@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.59

package/dist/adapters/http/ui/auth-console/resolve.mjs

@@ -0,0 +1,53 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { PACKAGE_PATH } from "../../../../path.mjs";
+import path from "node:path";
+import { locateUpSync } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/auth-console/resolve.ts
+let cachedPackagePath;
+let cachedDistPath;
+let overridePackagePath;
+/**
+* Point the resolution at a substituted package (config `authConsolePath`)
+* instead of the node_modules walk. Called once at boot.
+*/ function setAuthConsolePackagePath(value) {
+	overridePackagePath = value || void 0;
+	cachedPackagePath = void 0;
+	cachedDistPath = void 0;
+}
+/**
+* Locate the auth console package. The SSR auth workflow UI ships as
+* `@authup/client-auth-console` (a server-core dependency), so the
+* node_modules ancestor walk from server-core's own package root (locter's
+* `locateUp`) finds it for the workspace (symlink onto
+* apps/client-auth-console) and for a published install alike. Only a
+* positive result is cached.
+*/ function resolveAuthConsolePackagePath() {
+	if (cachedPackagePath) return cachedPackagePath;
+	if (overridePackagePath) {
+		cachedPackagePath = overridePackagePath;
+		return cachedPackagePath;
+	}
+	const manifest = locateUpSync("node_modules/@authup/client-auth-console/package.json", { cwd: PACKAGE_PATH });
+	if (manifest) cachedPackagePath = manifest.directory;
+	return cachedPackagePath;
+}
+/**
+* Locate the BUILT auth console bundle (`dist/client` template + assets,
+* `dist/server/server.js` render entry). Only a positive result is cached —
+* a dev building the package after boot is picked up on the next request.
+*/ function resolveAuthConsoleDistPath() {
+	if (cachedDistPath) return cachedDistPath;
+	const packagePath = resolveAuthConsolePackagePath();
+	if (packagePath) {
+		const distPath = path.join(packagePath, "dist");
+		if (fs.existsSync(path.join(distPath, "client", "index.html"))) cachedDistPath = distPath;
+	}
+	return cachedDistPath;
+}
+//#endregion
+export { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, setAuthConsolePackagePath };
+
+//# sourceMappingURL=resolve.mjs.map

package/dist/adapters/http/ui/auth-console/resolve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.mjs","names":["locateUpSync","fs","path","PACKAGE_PATH","cachedPackagePath","cachedDistPath","overridePackagePath","setAuthConsolePackagePath","value","undefined","resolveAuthConsolePackagePath","manifest","cwd","directory","resolveAuthConsoleDistPath","packagePath","distPath","join","existsSync"],"sources":["../../../../../src/adapters/http/ui/auth-console/resolve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { locateUpSync } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { PACKAGE_PATH } from '../../../../path.ts';\n\nlet cachedPackagePath: string | undefined;\nlet cachedDistPath: string | undefined;\nlet overridePackagePath: string | undefined;\n\n/**\n * Point the resolution at a substituted package (config `authConsolePath`)\n * instead of the node_modules walk. Called once at boot.\n */\nexport function setAuthConsolePackagePath(value: string | undefined) : void {\n    overridePackagePath = value || undefined;\n    cachedPackagePath = undefined;\n    cachedDistPath = undefined;\n}\n\n/**\n * Locate the auth console package. The SSR auth workflow UI ships as\n * `@authup/client-auth-console` (a server-core dependency), so the\n * node_modules ancestor walk from server-core's own package root (locter's\n * `locateUp`) finds it for the workspace (symlink onto\n * apps/client-auth-console) and for a published install alike. Only a\n * positive result is cached.\n */\nexport function resolveAuthConsolePackagePath() : string | undefined {\n    if (cachedPackagePath) {\n        return cachedPackagePath;\n    }\n\n    if (overridePackagePath) {\n        cachedPackagePath = overridePackagePath;\n\n        return cachedPackagePath;\n    }\n\n    const manifest = locateUpSync(\n        'node_modules/@authup/client-auth-console/package.json',\n        { cwd: PACKAGE_PATH },\n    );\n    if (manifest) {\n        cachedPackagePath = manifest.directory;\n    }\n\n    return cachedPackagePath;\n}\n\n/**\n * Locate the BUILT auth console bundle (`dist/client` template + assets,\n * `dist/server/server.js` render entry). Only a positive result is cached —\n * a dev building the package after boot is picked up on the next request.\n */\nexport function resolveAuthConsoleDistPath() : string | undefined {\n    if (cachedDistPath) {\n        return cachedDistPath;\n    }\n\n    const packagePath = resolveAuthConsolePackagePath();\n    if (packagePath) {\n        const distPath = path.join(packagePath, 'dist');\n\n        if (fs.existsSync(path.join(distPath, 'client', 'index.html'))) {\n            cachedDistPath = distPath;\n        }\n    }\n\n    return cachedDistPath;\n}\n"],"mappings":";;;;;;;;AAYA,IAAII;AACJ,IAAIC;AACJ,IAAIC;;;;GAMJ,SAAgBC,0BAA0BC,OAAyB;CAC/DF,sBAAsBE,SAASC,KAAAA;CAC/BL,oBAAoBK,KAAAA;CACpBJ,iBAAiBI,KAAAA;AACrB;;;;;;;;GAUA,SAAgBC,gCAAAA;CACZ,IAAIN,mBACA,OAAOA;CAGX,IAAIE,qBAAqB;EACrBF,oBAAoBE;EAEpB,OAAOF;CACX;CAEA,MAAMO,WAAWX,aACb,yDACA,EAAEY,KAAKT,aAAa,CAAA;CAExB,IAAIQ,UACAP,oBAAoBO,SAASE;CAGjC,OAAOT;AACX;;;;;GAOA,SAAgBU,6BAAAA;CACZ,IAAIT,gBACA,OAAOA;CAGX,MAAMU,cAAcL,8BAAAA;CACpB,IAAIK,aAAa;EACb,MAAMC,WAAWd,KAAKe,KAAKF,aAAa,MAAA;EAExC,IAAId,GAAGiB,WAAWhB,KAAKe,KAAKD,UAAU,UAAU,YAAA,CAAA,GAC5CX,iBAAiBW;CAEzB;CAEA,OAAOX;AACX"}

