maxAge","tokenRefreshMaxAge"],"sources":["../../../../src/app/modules/authentication/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { Repository } from 'typeorm';\nimport { SessionEntity } from '../../../adapters/database/domains/index.ts';\nimport type { IContainer } from 'eldin';\nimport { SessionManager } from '../../../core/index.ts';\nimport { CacheInjectionKey } from '../cache/index.ts';\nimport { ConfigInjectionKey } from '../config/index.ts';\n\nimport type { IModule } from 'orkos';\nimport { ModuleName } from '../constants.ts';\nimport { AuthenticationInjectionKey } from './constants.ts';\nimport { SessionRepository } from './repositories/index.ts';\n\nexport class AuthenticationModule implements IModule {\n    readonly name: string;\n\n    readonly dependencies: string[];\n\n    constructor() {\n        this.name = ModuleName.AUTHENTICATION;\n        this.dependencies = [ModuleName.DATABASE, ModuleName.CACHE, ModuleName.CONFIG];\n    }\n\n    async setup(container: IContainer): Promise<void> {\n        container.register(AuthenticationInjectionKey.SessionRepository, {\n            useFactory: (c) => {\n                const cache = c.resolve(CacheInjectionKey);\n                const repository = c.resolve<Repository<Session>>(SessionEntity);\n                return new SessionRepository({\n                    cache,\n                    repository,\n                });\n            },\n        });\n\n        container.register(AuthenticationInjectionKey.SessionManager, {\n            useFactory: (c) => {\n                const config = c.resolve(ConfigInjectionKey);\n                const repository = c.resolve(AuthenticationInjectionKey.SessionRepository);\n                return new SessionManager({\n                    repository,\n                    options: { maxAge: config.tokenRefreshMaxAge + 3_600 },\n                });\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,IAAaO,uBAAb,MAAaA;CACAC;CAEAC;CAET,cAAc;EACV,KAAKD,OAAOJ,WAAWM;EACvB,KAAKD,eAAe;GAACL,WAAWO;GAAUP,WAAWQ;GAAOR,WAAWS;EAAO;CAClF;CAEA,MAAMC,MAAMC,WAAsC;EAC9CA,UAAUC,SAASX,2BAA2BC,mBAAmB,EAC7DW,aAAaC,MAAAA;GACT,MAAMC,QAAQD,EAAEE,QAAQlB,iBAAAA;GACxB,MAAMmB,aAAaH,EAAEE,QAA6BpB,aAAAA;GAClD,OAAO,IAAIM,kBAAkB;IACzBa;IACAE;GACJ,CAAA;EACJ,EACJ,CAAA;EAEAN,UAAUC,SAASX,2BAA2BJ,gBAAgB,EAC1DgB,aAAaC,MAAAA;GACT,MAAMI,SAASJ,EAAEE,QAAQjB,kBAAAA;GACzB,MAAMkB,aAAaH,EAAEE,QAAQf,2BAA2BC,iBAAiB;GACzE,OAAO,IAAIL,eAAe;IACtBoB;IACAE,SAAS,EAAEC,QAAQF,OAAOG,qBAAqB,KAAM;GACzD,CAAA;EACJ,EACJ,CAAA;CACJ;AACJ"}

