@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/adapters/http/controllers/entities/identity-provider-account/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider-account/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,wBAAwB,EACxB,oBAAoB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AASpF,MAAM,MAAM,wCAAwC,GAAG;IACnD,OAAO,EAAE,+BAA+B,CAAC;CAC5C,CAAC;AAEF,qBAEa,iCAAiC;IAC1C,SAAS,CAAC,OAAO,EAAE,+BAA+B,CAAC;gBAEvC,GAAG,EAAE,wCAAwC;IAKnD,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAiBvD,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;IASnD,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC;CAQ5D"}

package/dist/adapters/http/controllers/entities/identity-provider-account/module.mjs

@@ -0,0 +1,94 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../core/query/describe.mjs";
+import { identityProviderAccountSchema } from "../../../../../core/entities/identity-provider-account/schema.mjs";
+import "../../../../../core/index.mjs";
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import { getRequestRealmID } from "../../../request/helpers/realm-id.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/identity-provider-account/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var IdentityProviderAccountController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });
+		return {
+			data,
+			meta: {
+				...meta,
+				schema: describeQuerySchema(identityProviderAccountSchema)
+			}
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return {
+			data: await this.service.getOne(id, actor, { realmId: getRequestRealmID(event) }),
+			meta: { schema: describeQuerySchema(identityProviderAccountSchema, RECORD_QUERY_PARAMETERS) }
+		};
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });
+		event.response.status = 202;
+		return {
+			data: entity,
+			meta: {}
+		};
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderAccountController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderAccountController.prototype, "getOne", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], IdentityProviderAccountController.prototype, "drop", null);
+IdentityProviderAccountController = _ts_decorate([
+	DTags("identity"),
+	DController(["/identity-provider-accounts", "/realms/:realmId/identity-provider-accounts"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IdentityProviderAccountControllerContext === "undefined" ? Object : IdentityProviderAccountControllerContext])
+], IdentityProviderAccountController);
+//#endregion
+export { IdentityProviderAccountController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/identity-provider-account/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","identityProviderAccountSchema","ForceLoggedInMiddleware","buildActorContext","getRequestRealmID","IdentityProviderAccountController","service","ctx","getMany","event","actor","data","meta","realmId","schema","getOne","id","entity","drop","delete","response","status"],"sources":["../../../../../../src/adapters/http/controllers/entities/identity-provider-account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { IdentityProviderAccount } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    EntityCollectionResponse,\n    EntityRecordResponse,\n} from '@authup/core-http-kit';\nimport type { IIdentityProviderAccountService } from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    describeQuerySchema,\n    identityProviderAccountSchema,\n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, getRequestRealmID } from '../../../request/index.ts';\n\nexport type IdentityProviderAccountControllerContext = {\n    service: IIdentityProviderAccountService,\n};\n\n@DTags('identity')\n@DController(['/identity-provider-accounts', '/realms/:realmId/identity-provider-accounts'])\nexport class IdentityProviderAccountController {\n    protected service: IIdentityProviderAccountService;\n\n    constructor(ctx: IdentityProviderAccountControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<IdentityProviderAccount>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor, { realmId: getRequestRealmID(event) });\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(identityProviderAccountSchema),\n            },\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<IdentityProviderAccount>> {\n        const actor = buildActorContext(event);\n\n        const entity = await this.service.getOne(id, actor, { realmId: getRequestRealmID(event) });\n\n        return { data: entity, meta: { schema: describeQuerySchema(identityProviderAccountSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<IdentityProviderAccount>> {\n        const actor = buildActorContext(event);\n\n        const entity = await this.service.delete(id, actor, { realmId: getRequestRealmID(event) });\n\n        event.response.status = 202;\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAaa,oCAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+C;EACvD,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC0D;EAC1D,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQV,gBAAgBW,KAAAA,GAAQC,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAElG,OAAO;GACHE;GACAC,MAAM;IACF,GAAGA;IACHE,QAAQd,oBAAoBC,6BAAAA;GAChC;EACJ;CACJ;CAEA,MACMc,OACF,IACA,OACsD;EACtD,MAAML,QAAQP,kBAAkBM,KAAAA;EAIhC,OAAO;GAAEE,MAAMM,MAFM,KAAKX,QAAQS,OAAOC,IAAIN,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;GAEjEG,MAAM,EAAEE,QAAQd,oBAAoBC,+BAA+BF,uBAAAA,EAAyB;EAAE;CACzH;CAEA,MACMmB,KACF,IACA,OACsD;EACtD,MAAMR,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAMQ,SAAS,MAAM,KAAKX,QAAQa,OAAOH,IAAIN,OAAO,EAAEG,SAAST,kBAAkBK,KAAAA,EAAO,CAAA;EAExFA,MAAMW,SAASC,SAAS;EACxB,OAAO;GAAEV,MAAMM;GAAQL,MAAM,CAAC;EAAE;CACpC;AACJ;;CA3CeV,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAmBIA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAYGA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;CAvCR,YAAA,CAAA,+BAA+B,6CAAA,CAAA"}

