@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.59

package/dist/adapters/http/ui/theme/contract/manifest.d.ts

@@ -0,0 +1,25 @@
+import { Container } from 'validup';
+import type { ThemeManifest } from './types.ts';
+/**
+ * Validator for the operator-authored `theme.json`.
+ *
+ * A validup Container over zod mounts, matching ConfigValidator: this file
+ * is config, not an API payload, and the config-shaped precedent in this
+ * codebase is validup. It also means a second consumer (a per-realm token
+ * map, an admin-console form, a CLI `theme validate`) reuses these rules
+ * instead of restating them.
+ *
+ * No validator groups: there is one source and one shape. A per-realm
+ * surface that accepts a narrower manifest than a file does would add one.
+ */
+export declare class ThemeManifestValidator extends Container<ThemeManifest> {
+    protected initialize(): void;
+}
+/**
+ * Validate a parsed `theme.json`. On failure the thrown error names the
+ * file and renders every issue as `<path>: <message>`, matching
+ * FileProvisioningSource: a bad entry must never abort a boot with nothing
+ * to act on.
+ */
+export declare function parseThemeManifest(input: unknown, filePath: string): Promise<ThemeManifest>;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/adapters/http/ui/theme/contract/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/ui/theme/contract/manifest.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAiC,MAAM,SAAS,CAAC;AAWnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAwChD;;;;;;;;;;;GAWG;AACH,qBAAa,sBAAuB,SAAQ,SAAS,CAAC,aAAa,CAAC;cAC7C,UAAU;CAYhC;AAqBD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,aAAa,CAAC,CA2BlG"}

package/dist/adapters/http/ui/theme/contract/manifest.mjs

@@ -0,0 +1,77 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_EXTENSIONS, THEME_IMAGE_EXTENSIONS, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN } from "./constants.mjs";
+import { themeAssetExtension } from "./utils.mjs";
+import { AuthupError } from "@authup/errors";
+import { Container, isValidupError, stringifyPath } from "validup";
+import { createValidator } from "@validup/zod";
+import { z } from "zod";
+//#region src/adapters/http/ui/theme/contract/manifest.ts
+const assetPathSchema = z.string().regex(new RegExp(`^${THEME_ASSETS_DIRECTORY_NAME}/[a-zA-Z0-9][a-zA-Z0-9._/-]*$`), `must be a path inside '${THEME_ASSETS_DIRECTORY_NAME}/'`).refine((value) => !value.split("/").includes(".."), "must not contain a \"..\" segment").refine((value) => THEME_ASSET_EXTENSIONS.includes(themeAssetExtension(value)), `must end in one of: ${THEME_ASSET_EXTENSIONS.join(", ")}`);
+/**
+* A logo must be an image. The general asset allowlist also covers CSS and
+* fonts, which would silently render as nothing here.
+*/ const logoPathSchema = assetPathSchema.refine((value) => THEME_IMAGE_EXTENSIONS.includes(themeAssetExtension(value)), `must be an image (${THEME_IMAGE_EXTENSIONS.join(", ")})`);
+const tokenMapSchema = z.record(z.string().regex(THEME_TOKEN_NAME_PATTERN, "must be a lowercase CSS custom property name (e.g. --authup-auth-accent)"), z.string().min(1).max(256).refine((value) => !THEME_TOKEN_VALUE_FORBIDDEN_PATTERN.test(value), "must not contain }, <, >, ;, @, \\, /*, url( or expression("));
+/**
+* Validator for the operator-authored `theme.json`.
+*
+* A validup Container over zod mounts, matching ConfigValidator: this file
+* is config, not an API payload, and the config-shaped precedent in this
+* codebase is validup. It also means a second consumer (a per-realm token
+* map, an admin-console form, a CLI `theme validate`) reuses these rules
+* instead of restating them.
+*
+* No validator groups: there is one source and one shape. A per-realm
+* surface that accepts a narrower manifest than a file does would add one.
+*/ var ThemeManifestValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("version", createValidator(z.literal(1)));
+		this.mount("title", { optional: true }, createValidator(z.string().min(1).max(200)));
+		this.mount("favicon", { optional: true }, createValidator(assetPathSchema));
+		this.mount("logo", { optional: true }, createValidator(logoPathSchema));
+		this.mount("logoDark", { optional: true }, createValidator(logoPathSchema));
+		this.mount("stylesheet", { optional: true }, createValidator(assetPathSchema));
+		this.mount("tokens", { optional: true }, createValidator(tokenMapSchema));
+		this.mount("tokensDark", { optional: true }, createValidator(tokenMapSchema));
+	}
+};
+const validator = new ThemeManifestValidator();
+/**
+* Every key the validator mounts. Validup STRIPS an unmounted key rather
+* than rejecting it, and a silently-ignored `stylesheets` typo is the exact
+* failure mode this feature must not have, so unknown keys are rejected
+* explicitly before the run.
+*/ const KNOWN_KEYS = [
+	"version",
+	"title",
+	"favicon",
+	"logo",
+	"logoDark",
+	"stylesheet",
+	"tokens",
+	"tokensDark"
+];
+/**
+* Validate a parsed `theme.json`. On failure the thrown error names the
+* file and renders every issue as `<path>: <message>`, matching
+* FileProvisioningSource: a bad entry must never abort a boot with nothing
+* to act on.
+*/ async function parseThemeManifest(input, filePath) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new AuthupError(`The theme manifest "${filePath}" must contain an object at its root.`);
+	const unknown = Object.keys(input).filter((key) => !KNOWN_KEYS.includes(key));
+	if (unknown.length > 0) throw new AuthupError(`The theme manifest "${filePath}" is invalid.\n${unknown.map((key) => `  ${key}: unknown property`).join("\n")}`);
+	try {
+		return await validator.run(input);
+	} catch (e) {
+		if (!isValidupError(e)) throw e;
+		const issues = e.issues.map((issue) => `  ${stringifyPath(issue.path)}: ${issue.message}`).join("\n");
+		throw new AuthupError(`The theme manifest "${filePath}" is invalid.\n${issues}`);
+	}
+}
+//#endregion
+export { ThemeManifestValidator, parseThemeManifest };
+
+//# sourceMappingURL=manifest.mjs.map