package/dist/app/modules/config/constants.d.ts

@@ -4,6 +4,10 @@ export declare const ConfigInjectionKey: TypedToken<Config>;
 export declare enum ConfigEnvironmentVariableName {
     NODE_ENV = "NODE_ENV",
     WRITABLE_DIRECTORY_PATH = "WRITABLE_DIRECTORY_PATH",
+    THEME_DIRECTORY_PATH = "THEME_DIRECTORY_PATH",
+    THEME_FRAGMENTS_ENABLED = "THEME_FRAGMENTS_ENABLED",
+    AUTH_CONSOLE_PATH = "AUTH_CONSOLE_PATH",
+    ACCOUNT_CONSOLE_PATH = "ACCOUNT_CONSOLE_PATH",
     REDIS = "REDIS",
     SMTP = "SMTP",
     HOST = "HOST",
@@ -22,6 +26,7 @@ export declare enum ConfigEnvironmentVariableName {
     EMAIL_VERIFICATION_ENABLED = "EMAIL_VERIFICATION_ENABLED",
     PASSWORD_RECOVERY_ENABLED = "PASSWORD_RECOVERY_ENABLED",
     PASSWORD_MIN_LENGTH = "PASSWORD_MIN_LENGTH",
+    ACCOUNT_CONSOLE_ENABLED = "ACCOUNT_CONSOLE_ENABLED",
     EVENT_LOG_ENABLED = "EVENT_LOG_ENABLED",
     EVENT_LOG_RETENTION_DAYS = "EVENT_LOG_RETENTION_DAYS",
     EVENT_LOG_ENTITY_ENABLED = "EVENT_LOG_ENTITY_ENABLED",

package/dist/app/modules/config/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IAEnD,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAE3C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,kBAAkB,oBAAmC,CAAC;AAEnE,oBAAY,6BAA6B;IACrC,QAAQ,aAAa;IACrB,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAC7C,uBAAuB,4BAA4B;IACnD,iBAAiB,sBAAsB;IACvC,oBAAoB,yBAAyB;IAE7C,KAAK,UAAU;IACf,IAAI,SAAS;IAEb,IAAI,SAAS;IACb,IAAI,SAAS;IACb,UAAU,eAAe;IACzB,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;IACnC,oBAAoB,yBAAyB;IAC7C,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IACzD,yBAAyB,8BAA8B;IACvD,mBAAmB,wBAAwB;IAC3C,uBAAuB,4BAA4B;IAEnD,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IACnE,8BAA8B,mCAAmC;IACjE,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAE7C,sBAAsB,2BAA2B;IAEjD,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,qBAAqB,0BAA0B;IAC/C,kBAAkB,uBAAuB;IAEzC,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,0BAA0B,+BAA+B;IAEzD,eAAe,oBAAoB;IACnC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,yBAAyB,8BAA8B;IAEvD,WAAW,gBAAgB;IAC3B,qCAAqC,0CAA0C;CAClF"}

package/dist/app/modules/config/constants.mjs

@@ -7,6 +7,10 @@ const ConfigInjectionKey = new TypedToken("Config");
 var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVariableName) {
 	ConfigEnvironmentVariableName["NODE_ENV"] = "NODE_ENV";
 	ConfigEnvironmentVariableName["WRITABLE_DIRECTORY_PATH"] = "WRITABLE_DIRECTORY_PATH";
+	ConfigEnvironmentVariableName["THEME_DIRECTORY_PATH"] = "THEME_DIRECTORY_PATH";
+	ConfigEnvironmentVariableName["THEME_FRAGMENTS_ENABLED"] = "THEME_FRAGMENTS_ENABLED";
+	ConfigEnvironmentVariableName["AUTH_CONSOLE_PATH"] = "AUTH_CONSOLE_PATH";
+	ConfigEnvironmentVariableName["ACCOUNT_CONSOLE_PATH"] = "ACCOUNT_CONSOLE_PATH";
 	ConfigEnvironmentVariableName["REDIS"] = "REDIS";
 	ConfigEnvironmentVariableName["SMTP"] = "SMTP";
 	ConfigEnvironmentVariableName["HOST"] = "HOST";
@@ -25,6 +29,7 @@ var ConfigEnvironmentVariableName = /*#__PURE__*/ function(ConfigEnvironmentVari
 	ConfigEnvironmentVariableName["EMAIL_VERIFICATION_ENABLED"] = "EMAIL_VERIFICATION_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_RECOVERY_ENABLED"] = "PASSWORD_RECOVERY_ENABLED";
 	ConfigEnvironmentVariableName["PASSWORD_MIN_LENGTH"] = "PASSWORD_MIN_LENGTH";
+	ConfigEnvironmentVariableName["ACCOUNT_CONSOLE_ENABLED"] = "ACCOUNT_CONSOLE_ENABLED";
 	ConfigEnvironmentVariableName["EVENT_LOG_ENABLED"] = "EVENT_LOG_ENABLED";
 	ConfigEnvironmentVariableName["EVENT_LOG_RETENTION_DAYS"] = "EVENT_LOG_RETENTION_DAYS";
 	ConfigEnvironmentVariableName["EVENT_LOG_ENTITY_ENABLED"] = "EVENT_LOG_ENTITY_ENABLED";