package/dist/adapters/http/ui/{serve.d.ts → auth-console/serve.d.ts}

@@ -1,12 +1,5 @@
-import type { StatusResponseFeatures } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
-export type ServeWorkflowPageOptions = {
-    url: string;
-    baseURL: string;
-    features: StatusResponseFeatures;
-    realmAware?: boolean;
-    tokenAware?: boolean;
-};
+import type { ServeWorkflowPageOptions } from './types.ts';
 /**
  * Single SSR payload-assembly path for the auth workflow GET routes:
  * whitelists query params, applies the open-redirect guard, and renders.

package/dist/adapters/http/ui/auth-console/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/serve.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/adapters/http/ui/{serve.mjs → auth-console/serve.mjs}

@@ -1,11 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { sanitizeRelativeRedirect } from "../request/helpers/redirect.mjs";
-import "../request/index.mjs";
-import { renderUIPage } from "./render.mjs";
+import { sanitizeRelativeRedirect } from "../../request/helpers/redirect.mjs";
+import "../../request/index.mjs";
+import { renderAuthConsolePage } from "./module.mjs";
 import { useRequestQuery } from "@routup/basic/query";
-//#region src/adapters/http/ui/serve.ts
+//#region src/adapters/http/ui/auth-console/serve.ts
 /**
 * Single SSR payload-assembly path for the auth workflow GET routes:
 * whitelists query params, applies the open-redirect guard, and renders.
@@ -21,7 +21,7 @@ import { useRequestQuery } from "@routup/basic/query";
 		data.realmId = typeof realmId === "string" ? realmId : void 0;
 	}
 	if (options.tokenAware) data.token = typeof query.token === "string" ? query.token : void 0;
-	return renderUIPage(event, {
+	return renderAuthConsolePage(event, {
 		url: options.url,
 		payload: {
 			config: { baseURL: options.baseURL },

package/dist/adapters/http/ui/auth-console/serve.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderAuthConsolePage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../../src/adapters/http/ui/auth-console/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../../request/index.ts';\nimport { renderAuthConsolePage } from './module.ts';\nimport type { ServeWorkflowPageOptions } from './types.ts';\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderAuthConsolePage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GAkBA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YAAY;EACpB,MAAMC,UAAU,OAAOL,MAAMK,YAAY,WAAWL,MAAMK,UAAUL,MAAMM;EAC1EL,KAAKI,UAAU,OAAOA,YAAY,WAAWA,UAAUE,KAAAA;CAC3D;CAEA,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,sBAAsBE,OAAO;EAChCY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/adapters/http/ui/auth-console/types.d.ts

@@ -0,0 +1,26 @@
+import type { HydrationPayload } from '@authup/client-auth-console';
+import type { StatusResponseFeatures } from '@authup/core-http-kit';
+export type AuthConsoleRenderContext = {
+    url: string;
+    payload: HydrationPayload;
+};
+export type ServeWorkflowPageOptions = {
+    url: string;
+    baseURL: string;
+    features: StatusResponseFeatures;
+    realmAware?: boolean;
+    tokenAware?: boolean;
+};
+export type InternalUIHttpClientContext = {
+    /**
+     * The public base URL (config `publicUrl`) — stays the client's
+     * `baseURL` so URLs rendered into the HTML remain user-facing.
+     */
+    publicURL: string;
+    /**
+     * The server's own listen address (e.g. http://localhost:3010/) —
+     * where the transport actually dispatches requests.
+     */
+    internalURL: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/auth-console/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/auth-console/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/adapters/http/ui/auth-console/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/adapters/http/ui/console-packages/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/console-packages/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/console-packages/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/console-packages/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages } from "./module.mjs";
+export { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages };

package/dist/adapters/http/ui/console-packages/module.d.ts

@@ -0,0 +1,33 @@
+import type { ConsolePackageOptions } from './types.ts';
+/**
+ * The render-contract version server-core compiles against. Must match the
+ * `CONTRACT_VERSION` the auth console bundle exports.
+ *
+ * Bump alongside `apps/client-auth-console/src/contract.ts` whenever a
+ * change breaks a package built against the previous shape.
+ */
+export declare const AUTH_CONSOLE_CONTRACT_VERSION = 1;
+/**
+ * The marker the account console's index.html must carry. It is that
+ * console's entire runtime contract: without it the injected
+ * `window.__AUTHUP__` never lands and the SPA silently falls back to
+ * deriving its API URL from the origin.
+ */
+export declare const ACCOUNT_CONSOLE_CONFIG_MARKER = "<!--account-config-->";
+/**
+ * Bind the substituted console packages and verify they still fulfill the
+ * contracts, before the first request rather than per render.
+ *
+ * Only runs for a package the operator actually substituted. With the
+ * default resolution the console packages ship from this repo with linked
+ * versions, so the assert would compare a constant against itself, and
+ * loading the SSR bundle at boot would turn a missing build into a failed
+ * start instead of an actionable error on the page.
+ *
+ * Fail-closed on a mismatch: the operator replaced the login and consent
+ * IMPLEMENTATION (the prompt ladder, PKCE and state handling, MFA
+ * ordering, redirect gating), so a contract drift must stop the container
+ * rather than render subtly wrong auth pages.
+ */
+export declare function bindConsolePackages(options?: ConsolePackageOptions): Promise<void>;
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/ui/console-packages/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/console-packages/module.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAiB/C;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAI,OAAO,CAAC,IAAI,CAAC,CAW7F"}