package/dist/adapters/http/ui/theme/contract/manifest.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.mjs","names":["AuthupError","createValidator","Container","isValidupError","stringifyPath","z","THEME_ASSETS_DIRECTORY_NAME","THEME_ASSET_EXTENSIONS","THEME_IMAGE_EXTENSIONS","THEME_MANIFEST_VERSION","THEME_TOKEN_NAME_PATTERN","THEME_TOKEN_VALUE_FORBIDDEN_PATTERN","THEME_TOKEN_VALUE_MAX_LENGTH","themeAssetExtension","assetPathSchema","string","regex","RegExp","refine","value","split","includes","join","logoPathSchema","tokenMapSchema","record","min","max","test","ThemeManifestValidator","initialize","mount","literal","optional","validator","KNOWN_KEYS","parseThemeManifest","input","filePath","Array","isArray","unknown","Object","keys","filter","key","length","map","run","e","issues","issue","path","message"],"sources":["../../../../../../src/adapters/http/ui/theme/contract/manifest.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError } from '@authup/errors';\nimport { createValidator } from '@validup/zod';\nimport { Container, isValidupError, stringifyPath } from 'validup';\nimport { z } from 'zod';\nimport {\n    THEME_ASSETS_DIRECTORY_NAME,\n    THEME_ASSET_EXTENSIONS,\n    THEME_IMAGE_EXTENSIONS,\n    THEME_MANIFEST_VERSION,\n    THEME_TOKEN_NAME_PATTERN,\n    THEME_TOKEN_VALUE_FORBIDDEN_PATTERN,\n    THEME_TOKEN_VALUE_MAX_LENGTH,\n} from './constants.ts';\nimport type { ThemeManifest } from './types.ts';\nimport { themeAssetExtension } from './utils.ts';\n\nconst assetPathSchema = z.string()\n    .regex(\n        new RegExp(`^${THEME_ASSETS_DIRECTORY_NAME}/[a-zA-Z0-9][a-zA-Z0-9._/-]*$`),\n        `must be a path inside '${THEME_ASSETS_DIRECTORY_NAME}/'`,\n    )\n    .refine(\n        (value) => !value.split('/').includes('..'),\n        'must not contain a \"..\" segment',\n    )\n    .refine(\n        (value) => THEME_ASSET_EXTENSIONS.includes(themeAssetExtension(value)),\n        `must end in one of: ${THEME_ASSET_EXTENSIONS.join(', ')}`,\n    );\n\n/**\n * A logo must be an image. The general asset allowlist also covers CSS and\n * fonts, which would silently render as nothing here.\n */\nconst logoPathSchema = assetPathSchema.refine(\n    (value) => THEME_IMAGE_EXTENSIONS.includes(themeAssetExtension(value)),\n    `must be an image (${THEME_IMAGE_EXTENSIONS.join(', ')})`,\n);\n\nconst tokenMapSchema = z.record(\n    z.string().regex(\n        THEME_TOKEN_NAME_PATTERN,\n        'must be a lowercase CSS custom property name (e.g. --authup-auth-accent)',\n    ),\n    z.string()\n        .min(1)\n        .max(THEME_TOKEN_VALUE_MAX_LENGTH)\n        .refine(\n            (value) => !THEME_TOKEN_VALUE_FORBIDDEN_PATTERN.test(value),\n            'must not contain }, <, >, ;, @, \\\\, /*, url( or expression(',\n        ),\n);\n\n/**\n * Validator for the operator-authored `theme.json`.\n *\n * A validup Container over zod mounts, matching ConfigValidator: this file\n * is config, not an API payload, and the config-shaped precedent in this\n * codebase is validup. It also means a second consumer (a per-realm token\n * map, an admin-console form, a CLI `theme validate`) reuses these rules\n * instead of restating them.\n *\n * No validator groups: there is one source and one shape. A per-realm\n * surface that accepts a narrower manifest than a file does would add one.\n */\nexport class ThemeManifestValidator extends Container<ThemeManifest> {\n    protected override initialize() {\n        super.initialize();\n\n        this.mount('version', createValidator(z.literal(THEME_MANIFEST_VERSION)));\n        this.mount('title', { optional: true }, createValidator(z.string().min(1).max(200)));\n        this.mount('favicon', { optional: true }, createValidator(assetPathSchema));\n        this.mount('logo', { optional: true }, createValidator(logoPathSchema));\n        this.mount('logoDark', { optional: true }, createValidator(logoPathSchema));\n        this.mount('stylesheet', { optional: true }, createValidator(assetPathSchema));\n        this.mount('tokens', { optional: true }, createValidator(tokenMapSchema));\n        this.mount('tokensDark', { optional: true }, createValidator(tokenMapSchema));\n    }\n}\n\nconst validator = new ThemeManifestValidator();\n\n/**\n * Every key the validator mounts. Validup STRIPS an unmounted key rather\n * than rejecting it, and a silently-ignored `stylesheets` typo is the exact\n * failure mode this feature must not have, so unknown keys are rejected\n * explicitly before the run.\n */\nconst KNOWN_KEYS = [\n    'version',\n    'title',\n    'favicon',\n    'logo',\n    'logoDark',\n    'stylesheet',\n    'tokens',\n    'tokensDark',\n];\n\n/**\n * Validate a parsed `theme.json`. On failure the thrown error names the\n * file and renders every issue as `<path>: <message>`, matching\n * FileProvisioningSource: a bad entry must never abort a boot with nothing\n * to act on.\n */\nexport async function parseThemeManifest(input: unknown, filePath: string) : Promise<ThemeManifest> {\n    if (typeof input !== 'object' || input === null || Array.isArray(input)) {\n        throw new AuthupError(`The theme manifest \"${filePath}\" must contain an object at its root.`);\n    }\n\n    const unknown = Object.keys(input).filter((key) => !KNOWN_KEYS.includes(key));\n    if (unknown.length > 0) {\n        throw new AuthupError(\n            `The theme manifest \"${filePath}\" is invalid.\\n${unknown\n                .map((key) => `  ${key}: unknown property`)\n                .join('\\n')}`,\n        );\n    }\n\n    try {\n        return await validator.run(input as Record<string, any>) as ThemeManifest;\n    } catch (e) {\n        if (!isValidupError(e)) {\n            throw e;\n        }\n\n        const issues = e.issues\n            .map((issue) => `  ${stringifyPath(issue.path)}: ${issue.message}`)\n            .join('\\n');\n\n        throw new AuthupError(`The theme manifest \"${filePath}\" is invalid.\\n${issues}`);\n    }\n}\n"],"mappings":";;;;;;;;;;AAuBA,MAAMc,kBAAkBT,EAAEU,OAAM,CAAA,CAC3BC,MACG,IAAIC,OAAO,IAAIX,4BAA4B,8BAA8B,GACzE,0BAA0BA,4BAA4B,GAAG,CAAA,CAE5DY,QACIC,UAAU,CAACA,MAAMC,MAAM,GAAA,CAAA,CAAKC,SAAS,IAAA,GACtC,mCAAA,CAAA,CAEHH,QACIC,UAAUZ,uBAAuBc,SAASR,oBAAoBM,KAAAA,CAAAA,GAC/D,uBAAuBZ,uBAAuBe,KAAK,IAAA,GAAO;;;;GAOlE,MAAMC,iBAAiBT,gBAAgBI,QAClCC,UAAUX,uBAAuBa,SAASR,oBAAoBM,KAAAA,CAAAA,GAC/D,qBAAqBX,uBAAuBc,KAAK,IAAA,EAAM,EAAE;AAG7D,MAAME,iBAAiBnB,EAAEoB,OACrBpB,EAAEU,OAAM,CAAA,CAAGC,MACPN,0BACA,0EAAA,GAEJL,EAAEU,OAAM,CAAA,CACHW,IAAI,CAAA,CAAA,CACJC,IAAAA,GAAIf,CAAAA,CACJM,QACIC,UAAU,CAACR,oCAAoCiB,KAAKT,KAAAA,GACrD,6DAAA,CAAA;;;;;;;;;;;;GAgBZ,IAAaU,yBAAb,cAA4C3B,UAAAA;CACrB4B,aAAa;EAC5B,MAAMA,WAAAA;EAEN,KAAKC,MAAM,WAAW9B,gBAAgBI,EAAE2B,QAAAA,CAAQvB,CAAAA,CAAAA;EAChD,KAAKsB,MAAM,SAAS,EAAEE,UAAU,KAAK,GAAGhC,gBAAgBI,EAAEU,OAAM,CAAA,CAAGW,IAAI,CAAA,CAAA,CAAGC,IAAI,GAAA,CAAA,CAAA;EAC9E,KAAKI,MAAM,WAAW,EAAEE,UAAU,KAAK,GAAGhC,gBAAgBa,eAAAA,CAAAA;EAC1D,KAAKiB,MAAM,QAAQ,EAAEE,UAAU,KAAK,GAAGhC,gBAAgBsB,cAAAA,CAAAA;EACvD,KAAKQ,MAAM,YAAY,EAAEE,UAAU,KAAK,GAAGhC,gBAAgBsB,cAAAA,CAAAA;EAC3D,KAAKQ,MAAM,cAAc,EAAEE,UAAU,KAAK,GAAGhC,gBAAgBa,eAAAA,CAAAA;EAC7D,KAAKiB,MAAM,UAAU,EAAEE,UAAU,KAAK,GAAGhC,gBAAgBuB,cAAAA,CAAAA;EACzD,KAAKO,MAAM,cAAc,EAAEE,UAAU,KAAK,GAAGhC,gBAAgBuB,cAAAA,CAAAA;CACjE;AACJ;AAEA,MAAMU,YAAY,IAAIL,uBAAAA;;;;;;GAQtB,MAAMM,aAAa;CACf;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACH;;;;;;GAQD,eAAsBC,mBAAmBC,OAAgBC,UAAgB;CACrE,IAAI,OAAOD,UAAU,YAAYA,UAAU,QAAQE,MAAMC,QAAQH,KAAAA,GAC7D,MAAM,IAAIrC,YAAY,uBAAuBsC,SAAS,sCAAsC;CAGhG,MAAMG,UAAUC,OAAOC,KAAKN,KAAAA,CAAAA,CAAOO,QAAQC,QAAQ,CAACV,WAAWd,SAASwB,GAAAA,CAAAA;CACxE,IAAIJ,QAAQK,SAAS,GACjB,MAAM,IAAI9C,YACN,uBAAuBsC,SAAS,iBAAiBG,QAC5CM,KAAKF,QAAQ,KAAKA,IAAI,mBAAmB,CAAA,CACzCvB,KAAK,IAAA,GAAO;CAIzB,IAAI;EACA,OAAO,MAAMY,UAAUc,IAAIX,KAAAA;CAC/B,SAASY,GAAG;EACR,IAAI,CAAC9C,eAAe8C,CAAAA,GAChB,MAAMA;EAGV,MAAMC,SAASD,EAAEC,OACZH,KAAKI,UAAU,KAAK/C,cAAc+C,MAAMC,IAAI,EAAE,IAAID,MAAME,SAAS,CAAA,CACjE/B,KAAK,IAAA;EAEV,MAAM,IAAItB,YAAY,uBAAuBsC,SAAS,iBAAiBY,QAAQ;CACnF;AACJ"}