package/dist/adapters/http/controllers/entities/index.d.ts

@@ -5,6 +5,7 @@ export * from './client-scope/index.ts';
 export * from './consent/index.ts';
 export * from './event/index.ts';
 export * from './identity-provider/index.ts';
+export * from './identity-provider-account/index.ts';
 export * from './identity-provide-role/index.ts';
 export * from './key/index.ts';
 export * from './permission/index.ts';
@@ -16,6 +17,7 @@ export * from './role-permission/index.ts';
 export * from './policy/index.ts';
 export * from './scope/index.ts';
 export * from './session/index.ts';
+export * from './session-token/index.ts';
 export * from './trust-anchor/index.ts';
 export * from './user/index.ts';
 export * from './user-attribute/index.ts';

package/dist/adapters/http/controllers/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/entities/index.ts"],"names":[],"mappings":"AAOA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/adapters/http/controllers/entities/index.mjs

@@ -18,6 +18,8 @@ import { EventController } from "./event/module.mjs";
 import "./event/index.mjs";
 import { IdentityProviderController } from "./identity-provider/module.mjs";
 import "./identity-provider/index.mjs";
+import { IdentityProviderAccountController } from "./identity-provider-account/module.mjs";
+import "./identity-provider-account/index.mjs";
 import { IdentityProviderRoleMappingController } from "./identity-provide-role/module.mjs";
 import "./identity-provide-role/index.mjs";
 import { KeyController } from "./key/module.mjs";
@@ -44,6 +46,8 @@ import { ScopeController } from "./scope/module.mjs";
 import "./scope/index.mjs";
 import { SessionController } from "./session/module.mjs";
 import "./session/index.mjs";
+import { SessionTokenController } from "./session-token/module.mjs";
+import "./session-token/index.mjs";
 import { TrustAnchorController } from "./trust-anchor/module.mjs";
 import "./trust-anchor/index.mjs";
 import { UserController } from "./user/module.mjs";
@@ -59,4 +63,4 @@ import "./user-permission/index.mjs";
 import { UserRoleController } from "./user-role/module.mjs";
 import { UserRoleRequestValidator } from "./user-role/utils/validation.mjs";
 import "./user-role/index.mjs";
-export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };
+export { ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, KeyController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator };

package/dist/adapters/http/controllers/entities/session-token/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/entities/session-token/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session-token/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/entities/session-token/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SessionTokenController } from "./module.mjs";
+export { SessionTokenController };

package/dist/adapters/http/controllers/entities/session-token/module.d.ts

@@ -0,0 +1,23 @@
+import type { SessionToken } from '@authup/core-kit';
+import type { IAppEvent } from 'routup';
+import type { EntityCollectionResponse, EntityRecordResponse } from '@authup/core-http-kit';
+import type { ISessionTokenService, SessionTokenDeleteManyResult } from '../../../../../core/index.ts';
+export type SessionTokenControllerContext = {
+    service: ISessionTokenService;
+};
+export declare class SessionTokenController {
+    protected service: ISessionTokenService;
+    constructor(ctx: SessionTokenControllerContext);
+    getMany(event: IAppEvent): Promise<EntityCollectionResponse<SessionToken>>;
+    getOne(id: string, event: IAppEvent): Promise<EntityRecordResponse<SessionToken>>;
+    /**
+     * Revoke every token matching the query. Requires a target filter, so it
+     * cannot degenerate into an unscoped mass revoke.
+     *
+     * Scoped to one client this is "sign out of this application": the session
+     * itself survives, so the other applications riding it stay signed in.
+     */
+    dropMany(event: IAppEvent): Promise<SessionTokenDeleteManyResult>;
+    drop(id: string, event: IAppEvent): Promise<EntityRecordResponse<SessionToken>>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/entities/session-token/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/entities/session-token/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AASvG,MAAM,MAAM,6BAA6B,GAAG;IACxC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBAEa,sBAAsB;IAC/B,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,6BAA6B;IAKxC,OAAO,CACG,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;IAc5C,MAAM,CACK,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAU9C;;;;;;OAMG;IAEG,QAAQ,CACE,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,4BAA4B,CAAC;IASlC,IAAI,CACO,EAAE,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;CAOjD"}