package/dist/adapters/http/ui/console-packages/module.mjs

@@ -0,0 +1,70 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { resolveAuthConsoleDistPath, setAuthConsolePackagePath } from "../auth-console/resolve.mjs";
+import "../auth-console/index.mjs";
+import { resolveAccountConsoleDistPath, setAccountConsolePackagePath } from "../account-console/module.mjs";
+import "../account-console/index.mjs";
+import { AuthupError, normalizeError } from "@authup/errors";
+import path from "node:path";
+import { read } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/console-packages/module.ts
+/**
+* The render-contract version server-core compiles against. Must match the
+* `CONTRACT_VERSION` the auth console bundle exports.
+*
+* Bump alongside `apps/client-auth-console/src/contract.ts` whenever a
+* change breaks a package built against the previous shape.
+*/ const AUTH_CONSOLE_CONTRACT_VERSION = 1;
+/**
+* The marker the account console's index.html must carry. It is that
+* console's entire runtime contract: without it the injected
+* `window.__AUTHUP__` never lands and the SPA silently falls back to
+* deriving its API URL from the origin.
+*/ const ACCOUNT_CONSOLE_CONFIG_MARKER = "<!--account-config-->";
+/**
+* Bind the substituted console packages and verify they still fulfill the
+* contracts, before the first request rather than per render.
+*
+* Only runs for a package the operator actually substituted. With the
+* default resolution the console packages ship from this repo with linked
+* versions, so the assert would compare a constant against itself, and
+* loading the SSR bundle at boot would turn a missing build into a failed
+* start instead of an actionable error on the page.
+*
+* Fail-closed on a mismatch: the operator replaced the login and consent
+* IMPLEMENTATION (the prompt ladder, PKCE and state handling, MFA
+* ordering, redirect gating), so a contract drift must stop the container
+* rather than render subtly wrong auth pages.
+*/ async function bindConsolePackages(options = {}) {
+	setAuthConsolePackagePath(options.authConsolePath);
+	setAccountConsolePackagePath(options.accountConsolePath);
+	if (options.authConsolePath) await assertAuthConsoleContract(options.authConsolePath);
+	if (options.accountConsolePath) assertAccountConsoleContract(options.accountConsolePath);
+}
+async function assertAuthConsoleContract(packagePath) {
+	const distPath = resolveAuthConsoleDistPath();
+	if (!distPath) throw new AuthupError(`The auth console package at "${packagePath}" carries no built bundle (expected dist/client/index.html).`);
+	const entry = path.join(distPath, "server", "server.js");
+	let module;
+	try {
+		module = await read(entry);
+	} catch (e) {
+		const reason = normalizeError(e).message;
+		throw new AuthupError(`The auth console render entry "${entry}" could not be loaded.\n  ${reason}`);
+	}
+	if (typeof module.render !== "function") throw new AuthupError(`The auth console bundle "${entry}" does not export a render() function.`);
+	const version = typeof module.CONTRACT_VERSION === "undefined" ? 1 : module.CONTRACT_VERSION;
+	if (version !== 1) throw new AuthupError(`The auth console package at "${packagePath}" implements render-contract version ${version}, but this authup requires 1. Rebuild it against the current @authup/client-auth-console contract.`);
+}
+function assertAccountConsoleContract(packagePath) {
+	const distPath = resolveAccountConsoleDistPath();
+	if (!distPath) throw new AuthupError(`The account console package at "${packagePath}" carries no built bundle (expected dist/index.html).`);
+	const entry = path.join(distPath, "index.html");
+	if (!fs.readFileSync(entry, "utf-8").includes("<!--account-config-->")) throw new AuthupError(`The account console shell "${entry}" carries no ${ACCOUNT_CONSOLE_CONFIG_MARKER} marker, so its runtime configuration cannot be injected.`);
+}
+//#endregion
+export { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/ui/console-packages/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["AuthupError","normalizeError","read","fs","path","resolveAccountConsoleDistPath","setAccountConsolePackagePath","resolveAuthConsoleDistPath","setAuthConsolePackagePath","AUTH_CONSOLE_CONTRACT_VERSION","AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC","ACCOUNT_CONSOLE_CONFIG_MARKER","bindConsolePackages","options","authConsolePath","accountConsolePath","assertAuthConsoleContract","assertAccountConsoleContract","packagePath","distPath","entry","join","module","e","reason","message","render","version","CONTRACT_VERSION","html","readFileSync","includes"],"sources":["../../../../../src/adapters/http/ui/console-packages/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, normalizeError } from '@authup/errors';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport {\n    resolveAccountConsoleDistPath,\n    setAccountConsolePackagePath,\n} from '../account-console/index.ts';\nimport { resolveAuthConsoleDistPath, setAuthConsolePackagePath } from '../auth-console/index.ts';\n// Type position only (see AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC below), so\n// the runtime stays a dist-file read and the layering rule holds.\nimport type { CONTRACT_VERSION as AuthConsoleContractVersion } from '@authup/client-auth-console';\nimport type { ConsolePackageOptions } from './types.ts';\n\n/**\n * The render-contract version server-core compiles against. Must match the\n * `CONTRACT_VERSION` the auth console bundle exports.