package/dist/app/modules/config/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUST_PROXY = 'TRUST_PROXY',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAAA,OAAAA;AAmDX,EAAA,CAAA,CAAA"}
+{"version":3,"file":"constants.mjs","names":["TypedToken","ConfigInjectionKey","ConfigEnvironmentVariableName"],"sources":["../../../../src/app/modules/config/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { TypedToken } from 'eldin';\nimport type { Config } from './types.ts';\n\nexport const ConfigInjectionKey = new TypedToken<Config>('Config');\n\nexport enum ConfigEnvironmentVariableName {\n    NODE_ENV = 'NODE_ENV',\n    WRITABLE_DIRECTORY_PATH = 'WRITABLE_DIRECTORY_PATH',\n    THEME_DIRECTORY_PATH = 'THEME_DIRECTORY_PATH',\n    THEME_FRAGMENTS_ENABLED = 'THEME_FRAGMENTS_ENABLED',\n    AUTH_CONSOLE_PATH = 'AUTH_CONSOLE_PATH',\n    ACCOUNT_CONSOLE_PATH = 'ACCOUNT_CONSOLE_PATH',\n\n    REDIS = 'REDIS',\n    SMTP = 'SMTP',\n\n    HOST = 'HOST',\n    PORT = 'PORT',\n    PUBLIC_URL = 'PUBLIC_URL',\n    MTLS_PUBLIC_URL = 'MTLS_PUBLIC_URL',\n    CERTIFICATE_SOURCE = 'CERTIFICATE_SOURCE',\n    TRUST_PROXY = 'TRUST_PROXY',\n    TRUSTED_ORIGINS = 'TRUSTED_ORIGINS',\n    TOKEN_ACCESS_MAX_AGE = 'TOKEN_ACCESS_MAX_AGE',\n    TOKEN_REFRESH_MAX_AGE = 'TOKEN_REFRESH_MAX_AGE',\n    TOKEN_REFRESH_GRACE_PERIOD = 'TOKEN_REFRESH_GRACE_PERIOD',\n    PROMPT_LOGIN_MAX_AGE = 'PROMPT_LOGIN_MAX_AGE',\n    END_SESSION_HINT_GRACE_PERIOD = 'END_SESSION_HINT_GRACE_PERIOD',\n    REGISTRATION_ENABLED = 'REGISTRATION_ENABLED',\n    EMAIL_VERIFICATION_ENABLED = 'EMAIL_VERIFICATION_ENABLED',\n    PASSWORD_RECOVERY_ENABLED = 'PASSWORD_RECOVERY_ENABLED',\n    PASSWORD_MIN_LENGTH = 'PASSWORD_MIN_LENGTH',\n    ACCOUNT_CONSOLE_ENABLED = 'ACCOUNT_CONSOLE_ENABLED',\n\n    EVENT_LOG_ENABLED = 'EVENT_LOG_ENABLED',\n    EVENT_LOG_RETENTION_DAYS = 'EVENT_LOG_RETENTION_DAYS',\n    EVENT_LOG_ENTITY_ENABLED = 'EVENT_LOG_ENTITY_ENABLED',\n    EVENT_LOG_ENTITY_RETENTION_DAYS = 'EVENT_LOG_ENTITY_RETENTION_DAYS',\n    LOGIN_ATTEMPT_THROTTLE_ENABLED = 'LOGIN_ATTEMPT_THROTTLE_ENABLED',\n    LOGIN_ATTEMPT_THRESHOLD = 'LOGIN_ATTEMPT_THRESHOLD',\n    LOGIN_ATTEMPT_WINDOW = 'LOGIN_ATTEMPT_WINDOW',\n\n    SECRETS_ENCRYPTION_KEY = 'SECRETS_ENCRYPTION_KEY',\n\n    MFA_ENABLED = 'MFA_ENABLED',\n    MFA_REQUIRED = 'MFA_REQUIRED',\n    MFA_FRESHNESS_MAX_AGE = 'MFA_FRESHNESS_MAX_AGE',\n    MFA_TICKET_MAX_AGE = 'MFA_TICKET_MAX_AGE',\n\n    CLIENT_AUTH_BASIC = 'CLIENT_AUTH_BASIC',\n    CLIENT_SYSTEM_ENABLED = 'CLIENT_SYSTEM_ENABLED',\n    CLIENT_SYSTEM_SECRET = 'CLIENT_SYSTEM_SECRET',\n    CLIENT_SYSTEM_SECRET_RESET = 'CLIENT_SYSTEM_SECRET_RESET',\n\n    USER_AUTH_BASIC = 'USER_AUTH_BASIC',\n    USER_ADMIN_ENABLED = 'USER_ADMIN_ENABLED',\n    USER_ADMIN_PASSWORD = 'USER_ADMIN_PASSWORD',\n    USER_ADMIN_PASSWORD_RESET = 'USER_ADMIN_PASSWORD_RESET',\n\n    PERMISSIONS = 'PERMISSIONS',\n    PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT = 'PERMISSIONS_DEFAULT_POLICY_ASSIGNMENT',\n}\n"],"mappings":";;;;;AAUA,MAAaC,qBAAqB,IAAID,WAAmB,QAAA;AAEzD,IAAO,gCAAKE,uBAAAA,+BAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAAA,OAAAA;AAwDX,EAAA,CAAA,CAAA"}