package/dist/adapters/http/controllers/entities/session-token/module.mjs

@@ -0,0 +1,112 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../core/query/describe.mjs";
+import { sessionTokenSchema } from "../../../../../core/entities/session-token/schema.mjs";
+import "../../../../../core/index.mjs";
+import { buildActorContext } from "../../../request/helpers/actor.mjs";
+import "../../../request/index.mjs";
+import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
+import "../../../middleware/index.mjs";
+import { useRequestQuery } from "@routup/basic/query";
+import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
+//#region src/adapters/http/controllers/entities/session-token/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var SessionTokenController = class {
+	service;
+	constructor(ctx) {
+		this.service = ctx.service;
+	}
+	async getMany(event) {
+		const actor = buildActorContext(event);
+		const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);
+		return {
+			data,
+			meta: {
+				...meta,
+				schema: describeQuerySchema(sessionTokenSchema)
+			}
+		};
+	}
+	async getOne(id, event) {
+		const actor = buildActorContext(event);
+		return {
+			data: await this.service.getOne(id, actor),
+			meta: { schema: describeQuerySchema(sessionTokenSchema, RECORD_QUERY_PARAMETERS) }
+		};
+	}
+	/**
+	* Revoke every token matching the query. Requires a target filter, so it
+	* cannot degenerate into an unscoped mass revoke.
+	*
+	* Scoped to one client this is "sign out of this application": the session
+	* itself survives, so the other applications riding it stay signed in.
+	*/ async dropMany(event) {
+		const actor = buildActorContext(event);
+		const result = await this.service.deleteMany(useRequestQuery(event), actor);
+		event.response.status = 202;
+		return result;
+	}
+	async drop(id, event) {
+		const actor = buildActorContext(event);
+		const entity = await this.service.delete(id, actor);
+		event.response.status = 202;
+		return {
+			data: entity,
+			meta: {}
+		};
+	}
+};
+_ts_decorate([
+	DGet("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "getMany", null);
+_ts_decorate([
+	DGet("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "getOne", null);
+_ts_decorate([
+	DDelete("", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "dropMany", null);
+_ts_decorate([
+	DDelete("/:id", [ForceLoggedInMiddleware]),
+	_ts_param(0, DPath("id")),
+	_ts_param(1, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [String, typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionTokenController.prototype, "drop", null);
+SessionTokenController = _ts_decorate([
+	DTags("session-token"),
+	DController(["/session-tokens"]),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof SessionTokenControllerContext === "undefined" ? Object : SessionTokenControllerContext])
+], SessionTokenController);
+//#endregion
+export { SessionTokenController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/entities/session-token/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","RECORD_QUERY_PARAMETERS","describeQuerySchema","sessionTokenSchema","ForceLoggedInMiddleware","buildActorContext","SessionTokenController","service","ctx","getMany","event","actor","data","meta","schema","getOne","id","entity","dropMany","result","deleteMany","response","status","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/session-token/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { SessionToken } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse, EntityRecordResponse } from '@authup/core-http-kit';\nimport type { ISessionTokenService, SessionTokenDeleteManyResult } from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    describeQuerySchema,\n    sessionTokenSchema,\n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type SessionTokenControllerContext = {\n    service: ISessionTokenService,\n};\n\n@DTags('session-token')\n@DController(['/session-tokens'])\nexport class SessionTokenController {\n    protected service: ISessionTokenService;\n\n    constructor(ctx: SessionTokenControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<SessionToken>> {\n        const actor = buildActorContext(event);\n        const { data, meta } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(sessionTokenSchema),\n            },\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<SessionToken>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.getOne(id, actor);\n\n        return {\n            data: entity,\n            meta: { schema: describeQuerySchema(sessionTokenSchema, RECORD_QUERY_PARAMETERS) },\n        };\n    }\n\n    /**\n     * Revoke every token matching the query. Requires a target filter, so it\n     * cannot degenerate into an unscoped mass revoke.\n     *\n     * Scoped to one client this is \"sign out of this application\": the session\n     * itself survives, so the other applications riding it stay signed in.\n     */\n    @DDelete('', [ForceLoggedInMiddleware])\n    async dropMany(\n        @DContext() event: IAppEvent,\n    ): Promise<SessionTokenDeleteManyResult> {\n        const actor = buildActorContext(event);\n        const result = await this.service.deleteMany(useRequestQuery(event), actor);\n\n        event.response.status = 202;\n        return result;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<SessionToken>> {\n        const actor = buildActorContext(event);\n        const entity = await this.service.delete(id, actor);\n\n        event.response.status = 202;\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,IAAaY,yBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAoC;EAC5C,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC+C;EAC/C,MAAME,QAAQN,kBAAkBK,KAAAA;EAChC,MAAM,EAAEE,MAAMC,SAAS,MAAM,KAAKN,QAAQE,QAAQT,gBAAgBU,KAAAA,GAAQC,KAAAA;EAE1E,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQZ,oBAAoBC,kBAAAA;GAChC;EACJ;CACJ;CAEA,MACMY,OACF,IACA,OAC2C;EAC3C,MAAMJ,QAAQN,kBAAkBK,KAAAA;EAGhC,OAAO;GACHE,MAAMK,MAHW,KAAKV,QAAQQ,OAAOC,IAAIL,KAAAA;GAIzCE,MAAM,EAAEC,QAAQZ,oBAAoBC,oBAAoBF,uBAAAA,EAAyB;EACrF;CACJ;;;;;;;IASA,MACMiB,SACF,OACqC;EACrC,MAAMP,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMS,SAAS,MAAM,KAAKZ,QAAQa,WAAWpB,gBAAgBU,KAAAA,GAAQC,KAAAA;EAErED,MAAMW,SAASC,SAAS;EACxB,OAAOH;CACX;CAEA,MACMI,KACF,IACA,OAC2C;EAC3C,MAAMZ,QAAQN,kBAAkBK,KAAAA;EAChC,MAAMO,SAAS,MAAM,KAAKV,QAAQiB,OAAOR,IAAIL,KAAAA;EAE7CD,MAAMW,SAASC,SAAS;EACxB,OAAO;GAAEV,MAAMK;GAAQJ,MAAM,CAAC;EAAE;CACpC;AACJ;;CA3DeT,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAgBIA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAqBDA,QAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAWIA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;CAxDR,YAAA,CAAA,iBAAA,CAAA"}