package/dist/adapters/http/ui/theme/contract/types.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The operator-authored `theme.json`, after validation.
+ *
+ * `favicon` / `logo` / `stylesheet` are theme-relative paths inside
+ * `assets/`; they are emitted as `<basePath>/theme/<name>` hrefs.
+ */
+export type ThemeManifest = {
+    version: number;
+    title?: string;
+    favicon?: string;
+    /**
+     * Replaces the built-in logo mark on both consoles. Maps onto the
+     * `--authup-{auth,account}-logo-*` token pairs.
+     */
+    logo?: string;
+    /**
+     * Dark-mode variant of `logo`. Without it dark mode inherits `logo`,
+     * which is wrong for a mark that is dark-on-light. Usable on its own to
+     * override only dark mode.
+     */
+    logoDark?: string;
+    stylesheet?: string;
+    tokens?: Record<string, string>;
+    tokensDark?: Record<string, string>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/theme/contract/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/ui/theme/contract/types.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC"}

package/dist/adapters/http/ui/theme/contract/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/adapters/http/ui/theme/contract/utils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Lowercased file extension of a theme-relative path, including the dot
+ * (`assets/logo.SVG` -> `.svg`); empty when there is none.
+ *
+ * Hand-rolled rather than `node:path`'s extname so this folder stays free
+ * of node APIs and can be consumed by a browser-side theme editor.
+ * Manifest paths are always POSIX and already grammar-checked, so the
+ * separator handling extname does is not needed here.
+ */
+export declare function themeAssetExtension(value: string): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/adapters/http/ui/theme/contract/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/ui/theme/contract/utils.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAI,MAAM,CAS1D"}

package/dist/adapters/http/ui/theme/contract/utils.mjs

@@ -0,0 +1,22 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/ui/theme/contract/utils.ts
+/**
+* Lowercased file extension of a theme-relative path, including the dot
+* (`assets/logo.SVG` -> `.svg`); empty when there is none.
+*
+* Hand-rolled rather than `node:path`'s extname so this folder stays free
+* of node APIs and can be consumed by a browser-side theme editor.
+* Manifest paths are always POSIX and already grammar-checked, so the
+* separator handling extname does is not needed here.
+*/ function themeAssetExtension(value) {
+	const name = value.slice(value.lastIndexOf("/") + 1);
+	const index = name.lastIndexOf(".");
+	if (index <= 0) return "";
+	return name.slice(index).toLowerCase();
+}
+//#endregion
+export { themeAssetExtension };
+
+//# sourceMappingURL=utils.mjs.map

package/dist/adapters/http/ui/theme/contract/utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.mjs","names":["themeAssetExtension","value","name","slice","lastIndexOf","index","toLowerCase"],"sources":["../../../../../../src/adapters/http/ui/theme/contract/utils.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Lowercased file extension of a theme-relative path, including the dot\n * (`assets/logo.SVG` -> `.svg`); empty when there is none.\n *\n * Hand-rolled rather than `node:path`'s extname so this folder stays free\n * of node APIs and can be consumed by a browser-side theme editor.\n * Manifest paths are always POSIX and already grammar-checked, so the\n * separator handling extname does is not needed here.\n */\nexport function themeAssetExtension(value: string) : string {\n    const name = value.slice(value.lastIndexOf('/') + 1);\n    const index = name.lastIndexOf('.');\n\n    if (index <= 0) {\n        return '';\n    }\n\n    return name.slice(index).toLowerCase();\n}\n"],"mappings":";;;;;;;;;;;;GAgBA,SAAgBA,oBAAoBC,OAAa;CAC7C,MAAMC,OAAOD,MAAME,MAAMF,MAAMG,YAAY,GAAA,IAAO,CAAA;CAClD,MAAMC,QAAQH,KAAKE,YAAY,GAAA;CAE/B,IAAIC,SAAS,GACT,OAAO;CAGX,OAAOH,KAAKC,MAAME,KAAAA,CAAAA,CAAOC,YAAW;AACxC"}

package/dist/adapters/http/ui/theme/index.d.ts

@@ -0,0 +1,7 @@
+export * from './contract/index.ts';
+export * from './apply.ts';
+export * from './assets.ts';
+export * from './constants.ts';
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/theme/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AAEpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/theme/index.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH } from "./contract/constants.mjs";
+import { buildThemeHead, escapeHtml } from "./contract/head.mjs";
+import { themeAssetExtension } from "./contract/utils.mjs";
+import { ThemeManifestValidator, parseThemeManifest } from "./contract/manifest.mjs";
+import "./contract/index.mjs";
+import { applyTheme } from "./apply.mjs";
+import { THEME_ASSET_CSP, THEME_MANIFEST_REVALIDATE_INTERVAL } from "./constants.mjs";
+import { createThemeAssetsHandler } from "./assets.mjs";
+import { ThemeProvider } from "./module.mjs";
+export { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_CSP, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_REVALIDATE_INTERVAL, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH, ThemeManifestValidator, ThemeProvider, applyTheme, buildThemeHead, createThemeAssetsHandler, escapeHtml, parseThemeManifest, themeAssetExtension };