\n *\n * Bump alongside `apps/client-auth-console/src/contract.ts` whenever a\n * change breaks a package built against the previous shape.\n */\nexport const AUTH_CONSOLE_CONTRACT_VERSION = 1;\n\n/**\n * Compile-time link to the value this constant mirrors.\n *\n * The runtime assert below only fires for a SUBSTITUTED package, so a bump\n * on one side and not the other would otherwise go unnoticed until a\n * substituted console failed at boot in someone else's deployment. The\n * annotation costs nothing at runtime (types are erased) and fails this\n * package's build the moment the two drift.\n */\ntype AuthConsoleContractVersionInSync =    typeof AuthConsoleContractVersion extends typeof AUTH_CONSOLE_CONTRACT_VERSION ?\n    true :\n    never;\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nconst AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC : AuthConsoleContractVersionInSync = true;\n\n/**\n * The marker the account console's index.html must carry. It is that\n * console's entire runtime contract: without it the injected\n * `window.__AUTHUP__` never lands and the SPA silently falls back to\n * deriving its API URL from the origin.\n */\nexport const ACCOUNT_CONSOLE_CONFIG_MARKER = '<!--account-config-->';\n\n/**\n * Bind the substituted console packages and verify they still fulfill the\n * contracts, before the first request rather than per render.\n *\n * Only runs for a package the operator actually substituted. With the\n * default resolution the console packages ship from this repo with linked\n * versions, so the assert would compare a constant against itself, and\n * loading the SSR bundle at boot would turn a missing build into a failed\n * start instead of an actionable error on the page.\n *\n * Fail-closed on a mismatch: the operator replaced the login and consent\n * IMPLEMENTATION (the prompt ladder, PKCE and state handling, MFA\n * ordering, redirect gating), so a contract drift must stop the container\n * rather than render subtly wrong auth pages.\n */\nexport async function bindConsolePackages(options: ConsolePackageOptions = {}) : Promise<void> {\n    setAuthConsolePackagePath(options.authConsolePath);\n    setAccountConsolePackagePath(options.accountConsolePath);\n\n    if (options.authConsolePath) {\n        await assertAuthConsoleContract(options.authConsolePath);\n    }\n\n    if (options.accountConsolePath) {\n        assertAccountConsoleContract(options.accountConsolePath);\n    }\n}\n\nasync function assertAuthConsoleContract(packagePath: string) : Promise<void> {\n    const distPath = resolveAuthConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" carries no built bundle (expected dist/client/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'server', 'server.js');\n\n    let module : Record<string, any>;\n    try {\n        module = await read(entry) as Record<string, any>;\n    } catch (e) {\n        const reason = normalizeError(e).message;\n\n        throw new AuthupError(`The auth console render entry \"${entry}\" could not be loaded.\\n  ${reason}`);\n    }\n\n    if (typeof module.render !== 'function') {\n        throw new AuthupError(`The auth console bundle \"${entry}\" does not export a render() function.`);\n    }\n\n    // A bundle predating the export counts as version 1, the shape every\n    // package built before the constant existed implements.\n    const version = typeof module.CONTRACT_VERSION === 'undefined' ?\n        1 :\n        module.CONTRACT_VERSION;\n\n    if (version !== AUTH_CONSOLE_CONTRACT_VERSION) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" implements render-contract version ${version}, but this authup requires ${AUTH_CONSOLE_CONTRACT_VERSION}. Rebuild it against the current @authup/client-auth-console contract.`,\n        );\n    }\n}\n\nfunction assertAccountConsoleContract(packagePath: string) : void {\n    const distPath = resolveAccountConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The account console package at \"${packagePath}\" carries no built bundle (expected dist/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'index.html');\n    const html = fs.readFileSync(entry, 'utf-8');\n\n    if (!html.includes(ACCOUNT_CONSOLE_CONFIG_MARKER)) {\n        throw new AuthupError(\n            `The account console shell \"${entry}\" carries no ${ACCOUNT_CONSOLE_CONFIG_MARKER} marker, so its runtime configuration cannot be injected.`,\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;GA4BA,MAAaS,gCAAgC;;;;;;GAuB7C,MAAaE,gCAAgC;;;;;;;;;;;;;;;GAiB7C,eAAsBC,oBAAoBC,UAAiC,CAAC,GAAC;CACzEL,0BAA0BK,QAAQC,eAAe;CACjDR,6BAA6BO,QAAQE,kBAAkB;CAEvD,IAAIF,QAAQC,iBACR,MAAME,0BAA0BH,QAAQC,eAAe;CAG3D,IAAID,QAAQE,oBACRE,6BAA6BJ,QAAQE,kBAAkB;AAE/D;AAEA,eAAeC,0BAA0BE,aAAmB;CACxD,MAAMC,WAAWZ,2BAAAA;CACjB,IAAI,CAACY,UACD,MAAM,IAAInB,YACN,gCAAgCkB,YAAY,6DAA6D;CAIjH,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,UAAU,WAAA;CAE5C,IAAIG;CACJ,IAAI;EACAA,SAAS,MAAMpB,KAAKkB,KAAAA;CACxB,SAASG,GAAG;EACR,MAAMC,SAASvB,eAAesB,CAAAA,CAAAA,CAAGE;EAEjC,MAAM,IAAIzB,YAAY,kCAAkCoB,MAAM,4BAA4BI,QAAQ;CACtG;CAEA,IAAI,OAAOF,OAAOI,WAAW,YACzB,MAAM,IAAI1B,YAAY,4BAA4BoB,MAAM,uCAAuC;CAKnG,MAAMO,UAAU,OAAOL,OAAOM,qBAAqB,cAC/C,IACAN,OAAOM;CAEX,IAAID,YAAAA,GACA,MAAM,IAAI3B,YACN,gCAAgCkB,YAAY,uCAAuCS,QAAQ,mGAAkI;AAGzO;AAEA,SAASV,6BAA6BC,aAAmB;CACrD,MAAMC,WAAWd,8BAAAA;CACjB,IAAI,CAACc,UACD,MAAM,IAAInB,YACN,mCAAmCkB,YAAY,sDAAsD;CAI7G,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,YAAA;CAGlC,IAAI,CAFShB,GAAG2B,aAAaV,OAAO,OAE/BS,CAAAA,CAAKE,SAAAA,uBAASpB,GACf,MAAM,IAAIX,YACN,8BAA8BoB,MAAM,eAAeT,8BAA8B,0DAA0D;AAGvJ"}