package/dist/adapters/http/controllers/index.mjs

@@ -11,10 +11,12 @@ import { ClientScopeRequestValidator } from "./entities/client-scope/utils/valid
 import { ConsentController } from "./entities/consent/module.mjs";
 import { EventController } from "./entities/event/module.mjs";
 import { IdentityProviderController } from "./entities/identity-provider/module.mjs";
+import { IdentityProviderAccountController } from "./entities/identity-provider-account/module.mjs";
 import { IdentityProviderRoleMappingController } from "./entities/identity-provide-role/module.mjs";
 import { KeyController } from "./entities/key/module.mjs";
 import { PermissionController } from "./entities/permission/module.mjs";
 import { PermissionPolicyController } from "./entities/permission-policy/module.mjs";
+import { AccountController } from "./workflows/account/module.mjs";
 import { ActivateController } from "./workflows/activate/module.mjs";
 import { AuthenticatorChallengeController } from "./workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./workflows/authorize/module.mjs";
@@ -40,6 +42,7 @@ import { PolicyAttributesValidator } from "./entities/policy/utils/attributes-va
 import { PolicyValidator } from "./entities/policy/utils/validation.mjs";
 import { ScopeController } from "./entities/scope/module.mjs";
 import { SessionController } from "./entities/session/module.mjs";
+import { SessionTokenController } from "./entities/session-token/module.mjs";
 import { TrustAnchorController } from "./entities/trust-anchor/module.mjs";
 import { UserController } from "./entities/user/module.mjs";
 import { UserAttributeController } from "./entities/user-attribute/module.mjs";
@@ -50,4 +53,4 @@ import { UserPermissionRequestValidator } from "./entities/user-permission/utils
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/account/index.d.ts