package/dist/adapters/http/ui/theme/module.d.ts

@@ -0,0 +1,79 @@
+import type { Logger } from '@authup/server-kit';
+import type { ThemeManifest } from './contract/index.ts';
+import type { IThemeProvider, ThemeProviderContext } from './types.ts';
+/**
+ * Owns the operator theme directory: manifest loading + validation, the
+ * realpathed servable asset root, and the memoized head markup.
+ *
+ * Failure posture is deliberately asymmetric, and inverts the
+ * FileProvisioningSource precedent for the request path:
+ * - at BOOT an invalid manifest throws, so a typo is reported once, loudly,
+ *   with the file path and every issue.
+ * - AFTER boot a manifest that becomes invalid keeps the last good value and
+ *   logs. Provisioning seeds authorization data; a theme is decoration, and
+ *   a broken logo must never take down the login page of an identity
+ *   provider.
+ */
+export declare class ThemeProvider implements IThemeProvider {
+    protected readonly directoryPath: string;
+    protected readonly manifestPath: string;
+    protected readonly fragmentPath: string;
+    protected readonly fragmentsEnabled: boolean;
+    protected readonly logger: Logger | undefined;
+    protected manifest: ThemeManifest | undefined;
+    protected headFragment: string | undefined;
+    protected assetsPath: string | undefined;
+    protected manifestSignature: string | undefined;
+    protected fragmentSignature: string | undefined;
+    protected revalidatedAt: number;
+    protected headCache: Map<string, string>;
+    constructor(ctx: ThemeProviderContext);
+    load(): Promise<void>;
+    getManifest(): Promise<ThemeManifest | undefined>;
+    getAssetsPath(): Promise<string | undefined>;
+    getHead(basePath: string): Promise<string>;
+    /**
+     * The mount root is `<root>/assets`, never the theme root, so the
+     * manifest is unreachable over HTTP by construction.
+     *
+     * Returns the LOGICAL path, deliberately not a realpath. A Kubernetes
+     * ConfigMap volume is a symlink farm whose update swaps `..data` to a
+     * NEW timestamped directory and deletes the old one, so a realpath
+     * captured here would dangle after the first update and every asset
+     * would 404 until the pod restarts. The asset handler resolves and
+     * re-asserts containment per request instead.
+     */
+    protected resolveAssetsPath(): Promise<string | undefined>;
+    /**
+     * Read + decode the manifest through locter, the same loader
+     * FileProvisioningSource uses for its operator files. Its JSON reader
+     * is a plain read-and-parse with no content cache, so the live reload
+     * below still sees an edited file.
+     */
+    protected readManifest(): Promise<unknown>;
+    protected readSignature(filePath: string): string | undefined;
+    /**
+     * Read `fragments/head.html`. Never called when the operator has not
+     * opted in, so dropping the file into the directory does nothing on
+     * its own.
+     */
+    protected readFragment(): string | undefined;
+    /**
+     * Re-read the manifest when it changed on disk, at most once per
+     * interval. One stat per console render is negligible next to the SSR
+     * pass it precedes, and it is what makes an edit visible without a
+     * restart (the property every operator asks about first).
+     */
+    protected revalidate(): Promise<void>;
+    protected revalidateManifest(): Promise<void>;
+    protected revalidateFragment(): void;
+    /**
+     * Always logged. The dominant failure mode of this feature is silence:
+     * mount the wrong path and the page looks exactly like an un-themed
+     * page. An enumerable boot summary is both the cheapest debugging
+     * affordance and the cheapest way to notice a file that should not be
+     * in the volume.
+     */
+    protected logInventory(): void;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/ui/theme/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAejD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,YAAW,cAAc;IAChD,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAG,MAAM,CAAC;IAE1C,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAG,MAAM,CAAC;IAEzC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAG,MAAM,CAAC;IAEzC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAG,OAAO,CAAC;IAE9C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAG,MAAM,GAAG,SAAS,CAAC;IAE/C,SAAS,CAAC,QAAQ,EAAG,aAAa,GAAG,SAAS,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAG,MAAM,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,MAAM,GAAG,SAAS,CAAC;IAE1C,SAAS,CAAC,iBAAiB,EAAG,MAAM,GAAG,SAAS,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,MAAM,GAAG,SAAS,CAAC;IAEjD,SAAS,CAAC,aAAa,SAAK;IAE5B,SAAS,CAAC,SAAS,sBAA6B;gBAEpC,GAAG,EAAE,oBAAoB;IAY/B,IAAI,IAAK,OAAO,CAAC,IAAI,CAAC;IAsBtB,WAAW,IAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAMlD,aAAa,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAM7C,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAqBjD;;;;;;;;;;OAUG;cACa,iBAAiB,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAajE;;;;;OAKG;cACa,YAAY,IAAK,OAAO,CAAC,OAAO,CAAC;IAYjD,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;IAU9D;;;;OAIG;IACH,SAAS,CAAC,YAAY,IAAK,MAAM,GAAG,SAAS;IAqB7C;;;;;OAKG;cACa,UAAU,IAAK,OAAO,CAAC,IAAI,CAAC;cAkB5B,kBAAkB,IAAK,OAAO,CAAC,IAAI,CAAC;IA2BpD,SAAS,CAAC,kBAAkB,IAAK,IAAI;IAiBrC;;;;;;OAMG;IACH,SAAS,CAAC,YAAY,IAAK,IAAI;CAoDlC"}