package/dist/adapters/http/ui/console-packages/types.d.ts

@@ -0,0 +1,12 @@
+export type ConsolePackageOptions = {
+    /**
+     * Package directory of a substituted @authup/client-auth-console.
+     * Empty resolves the packaged one from node_modules.
+     */
+    authConsolePath?: string;
+    /**
+     * Package directory of a substituted @authup/client-account-console.
+     */
+    accountConsolePath?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/console-packages/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/console-packages/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,qBAAqB,GAAG;IAChC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC"}

package/dist/adapters/http/ui/console-packages/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/adapters/http/ui/index.d.ts

@@ -1,6 +1,6 @@
-export * from './base-path.ts';
-export * from './internal-http-client.ts';
-export * from './render.ts';
-export * from './serve.ts';
-export * from './types.ts';
+export * from './account-console/index.ts';
+export * from './auth-console/index.ts';
+export * from './console-packages/index.ts';
+export * from './shared/index.ts';
+export * from './theme/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/adapters/http/ui/index.mjs

@@ -1,8 +1,25 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { rebasePublicAssetURLs } from "./base-path.mjs";
-import { createInternalUIHttpClient, createPublicToInternalURLRewriter } from "./internal-http-client.mjs";
-import { renderUIPage } from "./render.mjs";
-import { serveWorkflowPage } from "./serve.mjs";
-export { createInternalUIHttpClient, createPublicToInternalURLRewriter, rebasePublicAssetURLs, renderUIPage, serveWorkflowPage };
+import { createInternalUIHttpClient, createPublicToInternalURLRewriter } from "./auth-console/http-client.mjs";
+import { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes } from "./shared/html.mjs";
+import "./shared/index.mjs";
+import { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH } from "./theme/contract/constants.mjs";
+import { buildThemeHead, escapeHtml } from "./theme/contract/head.mjs";
+import { themeAssetExtension } from "./theme/contract/utils.mjs";
+import { ThemeManifestValidator, parseThemeManifest } from "./theme/contract/manifest.mjs";
+import { applyTheme } from "./theme/apply.mjs";
+import { THEME_ASSET_CSP, THEME_MANIFEST_REVALIDATE_INTERVAL } from "./theme/constants.mjs";
+import { createThemeAssetsHandler } from "./theme/assets.mjs";
+import { ThemeProvider } from "./theme/module.mjs";
+import "./theme/index.mjs";
+import { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, setAuthConsolePackagePath } from "./auth-console/resolve.mjs";
+import { renderAuthConsolePage } from "./auth-console/module.mjs";
+import { serveWorkflowPage } from "./auth-console/serve.mjs";
+import "./auth-console/index.mjs";
+import { ACCOUNT_CONSOLE_REF_MAX_LENGTH, resolveAccountConsoleRef } from "./account-console/ref.mjs";
+import { resolveAccountConsoleDistPath, serveAccountConsolePage, setAccountConsolePackagePath } from "./account-console/module.mjs";
+import "./account-console/index.mjs";
+import { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages } from "./console-packages/module.mjs";
+import "./console-packages/index.mjs";
+export { ACCOUNT_CONSOLE_CONFIG_MARKER, ACCOUNT_CONSOLE_REF_MAX_LENGTH, AUTH_CONSOLE_CONTRACT_VERSION, THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_CSP, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_REVALIDATE_INTERVAL, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH, ThemeManifestValidator, ThemeProvider, applyTheme, applyUIPageHeaders, bindConsolePackages, buildThemeHead, createInternalUIHttpClient, createPublicToInternalURLRewriter, createThemeAssetsHandler, escapeHtml, injectHeadContent, parseThemeManifest, readUIClientPreferences, rebaseAssetURLs, renderAuthConsolePage, replaceTemplateMarker, resolveAccountConsoleDistPath, resolveAccountConsoleRef, resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, serializeInlineScriptJSON, serveAccountConsolePage, serveWorkflowPage, setAccountConsolePackagePath, setAuthConsolePackagePath, stampDocumentTitle, stampHtmlAttributes, themeAssetExtension };