package/dist/app/modules/config/helpers.mjs

@@ -10,10 +10,11 @@ import "./read/index.mjs";
 *
 * @param options
 */ async function readConfig(options = {}) {
-	return normalizeConfig(await readConfigRaw({
+	const raw = await readConfigRaw({
 		env: true,
 		...options
-	}));
+	});
+	return normalizeConfig(raw);
 }
 //#endregion
 export { readConfig };

package/dist/app/modules/config/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.mjs","names":["normalizeConfig","readConfigRaw","readConfig","options","raw","env"],"sources":["../../../../src/app/modules/config/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { normalizeConfig } from './normalize.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport { readConfigRaw } from './read/index.ts';\nimport type { Config } from './types.ts';\n\n/**\n * Read config from env (and optionally fs) and normalize it.\n *\n * @param options\n */\nexport async function readConfig(options: ConfigRawReadOptions = {}) : Promise<Config> {\n    const raw = await readConfigRaw({\n        env: true,\n        ...options,\n    });\n\n    return normalizeConfig(raw);\n}\n"],"mappings":";;;;;;;;;;;GAiBA,eAAsBE,WAAWC,UAAgC,CAAC,GAAC;CAM/D,OAAOH,gBAAgBI,MALLH,cAAc;EAC5BI,KAAK;EACL,GAAGF;CACP,CAAA,CAEuBC;AAC3B"}
+{"version":3,"file":"helpers.mjs","names":["normalizeConfig","readConfigRaw","readConfig","options","raw","env"],"sources":["../../../../src/app/modules/config/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { normalizeConfig } from './normalize.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport { readConfigRaw } from './read/index.ts';\nimport type { Config } from './types.ts';\n\n/**\n * Read config from env (and optionally fs) and normalize it.\n *\n * @param options\n */\nexport async function readConfig(options: ConfigRawReadOptions = {}) : Promise<Config> {\n    const raw = await readConfigRaw({\n        env: true,\n        ...options,\n    });\n\n    return normalizeConfig(raw);\n}\n"],"mappings":";;;;;;;;;;;GAiBA,eAAsBE,WAAWC,UAAgC,CAAC,GAAC;CAC/D,MAAMC,MAAM,MAAMH,cAAc;EAC5BI,KAAK;EACL,GAAGF;CACP,CAAA;CAEA,OAAOH,gBAAgBI,GAAAA;AAC3B"}

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiK9E"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0L9E"}