package/dist/adapters/http/ui/theme/module.mjs

@@ -0,0 +1,206 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { THEME_ASSETS_DIRECTORY_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_MANIFEST_FILE_NAME } from "./contract/constants.mjs";
+import { buildThemeHead } from "./contract/head.mjs";
+import { parseThemeManifest } from "./contract/manifest.mjs";
+import "./contract/index.mjs";
+import "./constants.mjs";
+import { AuthupError, normalizeError } from "@authup/errors";
+import path from "node:path";
+import { read } from "locter";
+import fs from "node:fs";
+//#region src/adapters/http/ui/theme/module.ts
+/**
+* Owns the operator theme directory: manifest loading + validation, the
+* realpathed servable asset root, and the memoized head markup.
+*
+* Failure posture is deliberately asymmetric, and inverts the
+* FileProvisioningSource precedent for the request path:
+* - at BOOT an invalid manifest throws, so a typo is reported once, loudly,
+*   with the file path and every issue.
+* - AFTER boot a manifest that becomes invalid keeps the last good value and
+*   logs. Provisioning seeds authorization data; a theme is decoration, and
+*   a broken logo must never take down the login page of an identity
+*   provider.
+*/ var ThemeProvider = class {
+	directoryPath;
+	manifestPath;
+	fragmentPath;
+	fragmentsEnabled;
+	logger;
+	manifest;
+	headFragment;
+	assetsPath;
+	manifestSignature;
+	fragmentSignature;
+	revalidatedAt = 0;
+	headCache = /* @__PURE__ */ new Map();
+	constructor(ctx) {
+		this.directoryPath = ctx.directoryPath;
+		this.fragmentsEnabled = ctx.fragmentsEnabled ?? false;
+		this.logger = ctx.logger;
+		this.manifestPath = path.join(ctx.directoryPath, THEME_MANIFEST_FILE_NAME);
+		this.fragmentPath = path.join(ctx.directoryPath, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME);
+	}
+	async load() {
+		this.assetsPath = await this.resolveAssetsPath();
+		this.manifestSignature = this.readSignature(this.manifestPath);
+		if (this.manifestSignature) this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);
+		if (this.fragmentsEnabled) {
+			this.headFragment = this.readFragment();
+			this.fragmentSignature = this.readSignature(this.fragmentPath);
+		}
+		this.revalidatedAt = Date.now();
+		this.headCache.clear();
+		this.logInventory();
+	}
+	async getManifest() {
+		await this.revalidate();
+		return this.manifest;
+	}
+	async getAssetsPath() {
+		await this.revalidate();
+		return this.assetsPath;
+	}
+	async getHead(basePath) {
+		const manifest = await this.getManifest();
+		const cached = this.headCache.get(basePath);
+		if (typeof cached === "string") return cached;
+		const head = buildThemeHead(manifest ?? { version: 1 }, basePath, this.headFragment);
+		this.headCache.set(basePath, head);
+		return head;
+	}
+	/**
+	* The mount root is `<root>/assets`, never the theme root, so the
+	* manifest is unreachable over HTTP by construction.
+	*
+	* Returns the LOGICAL path, deliberately not a realpath. A Kubernetes
+	* ConfigMap volume is a symlink farm whose update swaps `..data` to a
+	* NEW timestamped directory and deletes the old one, so a realpath
+	* captured here would dangle after the first update and every asset
+	* would 404 until the pod restarts. The asset handler resolves and
+	* re-asserts containment per request instead.
+	*/ async resolveAssetsPath() {
+		const assetsPath = path.join(this.directoryPath, THEME_ASSETS_DIRECTORY_NAME);
+		try {
+			return (await fs.promises.stat(assetsPath)).isDirectory() ? assetsPath : void 0;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Read + decode the manifest through locter, the same loader
+	* FileProvisioningSource uses for its operator files. Its JSON reader
+	* is a plain read-and-parse with no content cache, so the live reload
+	* below still sees an edited file.
+	*/ async readManifest() {
+		try {
+			return await read(this.manifestPath);
+		} catch (e) {
+			const reason = normalizeError(e).message;
+			throw new AuthupError(`The theme manifest "${this.manifestPath}" could not be read.\n  ${reason}`);
+		}
+	}
+	readSignature(filePath) {
+		try {
+			const stats = fs.statSync(filePath);
+			return `${stats.size}-${stats.mtimeMs}`;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Read `fragments/head.html`. Never called when the operator has not
+	* opted in, so dropping the file into the directory does nothing on
+	* its own.
+	*/ readFragment() {
+		let raw;
+		try {
+			raw = fs.readFileSync(this.fragmentPath, "utf-8");
+		} catch {
+			return;
+		}
+		if (raw.length > 65536) {
+			this.logger?.warn(`The head fragment "${this.fragmentPath}" exceeds ${THEME_HEAD_FRAGMENT_MAX_LENGTH} bytes and is ignored.`);
+			return;
+		}
+		const trimmed = raw.trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	}
+	/**
+	* Re-read the manifest when it changed on disk, at most once per
+	* interval. One stat per console render is negligible next to the SSR
+	* pass it precedes, and it is what makes an edit visible without a
+	* restart (the property every operator asks about first).
+	*/ async revalidate() {
+		const now = Date.now();
+		if (now - this.revalidatedAt < 1e3) return;
+		this.revalidatedAt = now;
+		this.assetsPath = await this.resolveAssetsPath();
+		await this.revalidateManifest();
+		this.revalidateFragment();
+	}
+	async revalidateManifest() {
+		const signature = this.readSignature(this.manifestPath);
+		if (signature === this.manifestSignature) return;
+		if (typeof signature === "undefined") {
+			this.manifestSignature = void 0;
+			this.manifest = void 0;
+			this.headCache.clear();
+			return;
+		}
+		this.manifestSignature = signature;
+		try {
+			this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);
+			this.headCache.clear();
+		} catch (e) {
+			const reason = normalizeError(e).message;
+			this.logger?.warn(`The theme manifest changed but is invalid, keeping the previous one.\n${reason}`);
+		}
+	}
+	revalidateFragment() {
+		if (!this.fragmentsEnabled) return;
+		const signature = this.readSignature(this.fragmentPath);
+		if (signature === this.fragmentSignature) return;
+		this.fragmentSignature = signature;
+		this.headFragment = typeof signature === "undefined" ? void 0 : this.readFragment();
+		this.headCache.clear();
+	}
+	/**
+	* Always logged. The dominant failure mode of this feature is silence:
+	* mount the wrong path and the page looks exactly like an un-themed
+	* page. An enumerable boot summary is both the cheapest debugging
+	* affordance and the cheapest way to notice a file that should not be
+	* in the volume.
+	*/ logInventory() {
+		if (!this.logger) return;
+		this.logger.info(`Theme directory: ${this.directoryPath} (theming is EXPERIMENTAL and may change in a minor release)`);
+		if (this.manifest) {
+			const tokens = Object.keys(this.manifest.tokens ?? {}).length;
+			const tokensDark = Object.keys(this.manifest.tokensDark ?? {}).length;
+			this.logger.info(`Theme manifest: loaded (${tokens} token(s), ${tokensDark} dark token(s))`);
+		} else this.logger.info(`Theme manifest: none (no ${THEME_MANIFEST_FILE_NAME})`);
+		if (!this.fragmentsEnabled) this.logger.info("Theme head fragment: disabled (themeFragmentsEnabled is off)");
+		else if (this.headFragment) this.logger.info(`Theme head fragment: loaded (${this.headFragment.length} bytes from ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`);
+		else this.logger.info(`Theme head fragment: none (no ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`);
+		if (!this.assetsPath) {
+			this.logger.info(`Theme assets: none (no ${THEME_ASSETS_DIRECTORY_NAME}/ directory)`);
+			return;
+		}
+		let files;
+		try {
+			files = fs.readdirSync(this.assetsPath, {
+				recursive: true,
+				withFileTypes: true
+			}).filter((entry) => entry.isFile()).map((entry) => path.relative(this.assetsPath, path.join(entry.parentPath, entry.name)).split(path.sep).join("/")).sort();
+		} catch {
+			files = [];
+		}
+		this.logger.info(`Theme assets (${files.length}): ${files.join(", ") || "-"}`);
+	}
+};
+//#endregion