package/dist/adapters/http/ui/shared/html.d.ts

@@ -0,0 +1,76 @@
+import type { IAppEvent } from 'routup';
+export type UIClientPreferences = {
+    locale?: string;
+    colorMode?: string;
+};
+/**
+ * Mirror @vuecs/nuxt's SSR plugins: resolve the shared cookies server-side
+ * so the HTML shell already carries the `.dark`/`.light` class and lang
+ * attribute (no flash) and the client app hydrates from the same values.
+ * The cookies are shared between every console on the origin.
+ */
+export declare function readUIClientPreferences(event: IAppEvent): UIClientPreferences;
+/**
+ * Stamp the resolved preferences onto the opening `<html>` tag. Matched by
+ * pattern rather than an exact literal, so a reformatted tag / dev-mode
+ * transformIndexHtml rewrite still gets the lang + color-mode attributes
+ * (no silent FOUC).
+ */
+export declare function stampHtmlAttributes(html: string, preferences: UIClientPreferences): string;
+/**
+ * Replace a template marker (`<!--app-html-->`, `<!--account-config-->`, ...)
+ * with a rendered value.
+ *
+ * The replacement is passed as a FUNCTION on purpose. A string replacement
+ * expands the `$&`, `` $` ``, `$'` and `$$` patterns, so a `$'` anywhere in
+ * the value splices the template's own text back into the page. The values
+ * spliced here carry raw request input (the SSR hydration payload reflects
+ * query parameters), which made `?token=$'` return a page whose inline
+ * payload script was no longer valid JavaScript. Escaping cannot prevent
+ * this: the expansion happens after the value was built.
+ */
+export declare function replaceTemplateMarker(html: string, marker: string, value: string): string;
+/**
+ * Insert markup immediately before `</head>`.
+ *
+ * Deliberately not a template marker: injecting at the closing tag works
+ * against console bundles that were built BEFORE this feature existed, so
+ * server-core never silently loses theming when it runs against an older
+ * console package. A shell without a `</head>` is returned unchanged.
+ *
+ * Function-replacement form for the same reason as replaceTemplateMarker.
+ */
+export declare function injectHeadContent(html: string, content: string): string;
+/**
+ * Replace the document title. The value must already be HTML-escaped by
+ * the caller; matched by pattern so a reformatted tag still hits.
+ */
+export declare function stampDocumentTitle(html: string, title: string): string;
+/**
+ * Response headers every served console page shares.
+ *
+ * Clickjacking guard: the pages mutate state behind explicit clicks and
+ * hydrate first-party session state, so framing them would make
+ * click-gating defeatable via overlay attacks — deny embedding entirely
+ * (iframe-based silent renew is therefore unsupported). The URLs routinely
+ * carry sensitive query params (id_token_hint, code, redirect, state) —
+ * never leak them via Referer.
+ */
+export declare function applyUIPageHeaders(event: IAppEvent): void;
+/**
+ * Rewrite root-absolute asset references (script/link/preload tags emitted
+ * with a fixed vite base, e.g. /public/ or /account/) so they carry the
+ * path prefix under which authup is publicly served (e.g. /auth/public/...).
+ * The reverse proxy is expected to strip the prefix before the request
+ * reaches authup, so the assets middleware keeps serving at the fixed base.
+ */
+export declare function rebaseAssetURLs(html: string, basePath: string, viteBase: string): string;
+/**
+ * Escape characters that would otherwise let a value break out of an inline
+ * `<script>` context (`</script>`) or terminate the JS string literal via
+ * the U+2028/U+2029 line separators. Every window-global config/payload a
+ * console page inlines must pass through this — never rely on the VALUES
+ * staying benign.
+ */
+export declare function serializeInlineScriptJSON(value: unknown): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/adapters/http/ui/shared/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/shared/html.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAKxC,MAAM,MAAM,mBAAmB,GAAG;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,GAAI,mBAAmB,CAK9E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,GAAI,MAAM,CAU3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAI,MAAM,CAE1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,MAAM,CAWxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAI,MAAM,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,IAAI,CAQ1D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,MAAM,CASzF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAI,MAAM,CAMjE"}

package/dist/adapters/http/ui/shared/html.mjs

@@ -0,0 +1,103 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { LOCALE_COOKIE } from "../../request/helpers/locale.mjs";
+import { useRequestCookie } from "@routup/basic/cookie";
+//#region src/adapters/http/ui/shared/html.ts
+const COLOR_MODE_COOKIE = "vc-color-mode";
+/**
+* Mirror @vuecs/nuxt's SSR plugins: resolve the shared cookies server-side
+* so the HTML shell already carries the `.dark`/`.light` class and lang
+* attribute (no flash) and the client app hydrates from the same values.
+* The cookies are shared between every console on the origin.
+*/ function readUIClientPreferences(event) {
+	return {
+		locale: useRequestCookie(event, LOCALE_COOKIE),
+		colorMode: useRequestCookie(event, COLOR_MODE_COOKIE)
+	};
+}
+/**
+* Stamp the resolved preferences onto the opening `<html>` tag. Matched by
+* pattern rather than an exact literal, so a reformatted tag / dev-mode
+* transformIndexHtml rewrite still gets the lang + color-mode attributes
+* (no silent FOUC).
+*/ function stampHtmlAttributes(html, preferences) {
+	let htmlAttrs = "lang=\"en\"";
+	if (preferences.locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(preferences.locale)) htmlAttrs = `lang="${preferences.locale}"`;
+	if (preferences.colorMode === "dark" || preferences.colorMode === "light") htmlAttrs += ` class="${preferences.colorMode}"`;
+	return html.replace(/<html\b[^>]*>/i, () => `<html ${htmlAttrs}>`);
+}
+/**
+* Replace a template marker (`<!--app-html-->`, `<!--account-config-->`, ...)
+* with a rendered value.
+*
+* The replacement is passed as a FUNCTION on purpose. A string replacement
+* expands the `$&`, `` $` ``, `$'` and `$$` patterns, so a `$'` anywhere in
+* the value splices the template's own text back into the page. The values
+* spliced here carry raw request input (the SSR hydration payload reflects
+* query parameters), which made `?token=$'` return a page whose inline
+* payload script was no longer valid JavaScript. Escaping cannot prevent
+* this: the expansion happens after the value was built.
+*/ function replaceTemplateMarker(html, marker, value) {
+	return html.replace(marker, () => value);
+}
+/**
+* Insert markup immediately before `</head>`.
+*
+* Deliberately not a template marker: injecting at the closing tag works
+* against console bundles that were built BEFORE this feature existed, so
+* server-core never silently loses theming when it runs against an older
+* console package. A shell without a `</head>` is returned unchanged.
+*
+* Function-replacement form for the same reason as replaceTemplateMarker.
+*/ function injectHeadContent(html, content) {
+	if (!content) return html;
+	const index = html.toLowerCase().indexOf("</head>");
+	if (index === -1) return html;
+	return html.slice(0, index) + content + html.slice(index);
+}
+/**
+* Replace the document title. The value must already be HTML-escaped by
+* the caller; matched by pattern so a reformatted tag still hits.
+*/ function stampDocumentTitle(html, title) {
+	return html.replace(/<title\b[^>]*>[\s\S]*?<\/title>/i, () => `<title>${title}</title>`);
+}
+/**
+* Response headers every served console page shares.
+*
+* Clickjacking guard: the pages mutate state behind explicit clicks and
+* hydrate first-party session state, so framing them would make
+* click-gating defeatable via overlay attacks — deny embedding entirely
+* (iframe-based silent renew is therefore unsupported). The URLs routinely
+* carry sensitive query params (id_token_hint, code, redirect, state) —
+* never leak them via Referer.
+*/ function applyUIPageHeaders(event) {
+	event.response.headers.set("content-type", "text/html; charset=utf-8");
+	event.response.headers.set("vary", "cookie");
+	event.response.headers.set("content-security-policy", "frame-ancestors 'none'");
+	event.response.headers.set("x-frame-options", "DENY");
+	event.response.headers.set("referrer-policy", "no-referrer");
+}
+/**
+* Rewrite root-absolute asset references (script/link/preload tags emitted
+* with a fixed vite base, e.g. /public/ or /account/) so they carry the
+* path prefix under which authup is publicly served (e.g. /auth/public/...).
+* The reverse proxy is expected to strip the prefix before the request
+* reaches authup, so the assets middleware keeps serving at the fixed base.
+*/ function rebaseAssetURLs(html, basePath, viteBase) {
+	if (!basePath) return html;
+	return html.replace(new RegExp(`(src|href)="${viteBase.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}`, "g"), (_match, attribute) => `${attribute}="${basePath}${viteBase}`);
+}
+/**
+* Escape characters that would otherwise let a value break out of an inline
+* `<script>` context (`<\/script>`) or terminate the JS string literal via
+* the U+2028/U+2029 line separators. Every window-global config/payload a
+* console page inlines must pass through this — never rely on the VALUES
+* staying benign.
+*/ function serializeInlineScriptJSON(value) {
+	return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+//#endregion
+export { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes };
+
+//# sourceMappingURL=html.mjs.map