@@ -0,0 +1,2 @@
+export * from './module.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/adapters/http/controllers/workflows/account/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AccountController } from "./module.mjs";
+export { AccountController };

package/dist/adapters/http/controllers/workflows/account/module.d.ts

@@ -0,0 +1,24 @@
+import type { StatusResponseFeatures } from '@authup/core-http-kit';
+import type { IAppEvent } from 'routup';
+export type AccountControllerOptions = {
+    baseURL: string;
+    features: StatusResponseFeatures;
+    trustedOrigins: string[];
+};
+export type AccountControllerContext = {
+    options: AccountControllerOptions;
+};
+/**
+ * Serves the account console SPA (`@authup/client-account-console`) shell —
+ * client-side routing owns the sub-paths, so every route returns the same
+ * shell with the runtime config (apiUrl, base path, feature flags) injected.
+ * The bundle's static assets ride the assets middleware (/account/assets).
+ */
+export declare class AccountController {
+    protected options: AccountControllerOptions;
+    constructor(ctx: AccountControllerContext);
+    serve(event: IAppEvent): Promise<string>;
+    servePage(event: IAppEvent): Promise<string>;
+    protected render(event: IAppEvent): Promise<string>;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/account/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAMpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,qBACa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,wBAAwB;IAKnC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpD,SAAS,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9D,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAOtD"}

package/dist/adapters/http/controllers/workflows/account/module.mjs

@@ -0,0 +1,63 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { serveAccountConsolePage } from "../../../ui/account-console/module.mjs";
+import "../../../ui/index.mjs";
+import { DContext, DController, DGet } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/account/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var AccountController = class {
+	options;
+	constructor(ctx) {
+		this.options = ctx.options;
+	}
+	async serve(event) {
+		return this.render(event);
+	}
+	async servePage(event) {
+		return this.render(event);
+	}
+	render(event) {
+		return serveAccountConsolePage(event, {
+			baseURL: this.options.baseURL,
+			features: this.options.features,
+			trustedOrigins: this.options.trustedOrigins
+		});
+	}
+};
+_ts_decorate([
+	DGet("", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AccountController.prototype, "serve", null);
+_ts_decorate([
+	DGet("/:page", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AccountController.prototype, "servePage", null);
+AccountController = _ts_decorate([
+	DController("/account"),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof AccountControllerContext === "undefined" ? Object : AccountControllerContext])
+], AccountController);
+//#endregion
+export { AccountController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/account/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","serveAccountConsolePage","AccountController","options","ctx","serve","event","render","servePage","baseURL","features","trustedOrigins"],"sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { serveAccountConsolePage } from '../../../ui/index.ts';\n\nexport type AccountControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n    trustedOrigins: string[],\n};\n\nexport type AccountControllerContext = {\n    options: AccountControllerOptions,\n};\n\n/**\n * Serves the account console SPA (`@authup/client-account-console`) shell —\n * client-side routing owns the sub-paths, so every route returns the same\n * shell with the runtime config (apiUrl, base path, feature flags) injected.\n * The bundle's static assets ride the assets middleware (/account/assets).\n */\n@DController('/account')\nexport class AccountController {\n    protected options: AccountControllerOptions;\n\n    constructor(ctx: AccountControllerContext) {\n        this.options = ctx.options;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return this.render(event);\n    }\n\n    @DGet('/:page', [])\n    async servePage(@DContext() event: IAppEvent): Promise<string> {\n        return this.render(event);\n    }\n\n    protected render(event: IAppEvent): Promise<string> {\n        return serveAccountConsolePage(event, {\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            trustedOrigins: this.options.trustedOrigins,\n        });\n    }\n}\n"],"mappings":";;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AA4BD,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAEA,MACME,UAAU,OAA+C;EAC3D,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEUC,OAAOD,OAAmC;EAChD,OAAOL,wBAAwBK,OAAO;GAClCG,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,gBAAgB,KAAKR,QAAQQ;EACjC,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/activate/module.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { ActivateRequestValidator } from "./validator.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;IAcxC,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAsEvD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;IAcxC,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAuEvD"}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs

@@ -82,6 +82,7 @@ var AuthenticatorChallengeController = class {
 			ipAddress: getRequestIP(event) ?? null,
 			userAgent: getRequestHeader(event, "user-agent") ?? null,
 			clientId: identity.clientId,
+			sessionId: sessionId ?? null,
 			...session ? { onVerified: async () => {
 				await this.sessionManager.markMfaVerified(session);
 			} } : {}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAoBd,IAAI,CAACwC,MAjBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,KAAAA,KAAU;GAClC6B,WAAWzC,iBAAiBY,OAAO,YAAA,KAAiB;GACpD8B,UAAU7B,SAAS6B;GACnB,GAAIL,UAAU,EACVM,YAAY,YAAA;IACR,MAAM,KAAKnC,eAAeoC,gBAAgBP,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMM,OAAAA,MANL,KAAKpC,gBAAgBqC,SAAS;IAC9CT;IACAvB,QAAQA,OAAOqB;IACfY,UAAUlC,SAASW,KAAKwB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAET,UAAU,KAAK;CAC5B;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","DTags","IdentityType","UserAuthenticatorKind","BadRequestError","EntityCredentialsInvalidError","UnauthorizedError","getRequestHeader","getRequestIP","useRequestIdentity","useRequestLocale","useRequestMfaLoginTicket","useRequestSessionId","AuthenticatorChallengeController","service","sessionManager","mfaLoginService","ctx","resolveActor","event","identity","ticket","status","type","USER","required","enrollmentRequired","kinds","challenge","id","send","data","Object","values","includes","kind","sendChallenge","locale","success","verify","response","sessionId","payload","session_id","session","findOneById","verified","ipAddress","userAgent","clientId","onVerified","markMfaVerified","token","complete","userName","name"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n    DTags,\n} from '@routup/decorators';\nimport { IdentityType, UserAuthenticatorKind } from '@authup/core-kit';\nimport { BadRequestError, EntityCredentialsInvalidError, UnauthorizedError } from '@authup/errors';\nimport type { IAppEvent } from 'routup';\nimport { getRequestHeader, getRequestIP } from 'routup';\nimport type {\n    UserAuthenticatorChallengeResponse,\n    UserAuthenticatorChallengeSendPayload,\n    UserAuthenticatorChallengeVerifyPayload,\n    UserAuthenticatorChallengeVerifyResponse,\n} from '@authup/core-http-kit';\nimport type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';\nimport type { RequestIdentity, RequestMfaLoginTicket } from '../../../request/index.ts';\nimport {\n    useRequestIdentity,\n    useRequestLocale,\n    useRequestMfaLoginTicket,\n    useRequestSessionId,\n} from '../../../request/index.ts';\n\nexport type AuthenticatorChallengeControllerContext = {\n    service: IUserAuthenticatorService,\n    sessionManager: ISessionManager,\n    mfaLoginService?: IOAuth2MfaLoginService,\n};\n\ntype ChallengeActor = {\n    identity: RequestIdentity,\n    ticket: RequestMfaLoginTicket | null,\n};\n\n/**\n * Login-time challenge surface, scoped to the CURRENT bearer identity.\n * GET reports whether (and how) the caller must present a second factor;\n * POST verifies a factor and stamps mfa_at onto the backing session so\n * the /authorize backstop passes.\n *\n * Besides a regular access bearer, these routes accept the \"MFA-pending\"\n * login ticket (kind: mfa_token, issue #3242) the password grant issues\n * for factor kinds that cannot ride the single grant POST (email /\n * WebAuthn). A ticket-authenticated verify additionally completes the\n * login: the response carries the full token grant for the now-MFA'd\n * pending session.