+export { ThemeProvider };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/ui/theme/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["AuthupError","normalizeError","read","fs","path","THEME_MANIFEST_REVALIDATE_INTERVAL","THEME_ASSETS_DIRECTORY_NAME","THEME_FRAGMENTS_DIRECTORY_NAME","THEME_HEAD_FRAGMENT_FILE_NAME","THEME_HEAD_FRAGMENT_MAX_LENGTH","THEME_MANIFEST_FILE_NAME","THEME_MANIFEST_VERSION","buildThemeHead","parseThemeManifest","ThemeProvider","directoryPath","manifestPath","fragmentPath","fragmentsEnabled","logger","manifest","headFragment","assetsPath","manifestSignature","fragmentSignature","revalidatedAt","headCache","Map","ctx","join","load","resolveAssetsPath","readSignature","readManifest","readFragment","Date","now","clear","logInventory","getManifest","revalidate","getAssetsPath","getHead","basePath","cached","get","head","version","set","stats","promises","stat","isDirectory","undefined","e","reason","message","filePath","statSync","size","mtimeMs","raw","readFileSync","length","warn","trimmed","trim","revalidateManifest","revalidateFragment","signature","info","tokens","Object","keys","tokensDark","files","readdirSync","recursive","withFileTypes","filter","entry","isFile","map","relative","parentPath","name","split","sep","sort"],"sources":["../../../../../src/adapters/http/ui/theme/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, normalizeError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { THEME_MANIFEST_REVALIDATE_INTERVAL } from './constants.ts';\nimport {\n    THEME_ASSETS_DIRECTORY_NAME,\n    THEME_FRAGMENTS_DIRECTORY_NAME,\n    THEME_HEAD_FRAGMENT_FILE_NAME,\n    THEME_HEAD_FRAGMENT_MAX_LENGTH,\n    THEME_MANIFEST_FILE_NAME,\n    THEME_MANIFEST_VERSION,\n    buildThemeHead,\n    parseThemeManifest,\n} from './contract/index.ts';\nimport type { ThemeManifest } from './contract/index.ts';\nimport type { IThemeProvider, ThemeProviderContext } from './types.ts';\n\n/**\n * Owns the operator theme directory: manifest loading + validation, the\n * realpathed servable asset root, and the memoized head markup.\n *\n * Failure posture is deliberately asymmetric, and inverts the\n * FileProvisioningSource precedent for the request path:\n * - at BOOT an invalid manifest throws, so a typo is reported once, loudly,\n *   with the file path and every issue.\n * - AFTER boot a manifest that becomes invalid keeps the last good value and\n *   logs. Provisioning seeds authorization data; a theme is decoration, and\n *   a broken logo must never take down the login page of an identity\n *   provider.\n */\nexport class ThemeProvider implements IThemeProvider {\n    protected readonly directoryPath : string;\n\n    protected readonly manifestPath : string;\n\n    protected readonly fragmentPath : string;\n\n    protected readonly fragmentsEnabled : boolean;\n\n    protected readonly logger : Logger | undefined;\n\n    protected manifest : ThemeManifest | undefined;\n\n    protected headFragment : string | undefined;\n\n    protected assetsPath : string | undefined;\n\n    protected manifestSignature : string | undefined;\n\n    protected fragmentSignature : string | undefined;\n\n    protected revalidatedAt = 0;\n\n    protected headCache = new Map<string, string>();\n\n    constructor(ctx: ThemeProviderContext) {\n        this.directoryPath = ctx.directoryPath;\n        this.fragmentsEnabled = ctx.fragmentsEnabled ?? false;\n        this.logger = ctx.logger;\n        this.manifestPath = path.join(ctx.directoryPath, THEME_MANIFEST_FILE_NAME);\n        this.fragmentPath = path.join(\n            ctx.directoryPath,\n            THEME_FRAGMENTS_DIRECTORY_NAME,\n            THEME_HEAD_FRAGMENT_FILE_NAME,\n        );\n    }\n\n    async load() : Promise<void> {\n        this.assetsPath = await this.resolveAssetsPath();\n\n        // Stat first: it doubles as the existence probe (no manifest is a\n        // valid theme — the operator may ship only a stylesheet) and as the\n        // revalidation signature.\n        this.manifestSignature = this.readSignature(this.manifestPath);\n        if (this.manifestSignature) {\n            this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);\n        }\n\n        if (this.fragmentsEnabled) {\n            this.headFragment = this.readFragment();\n            this.fragmentSignature = this.readSignature(this.fragmentPath);\n        }\n\n        this.revalidatedAt = Date.now();\n        this.headCache.clear();\n\n        this.logInventory();\n    }\n\n    async getManifest() : Promise<ThemeManifest | undefined> {\n        await this.revalidate();\n\n        return this.manifest;\n    }\n\n    async getAssetsPath() : Promise<string | undefined> {\n        await this.revalidate();\n\n        return this.assetsPath;\n    }\n\n    async getHead(basePath: string) : Promise<string> {\n        // Drives the revalidation for both files.\n        const manifest = await this.getManifest();\n\n        const cached = this.headCache.get(basePath);\n        if (typeof cached === 'string') {\n            return cached;\n        }\n\n        const head = buildThemeHead(\n            manifest ?? { version: THEME_MANIFEST_VERSION },\n            basePath,\n            this.headFragment,\n        );\n        this.headCache.set(basePath, head);\n\n        return head;\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * The mount root is `<root>/assets`, never the theme root, so the\n     * manifest is unreachable over HTTP by construction.\n     *\n     * Returns the LOGICAL path, deliberately not a realpath. A Kubernetes\n     * ConfigMap volume is a symlink farm whose update swaps `..data` to a\n     * NEW timestamped directory and deletes the old one, so a realpath\n     * captured here would dangle after the first update and every asset\n     * would 404 until the pod restarts. The asset handler resolves and\n     * re-asserts containment per request instead.\n     */\n    protected async resolveAssetsPath() : Promise<string | undefined> {\n        const assetsPath = path.join(this.directoryPath, THEME_ASSETS_DIRECTORY_NAME);\n\n        try {\n            // stat follows the symlink, so this still rejects a non-directory.\n            const stats = await fs.promises.stat(assetsPath);\n\n            return stats.isDirectory() ? assetsPath : undefined;\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Read + decode the manifest through locter, the same loader\n     * FileProvisioningSource uses for its operator files. Its JSON reader\n     * is a plain read-and-parse with no content cache, so the live reload\n     * below still sees an edited file.\n     */\n    protected async readManifest() : Promise<unknown> {\n        try {\n            return await read(this.manifestPath);\n        } catch (e) {\n            const reason = normalizeError(e).message;\n\n            throw new AuthupError(\n                `The theme manifest \"${this.manifestPath}\" could not be read.\\n  ${reason}`,\n            );\n        }\n    }\n\n    protected readSignature(filePath: string) : string | undefined {\n        try {\n            const stats = fs.statSync(filePath);\n\n            return `${stats.size}-${stats.mtimeMs}`;\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Read `fragments/head.html`. Never called when the operator has not\n     * opted in, so dropping the file into the directory does nothing on\n     * its own.\n     */\n    protected readFragment() : string | undefined {\n        let raw : string;\n        try {\n            raw = fs.readFileSync(this.fragmentPath, 'utf-8');\n        } catch {\n            return undefined;\n        }\n\n        if (raw.length > THEME_HEAD_FRAGMENT_MAX_LENGTH) {\n            this.logger?.warn(\n                `The head fragment \"${this.fragmentPath}\" exceeds ${THEME_HEAD_FRAGMENT_MAX_LENGTH} bytes and is ignored.`,\n            );\n\n            return undefined;\n        }\n\n        const trimmed = raw.trim();\n\n        return trimmed.length > 0 ? trimmed : undefined;\n    }\n\n    /**\n     * Re-read the manifest when it changed on disk, at most once per\n     * interval. One stat per console render is negligible next to the SSR\n     * pass it precedes, and it is what makes an edit visible without a\n     * restart (the property every operator asks about first).