package/dist/adapters/http/ui/shared/html.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.mjs","names":["useRequestCookie","LOCALE_COOKIE","COLOR_MODE_COOKIE","readUIClientPreferences","event","locale","colorMode","stampHtmlAttributes","html","preferences","htmlAttrs","test","replace","replaceTemplateMarker","marker","value","injectHeadContent","content","index","toLowerCase","indexOf","slice","stampDocumentTitle","title","applyUIPageHeaders","response","headers","set","rebaseAssetURLs","basePath","viteBase","RegExp","_match","attribute","serializeInlineScriptJSON","JSON","stringify"],"sources":["../../../../../src/adapters/http/ui/shared/html.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport type { IAppEvent } from 'routup';\nimport { LOCALE_COOKIE } from '../../request/helpers/locale.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\nexport type UIClientPreferences = {\n    locale?: string,\n    colorMode?: string,\n};\n\n/**\n * Mirror @vuecs/nuxt's SSR plugins: resolve the shared cookies server-side\n * so the HTML shell already carries the `.dark`/`.light` class and lang\n * attribute (no flash) and the client app hydrates from the same values.\n * The cookies are shared between every console on the origin.\n */\nexport function readUIClientPreferences(event: IAppEvent) : UIClientPreferences {\n    return {\n        locale: useRequestCookie(event, LOCALE_COOKIE),\n        colorMode: useRequestCookie(event, COLOR_MODE_COOKIE),\n    };\n}\n\n/**\n * Stamp the resolved preferences onto the opening `<html>` tag. Matched by\n * pattern rather than an exact literal, so a reformatted tag / dev-mode\n * transformIndexHtml rewrite still gets the lang + color-mode attributes\n * (no silent FOUC).\n */\nexport function stampHtmlAttributes(html: string, preferences: UIClientPreferences) : string {\n    let htmlAttrs = 'lang=\"en\"';\n    if (preferences.locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(preferences.locale)) {\n        htmlAttrs = `lang=\"${preferences.locale}\"`;\n    }\n    if (preferences.colorMode === 'dark' || preferences.colorMode === 'light') {\n        htmlAttrs += ` class=\"${preferences.colorMode}\"`;\n    }\n\n    return html.replace(/<html\\b[^>]*>/i, () => `<html ${htmlAttrs}>`);\n}\n\n/**\n * Replace a template marker (`<!--app-html-->`, `<!--account-config-->`, ...)\n * with a rendered value.\n *\n * The replacement is passed as a FUNCTION on purpose. A string replacement\n * expands the `$&`, `` $` ``, `$'` and `$$` patterns, so a `$'` anywhere in\n * the value splices the template's own text back into the page. The values\n * spliced here carry raw request input (the SSR hydration payload reflects\n * query parameters), which made `?token=$'` return a page whose inline\n * payload script was no longer valid JavaScript. Escaping cannot prevent\n * this: the expansion happens after the value was built.\n */\nexport function replaceTemplateMarker(html: string, marker: string, value: string) : string {\n    return html.replace(marker, () => value);\n}\n\n/**\n * Insert markup immediately before `</head>`.\n *\n * Deliberately not a template marker: injecting at the closing tag works\n * against console bundles that were built BEFORE this feature existed, so\n * server-core never silently loses theming when it runs against an older\n * console package. A shell without a `</head>` is returned unchanged.\n *\n * Function-replacement form for the same reason as replaceTemplateMarker.\n */\nexport function injectHeadContent(html: string, content: string) : string {\n    if (!content) {\n        return html;\n    }\n\n    const index = html.toLowerCase().indexOf('</head>');\n    if (index === -1) {\n        return html;\n    }\n\n    return html.slice(0, index) + content + html.slice(index);\n}\n\n/**\n * Replace the document title. The value must already be HTML-escaped by\n * the caller; matched by pattern so a reformatted tag still hits.\n */\nexport function stampDocumentTitle(html: string, title: string) : string {\n    return html.replace(/<title\\b[^>]*>[\\s\\S]*?<\\/title>/i, () => `<title>${title}</title>`);\n}\n\n/**\n * Response headers every served console page shares.\n *\n * Clickjacking guard: the pages mutate state behind explicit clicks and\n * hydrate first-party session state, so framing them would make\n * click-gating defeatable via overlay attacks — deny embedding entirely\n * (iframe-based silent renew is therefore unsupported). The URLs routinely\n * carry sensitive query params (id_token_hint, code, redirect, state) —\n * never leak them via Referer.