\n */\n@DTags('userAuthenticator')\n@DController('/authenticators/challenge')\nexport class AuthenticatorChallengeController {\n    protected service: IUserAuthenticatorService;\n\n    protected sessionManager: ISessionManager;\n\n    protected mfaLoginService?: IOAuth2MfaLoginService;\n\n    constructor(ctx: AuthenticatorChallengeControllerContext) {\n        this.service = ctx.service;\n        this.sessionManager = ctx.sessionManager;\n        this.mfaLoginService = ctx.mfaLoginService;\n    }\n\n    /**\n     * Resolve the acting subject: the regular request identity (access\n     * bearer — the middleware never sets it for a ticket) or the stashed\n     * MFA-pending ticket. Anything else is unauthorized — the previous\n     * ForceLoggedInMiddleware contract, widened by exactly one bearer kind.\n     */\n    protected resolveActor(event: IAppEvent) : ChallengeActor {\n        const identity = useRequestIdentity(event);\n        if (identity) {\n            return { identity, ticket: null };\n        }\n\n        const ticket = useRequestMfaLoginTicket(event);\n        if (ticket) {\n            return { identity: ticket.identity, ticket };\n        }\n\n        throw new UnauthorizedError();\n    }\n\n    @DGet('')\n    async status(\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeResponse> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            return {\n                required: false,\n                enrollmentRequired: false,\n                kinds: [],\n            };\n        }\n\n        return this.service.challenge(identity.id);\n    }\n\n    @DPost('/send')\n    async send(\n        @DBody() data: UserAuthenticatorChallengeSendPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<{ success: true }> {\n        const { identity } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can request a challenge.');\n        }\n\n        if (\n            !data ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind must be provided.');\n        }\n\n        await this.service.sendChallenge(identity.id, data.kind, { locale: useRequestLocale(event) });\n\n        // uniform 200 regardless of whether a code was actually mailed —\n        // no enrollment-status oracle for the caller.\n        return { success: true };\n    }\n\n    @DPost('')\n    async verify(\n        @DBody() data: UserAuthenticatorChallengeVerifyPayload,\n        @DContext() event: IAppEvent,\n    ): Promise<UserAuthenticatorChallengeVerifyResponse> {\n        const { identity, ticket } = this.resolveActor(event);\n        if (identity.type !== IdentityType.USER) {\n            throw new BadRequestError('Only user identities can complete a challenge.');\n        }\n\n        if (\n            !data ||\n            typeof data.response !== 'string' ||\n            !data.response ||\n            !Object.values(UserAuthenticatorKind).includes(data.kind as UserAuthenticatorKind)\n        ) {\n            throw new BadRequestError('A kind and response must be provided.');\n        }\n\n        // Bind the proof to the backing session — the /authorize backstop\n        // reads session.mfa_at. The session id is server-derived (stashed\n        // by the authorization middleware / carried by the verified ticket),\n        // never client input. The stamp runs INSIDE the verify unit of work\n        // (before the code consumption persists), so a stamp failure never\n        // burns a single-use code.\n        const sessionId = ticket ?\n            ticket.payload.session_id :\n            useRequestSessionId(event);\n        const session = sessionId ?\n            await this.sessionManager.findOneById(sessionId) :\n            null;\n\n        // a ticket references exactly one pending session — without it\n        // (swept / expired mid-flight) the login can not complete.\n        if (ticket && !session) {\n            throw new UnauthorizedError();\n        }\n\n        const verified = await this.service.verify(\n            identity.id,\n            {\n                kind: data.kind,\n                response: data.response,\n            },\n            {\n                ipAddress: getRequestIP(event) ?? null,\n                userAgent: getRequestHeader(event, 'user-agent') ?? null,\n                clientId: identity.clientId,\n                sessionId: sessionId ?? null,\n                ...