\n     */\n    protected async revalidate() : Promise<void> {\n        const now = Date.now();\n        if (now - this.revalidatedAt < THEME_MANIFEST_REVALIDATE_INTERVAL) {\n            return;\n        }\n        this.revalidatedAt = now;\n\n        // Re-resolved with the manifest, not captured at boot: a directory\n        // that carried no `assets/` when the process started would otherwise\n        // 404 every asset forever, even though the manifest hot-reloads and\n        // can start referencing them. One stat, on the interval that already\n        // pays for two.\n        this.assetsPath = await this.resolveAssetsPath();\n\n        await this.revalidateManifest();\n        this.revalidateFragment();\n    }\n\n    protected async revalidateManifest() : Promise<void> {\n        const signature = this.readSignature(this.manifestPath);\n        if (signature === this.manifestSignature) {\n            return;\n        }\n\n        if (typeof signature === 'undefined') {\n            this.manifestSignature = undefined;\n            this.manifest = undefined;\n            this.headCache.clear();\n\n            return;\n        }\n\n        // Stamped before the parse attempt so a persistently broken file is\n        // re-parsed once per edit, not once per render.\n        this.manifestSignature = signature;\n\n        try {\n            this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);\n            this.headCache.clear();\n        } catch (e) {\n            const reason = normalizeError(e).message;\n            this.logger?.warn(`The theme manifest changed but is invalid, keeping the previous one.\\n${reason}`);\n        }\n    }\n\n    protected revalidateFragment() : void {\n        if (!this.fragmentsEnabled) {\n            return;\n        }\n\n        const signature = this.readSignature(this.fragmentPath);\n        if (signature === this.fragmentSignature) {\n            return;\n        }\n\n        this.fragmentSignature = signature;\n        this.headFragment = typeof signature === 'undefined' ?\n            undefined :\n            this.readFragment();\n        this.headCache.clear();\n    }\n\n    /**\n     * Always logged. The dominant failure mode of this feature is silence:\n     * mount the wrong path and the page looks exactly like an un-themed\n     * page. An enumerable boot summary is both the cheapest debugging\n     * affordance and the cheapest way to notice a file that should not be\n     * in the volume.\n     */\n    protected logInventory() : void {\n        if (!this.logger) {\n            return;\n        }\n\n        this.logger.info(\n            `Theme directory: ${this.directoryPath} (theming is EXPERIMENTAL and may change in a minor release)`,\n        );\n\n        if (this.manifest) {\n            const tokens = Object.keys(this.manifest.tokens ?? {}).length;\n            const tokensDark = Object.keys(this.manifest.tokensDark ?? {}).length;\n            this.logger.info(\n                `Theme manifest: loaded (${tokens} token(s), ${tokensDark} dark token(s))`,\n            );\n        } else {\n            this.logger.info(`Theme manifest: none (no ${THEME_MANIFEST_FILE_NAME})`);\n        }\n\n        if (!this.fragmentsEnabled) {\n            this.logger.info('Theme head fragment: disabled (themeFragmentsEnabled is off)');\n        } else if (this.headFragment) {\n            this.logger.info(\n                `Theme head fragment: loaded (${this.headFragment.length} bytes from ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`,\n            );\n        } else {\n            this.logger.info(\n                `Theme head fragment: none (no ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`,\n            );\n        }\n\n        if (!this.assetsPath) {\n            this.logger.info(`Theme assets: none (no ${THEME_ASSETS_DIRECTORY_NAME}/ directory)`);\n\n            return;\n        }\n\n        let files : string[];\n        try {\n            files = fs.readdirSync(this.assetsPath, { recursive: true, withFileTypes: true })\n                .filter((entry) => entry.isFile())\n                .map((entry) => path\n                    .relative(this.assetsPath as string, path.join(entry.parentPath, entry.name))\n                    .split(path.sep)\n                    .join('/'))\n                .sort();\n        } catch {\n            files = [];\n        }\n\n        this.logger.info(`Theme assets (${files.length}): ${files.join(', ') || '-'}`);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAuCA,IAAac,gBAAb,MAAaA;CACUC;CAEAC;CAEAC;CAEAC;CAEAC;CAETC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC,gBAAgB;CAEhBC,4BAAY,IAAIC,IAAAA;CAE1B,YAAYC,KAA2B;EACnC,KAAKb,gBAAgBa,IAAIb;EACzB,KAAKG,mBAAmBU,IAAIV,oBAAoB;EAChD,KAAKC,SAASS,IAAIT;EAClB,KAAKH,eAAeZ,KAAKyB,KAAKD,IAAIb,eAAeL,wBAAAA;EACjD,KAAKO,eAAeb,KAAKyB,KACrBD,IAAIb,eACJR,gCACAC,6BAAAA;CAER;CAEA,MAAMsB,OAAuB;EACzB,KAAKR,aAAa,MAAM,KAAKS,kBAAiB;EAK9C,KAAKR,oBAAoB,KAAKS,cAAc,KAAKhB,YAAY;EAC7D,IAAI,KAAKO,mBACL,KAAKH,WAAW,MAAMP,mBAAmB,MAAM,KAAKoB,aAAY,GAAI,KAAKjB,YAAY;EAGzF,IAAI,KAAKE,kBAAkB;GACvB,KAAKG,eAAe,KAAKa,aAAY;GACrC,KAAKV,oBAAoB,KAAKQ,cAAc,KAAKf,YAAY;EACjE;EAEA,KAAKQ,gBAAgBU,KAAKC,IAAG;EAC7B,KAAKV,UAAUW,MAAK;EAEpB,KAAKC,aAAY;CACrB;CAEA,MAAMC,cAAmD;EACrD,MAAM,KAAKC,WAAU;EAErB,OAAO,KAAKpB;CAChB;CAEA,MAAMqB,gBAA8C;EAChD,MAAM,KAAKD,WAAU;EAErB,OAAO,KAAKlB;CAChB;CAEA,MAAMoB,QAAQC,UAAoC;EAE9C,MAAMvB,WAAW,MAAM,KAAKmB,YAAW;EAEvC,MAAMK,SAAS,KAAKlB,UAAUmB,IAAIF,QAAAA;EAClC,IAAI,OAAOC,WAAW,UAClB,OAAOA;EAGX,MAAME,OAAOlC,eACTQ,YAAY,EAAE2B,SAAAA,EAAgC,GAC9CJ,UACA,KAAKtB,YAAY;EAErB,KAAKK,UAAUsB,IAAIL,UAAUG,IAAAA;EAE7B,OAAOA;CACX;;;;;;;;;;;IAeA,MAAgBf,oBAAkD;EAC9D,MAAMT,aAAalB,KAAKyB,KAAK,KAAKd,eAAeT,2BAAAA;EAEjD,IAAI;GAIA,QAAO2C,MAFa9C,GAAG+C,SAASC,KAAK7B,UAAAA,EAAAA,CAExB8B,YAAW,IAAK9B,aAAa+B,KAAAA;EAC9C,QAAQ;GACJ;EACJ;CACJ;;;;;;IAQA,MAAgBpB,eAAkC;EAC9C,IAAI;GACA,OAAO,MAAM/B,KAAK,KAAKc,YAAY;EACvC,SAASsC,GAAG;GACR,MAAMC,SAAStD,eAAeqD,CAAAA,CAAAA,CAAGE;GAEjC,MAAM,IAAIxD,YACN,uBAAuB,KAAKgB,aAAa,0BAA0BuC,QAAQ;EAEnF;CACJ;CAEUvB,cAAcyB,UAAuC;EAC3D,IAAI;GACA,MAAMR,QAAQ9C,GAAGuD,SAASD,QAAAA;GAE1B,OAAO,GAAGR,MAAMU,KAAK,GAAGV,MAAMW;EAClC,QAAQ;GACJ;EACJ;CACJ;;;;;IAOA,eAA8C;EAC1C,IAAIC;EACJ,IAAI;GACAA,MAAM1D,GAAG2D,aAAa,KAAK7C,cAAc,OAAA;EAC7C,QAAQ;GACJ;EACJ;EAEA,IAAI4C,IAAIE,SAAAA,OAAyC;GAC7C,KAAK5C,QAAQ6C,KACT,sBAAsB,KAAK/C,aAAa,YAAYR,+BAA+B,uBAAuB;GAG9G;EACJ;EAEA,MAAMwD,UAAUJ,IAAIK,KAAI;EAExB,OAAOD,QAAQF,SAAS,IAAIE,UAAUZ,KAAAA;CAC1C;;;;;;IAQA,MAAgBb,aAA6B;EACzC,MAAMJ,MAAMD,KAAKC,IAAG;EACpB,IAAIA,MAAM,KAAKX,gBAAAA,KACX;EAEJ,KAAKA,gBAAgBW;EAOrB,KAAKd,aAAa,MAAM,KAAKS,kBAAiB;EAE9C,MAAM,KAAKoC,mBAAkB;EAC7B,KAAKC,mBAAkB;CAC3B;CAEA,MAAgBD,qBAAqC;EACjD,MAAME,YAAY,KAAKrC,cAAc,KAAKhB,YAAY;EACtD,IAAIqD,cAAc,KAAK9C,mBACnB;EAGJ,IAAI,OAAO8C,cAAc,aAAa;GAClC,KAAK9C,oBAAoB8B,KAAAA;GACzB,KAAKjC,WAAWiC,KAAAA;GAChB,KAAK3B,UAAUW,MAAK;GAEpB;EACJ;EAIA,KAAKd,oBAAoB8C;EAEzB,IAAI;GACA,KAAKjD,WAAW,MAAMP,mBAAmB,MAAM,KAAKoB,aAAY,GAAI,KAAKjB,YAAY;GACrF,KAAKU,UAAUW,MAAK;EACxB,SAASiB,GAAG;GACR,MAAMC,SAAStD,eAAeqD,CAAAA,CAAAA,CAAGE;GACjC,KAAKrC,QAAQ6C,KAAK,yEAAyET,QAAQ;EACvG;CACJ;CAEUa,qBAA4B;EAClC,IAAI,CAAC,KAAKlD,kBACN;EAGJ,MAAMmD,YAAY,KAAKrC,cAAc,KAAKf,YAAY;EACtD,IAAIoD,cAAc,KAAK7C,mBACnB;EAGJ,KAAKA,oBAAoB6C;EACzB,KAAKhD,eAAe,OAAOgD,cAAc,cACrChB,KAAAA,IACA,KAAKnB,aAAY;EACrB,KAAKR,UAAUW,MAAK;CACxB;;;;;;;IASA,eAAgC;EAC5B,IAAI,CAAC,KAAKlB,QACN;EAGJ,KAAKA,OAAOmD,KACR,oBAAoB,KAAKvD,cAAc,6DAA6D;EAGxG,IAAI,KAAKK,UAAU;GACf,MAAMmD,SAASC,OAAOC,KAAK,KAAKrD,SAASmD,UAAU,CAAC,CAAA,CAAA,CAAGR;GACvD,MAAMW,aAAaF,OAAOC,KAAK,KAAKrD,SAASsD,cAAc,CAAC,CAAA,CAAA,CAAGX;GAC/D,KAAK5C,OAAOmD,KACR,2BAA2BC,OAAO,aAAaG,WAAW,gBAAgB;EAElF,OACI,KAAKvD,OAAOmD,KAAK,4BAA4B5D,yBAAyB,EAAE;EAG5E,IAAI,CAAC,KAAKQ,kBACN,KAAKC,OAAOmD,KAAK,8DAAA;OACd,IAAI,KAAKjD,cACZ,KAAKF,OAAOmD,KACR,gCAAgC,KAAKjD,aAAa0C,OAAO,cAAcxD,+BAA+B,GAAGC,8BAA8B,EAAE;OAG7I,KAAKW,OAAOmD,KACR,iCAAiC/D,+BAA+B,GAAGC,8BAA8B,EAAE;EAI3G,IAAI,CAAC,KAAKc,YAAY;GAClB,KAAKH,OAAOmD,KAAK,0BAA0BhE,4BAA4B,aAAa;GAEpF;EACJ;EAEA,IAAIqE;EACJ,IAAI;GACAA,QAAQxE,GAAGyE,YAAY,KAAKtD,YAAY;IAAEuD,WAAW;IAAMC,eAAe;GAAK,CAAA,CAAA,CAC1EC,QAAQC,UAAUA,MAAMC,OAAM,CAAA,CAAA,CAC9BC,KAAKF,UAAU5E,KACX+E,SAAS,KAAK7D,YAAsBlB,KAAKyB,KAAKmD,MAAMI,YAAYJ,MAAMK,IAAI,CAAA,CAAA,CAC1EC,MAAMlF,KAAKmF,GAAG,CAAA,CACd1D,KAAK,GAAA,CAAA,CAAA,CACT2D,KAAI;EACb,QAAQ;GACJb,QAAQ,CAAA;EACZ;EAEA,KAAKxD,OAAOmD,KAAK,iBAAiBK,MAAMZ,OAAO,KAAKY,MAAM9C,KAAK,IAAA,KAAS,KAAK;CACjF;AACJ"}