\n */\nexport function applyUIPageHeaders(event: IAppEvent) : void {\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n    // The shell is stamped from the vc-locale / vc-color-mode cookies, so\n    // it genuinely varies by them. It carried no Vary header at all.\n    event.response.headers.set('vary', 'cookie');\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n    event.response.headers.set('referrer-policy', 'no-referrer');\n}\n\n/**\n * Rewrite root-absolute asset references (script/link/preload tags emitted\n * with a fixed vite base, e.g. /public/ or /account/) so they carry the\n * path prefix under which authup is publicly served (e.g. /auth/public/...).\n * The reverse proxy is expected to strip the prefix before the request\n * reaches authup, so the assets middleware keeps serving at the fixed base.\n */\nexport function rebaseAssetURLs(html: string, basePath: string, viteBase: string) : string {\n    if (!basePath) {\n        return html;\n    }\n\n    return html.replace(\n        new RegExp(`(src|href)=\"${viteBase.replace(/[.*+?^${}()|[\\]\\\\/]/g, '\\\\$&')}`, 'g'),\n        (_match, attribute) => `${attribute}=\"${basePath}${viteBase}`,\n    );\n}\n\n/**\n * Escape characters that would otherwise let a value break out of an inline\n * `<script>` context (`</script>`) or terminate the JS string literal via\n * the U+2028/U+2029 line separators. Every window-global config/payload a\n * console page inlines must pass through this — never rely on the VALUES\n * staying benign.\n */\nexport function serializeInlineScriptJSON(value: unknown) : string {\n    return JSON.stringify(value)\n        .replace(/</g, '\\\\u003c')\n        .replace(/>/g, '\\\\u003e')\n        .replace(/\\u2028/g, '\\\\u2028')\n        .replace(/\\u2029/g, '\\\\u2029');\n}\n"],"mappings":";;;;;;AAWA,MAAME,oBAAoB;;;;;;GAa1B,SAAgBC,wBAAwBC,OAAgB;CACpD,OAAO;EACHC,QAAQL,iBAAiBI,OAAOH,aAAAA;EAChCK,WAAWN,iBAAiBI,OAAOF,iBAAAA;CACvC;AACJ;;;;;;GAQA,SAAgBK,oBAAoBC,MAAcC,aAAgC;CAC9E,IAAIC,YAAY;CAChB,IAAID,YAAYJ,UAAU,kCAAkCM,KAAKF,YAAYJ,MAAM,GAC/EK,YAAY,SAASD,YAAYJ,OAAO;CAE5C,IAAII,YAAYH,cAAc,UAAUG,YAAYH,cAAc,SAC9DI,aAAa,WAAWD,YAAYH,UAAU;CAGlD,OAAOE,KAAKI,QAAQ,wBAAwB,SAASF,UAAU,EAAE;AACrE;;;;;;;;;;;;GAcA,SAAgBG,sBAAsBL,MAAcM,QAAgBC,OAAa;CAC7E,OAAOP,KAAKI,QAAQE,cAAcC,KAAAA;AACtC;;;;;;;;;;GAYA,SAAgBC,kBAAkBR,MAAcS,SAAe;CAC3D,IAAI,CAACA,SACD,OAAOT;CAGX,MAAMU,QAAQV,KAAKW,YAAW,CAAA,CAAGC,QAAQ,SAAA;CACzC,IAAIF,UAAU,IACV,OAAOV;CAGX,OAAOA,KAAKa,MAAM,GAAGH,KAAAA,IAASD,UAAUT,KAAKa,MAAMH,KAAAA;AACvD;;;;GAMA,SAAgBI,mBAAmBd,MAAce,OAAa;CAC1D,OAAOf,KAAKI,QAAQ,0CAA0C,UAAUW,MAAM,SAAS;AAC3F;;;;;;;;;;GAYA,SAAgBC,mBAAmBpB,OAAgB;CAC/CA,MAAMqB,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAG3CvB,MAAMqB,SAASC,QAAQC,IAAI,QAAQ,QAAA;CACnCvB,MAAMqB,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDvB,MAAMqB,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAC9CvB,MAAMqB,SAASC,QAAQC,IAAI,mBAAmB,aAAA;AAClD;;;;;;;GASA,SAAgBC,gBAAgBpB,MAAcqB,UAAkBC,UAAgB;CAC5E,IAAI,CAACD,UACD,OAAOrB;CAGX,OAAOA,KAAKI,QACR,IAAImB,OAAO,eAAeD,SAASlB,QAAQ,wBAAwB,MAAA,KAAW,GAAA,IAC7EoB,QAAQC,cAAc,GAAGA,UAAU,IAAIJ,WAAWC,UAAU;AAErE;;;;;;;GASA,SAAgBI,0BAA0BnB,OAAc;CACpD,OAAOoB,KAAKC,UAAUrB,KAAAA,CAAAA,CACjBH,QAAQ,MAAM,SAAA,CAAA,CACdA,QAAQ,MAAM,SAAA,CAAA,CACdA,QAAQ,WAAW,SAAA,CAAA,CACnBA,QAAQ,WAAW,SAAA;AAC5B"}

package/dist/adapters/http/ui/shared/index.d.ts

@@ -0,0 +1,2 @@
+export * from './html.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/shared/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/shared/index.ts"],"names":[],"mappings":"AAOA,cAAc,WAAW,CAAC"}

package/dist/adapters/http/ui/shared/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes } from "./html.mjs";
+export { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes };

package/dist/adapters/http/ui/theme/apply.d.ts

@@ -0,0 +1,12 @@
+import type { IThemeProvider } from './types.ts';
+/**
+ * Apply the operator theme to a rendered console shell. A no-op when
+ * theming is off or the directory carries no manifest, so both console
+ * serve paths can call it unconditionally.
+ *
+ * Lives outside contract/ because it takes a provider (filesystem-backed)
+ * and splices into a served document: contract/ stays a pure description
+ * of what a theme IS.
+ */
+export declare function applyTheme(html: string, provider: IThemeProvider | undefined, basePath: string): Promise<string>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/adapters/http/ui/theme/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/apply.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAoBlB"}