(session ? {\n                    onVerified: async () => {\n                        await this.sessionManager.markMfaVerified(session);\n                    },\n                } : {}),\n            },\n        );\n        if (!verified) {\n            throw new EntityCredentialsInvalidError();\n        }\n\n        // Ticket flow: the factor is verified and mfa_at stamped — complete\n        // the login by minting the full grant for the pending session and\n        // consuming the ticket (single use).\n        if (ticket && session && this.mfaLoginService) {\n            const token = await this.mfaLoginService.complete({\n                session,\n                ticket: ticket.payload,\n                userName: identity.data.name,\n            });\n\n            return { verified: true, token };\n        }\n\n        return { verified: true };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAaiB,mCAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8C;EACtD,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,kBAAkBC,IAAID;CAC/B;;;;;;IAQA,aAAuBG,OAAmC;EACtD,MAAMC,WAAWX,mBAAmBU,KAAAA;EACpC,IAAIC,UACA,OAAO;GAAEA;GAAUC,QAAQ;EAAK;EAGpC,MAAMA,SAASV,yBAAyBQ,KAAAA;EACxC,IAAIE,QACA,OAAO;GAAED,UAAUC,OAAOD;GAAUC;EAAO;EAG/C,MAAM,IAAIf,kBAAAA;CACd;CAEA,MACMgB,OACF,OAC2C;EAC3C,MAAM,EAAEF,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,OAAO;GACHC,UAAU;GACVC,oBAAoB;GACpBC,OAAO,CAAA;EACX;EAGJ,OAAO,KAAKb,QAAQc,UAAUR,SAASS,EAAE;CAC7C;CAEA,MACMC,KACF,MACA,OAC0B;EAC1B,MAAM,EAAEV,aAAa,KAAKF,aAAaC,KAAAA;EACvC,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,+CAAA;EAG9B,IACI,CAAC2B,QACD,CAACC,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,0BAAA;EAG9B,MAAM,KAAKU,QAAQsB,cAAchB,SAASS,IAAIE,KAAKI,MAAM,EAAEE,QAAQ3B,iBAAiBS,KAAAA,EAAO,CAAA;EAI3F,OAAO,EAAEmB,SAAS,KAAK;CAC3B;CAEA,MACMC,OACF,MACA,OACiD;EACjD,MAAM,EAAEnB,UAAUC,WAAW,KAAKH,aAAaC,KAAAA;EAC/C,IAAIC,SAASG,SAASrB,aAAasB,MAC/B,MAAM,IAAIpB,gBAAgB,gDAAA;EAG9B,IACI,CAAC2B,QACD,OAAOA,KAAKS,aAAa,YACzB,CAACT,KAAKS,YACN,CAACR,OAAOC,OAAO9B,qBAAAA,CAAAA,CAAuB+B,SAASH,KAAKI,IAAI,GAExD,MAAM,IAAI/B,gBAAgB,uCAAA;EAS9B,MAAMqC,YAAYpB,SACdA,OAAOqB,QAAQC,aACf/B,oBAAoBO,KAAAA;EACxB,MAAMyB,UAAUH,YACZ,MAAM,KAAK1B,eAAe8B,YAAYJ,SAAAA,IACtC;EAIJ,IAAIpB,UAAU,CAACuB,SACX,MAAM,IAAItC,kBAAAA;EAqBd,IAAI,CAACwC,MAlBkB,KAAKhC,QAAQyB,OAChCnB,SAASS,IACT;GACIM,MAAMJ,KAAKI;GACXK,UAAUT,KAAKS;EACnB,GACA;GACIO,WAAWvC,aAAaW,KAAAA,KAAU;GAClC6B,WAAWzC,iBAAiBY,OAAO,YAAA,KAAiB;GACpD8B,UAAU7B,SAAS6B;GACnBR,WAAWA,aAAa;GACxB,GAAIG,UAAU,EACVM,YAAY,YAAA;IACR,MAAM,KAAKnC,eAAeoC,gBAAgBP,OAAAA;GAC9C,EACJ,IAAI,CAAC;EACT,CAAA,GAGA,MAAM,IAAIvC,8BAAAA;EAMd,IAAIgB,UAAUuB,WAAW,KAAK5B,iBAO1B,OAAO;GAAE8B,UAAU;GAAMM,OAAAA,MANL,KAAKpC,gBAAgBqC,SAAS;IAC9CT;IACAvB,QAAQA,OAAOqB;IACfY,UAAUlC,SAASW,KAAKwB;GAC5B,CAAA;EAE+B;EAGnC,OAAO,EAAET,UAAU,KAAK;CAC5B;AACJ"}

package/dist/adapters/http/controllers/workflows/authorize/module.mjs

@@ -6,10 +6,10 @@ import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
 import { ForceUserLoggedInMiddleware } from "../../../middleware/built-in/loggedin/user.mjs";
+import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
 import { sanitizeError } from "../../../../../utils/error.mjs";
 import "../../../../../utils/index.mjs";
 import "../../../middleware/index.mjs";
-import { renderUIPage } from "../../../ui/render.mjs";
 import "../../../ui/index.mjs";
 import { HTTPOAuth2Authorizer } from "../../../adapters/oauth2/authorization/module.mjs";
 import "../../../adapters/index.mjs";
@@ -115,7 +115,7 @@ var AuthorizeController = class {
 			}
 		}
 		const requestURL = new URL(event.request.url);
-		return renderUIPage(event, {
+		return renderAuthConsolePage(event, {
 			url: "/authorize",
 			payload: {
 				config: { baseURL: this.options.baseURL },