package/dist/adapters/http/ui/theme/types.d.ts

@@ -0,0 +1,42 @@
+import type { Logger } from '@authup/server-kit';
+import type { ThemeManifest } from './contract/index.ts';
+export type ThemeProviderContext = {
+    /**
+     * Absolute path of the theme root (normalizeConfig resolves a relative
+     * value against the rootPath).
+     */
+    directoryPath: string;
+    /**
+     * Opt in to reading `fragments/head.html`. Default off: the fragment
+     * is unsanitized markup served on the IdP origin.
+     */
+    fragmentsEnabled?: boolean;
+    logger?: Logger;
+};
+export interface IThemeProvider {
+    /**
+     * Read + validate the manifest and resolve the servable asset root.
+     * Throws on an invalid manifest, so a typo fails the boot rather than
+     * silently rendering an un-themed page.
+     */
+    load(): Promise<void>;
+    /**
+     * The current manifest, re-read when the file changed on disk. Returns
+     * undefined when the directory carries no manifest (Layer 2 only).
+     *
+     * Async because validation runs through validup. The re-read is
+     * debounced and the head is memoized, so a steady-state render awaits
+     * an already-resolved value.
+     */
+    getManifest(): Promise<ThemeManifest | undefined>;
+    /**
+     * The realpathed `<root>/assets` directory, or undefined when absent.
+     * Every served path is re-checked against this value.
+     */
+    getAssetsPath(): Promise<string | undefined>;
+    /**
+     * The markup injected before `</head>`, memoized per base path.
+     */
+    getHead(basePath: string): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/theme/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,cAAc;IAC3B;;;;OAIG;IACH,IAAI,IAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;;OAOG;IACH,WAAW,IAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAEnD;;;OAGG;IACH,aAAa,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE9C;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C"}

package/dist/adapters/http/ui/theme/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};