@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/adapters/http/controllers/workflows/authorize/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderUIPage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'displayName' | 'builtIn' | 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with error=access_denied on a policy denial)\n        // is mapped onto the hydration payload's error — neutral message,\n        // never attacker-controlled text.\n        if (!error) {\n            const query = useRequestQuery(event);\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX,OACa7C;OAAAA,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,aAAaqB,OAAO;GACvBG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;CAlIgB/D,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","useRequestQuery","OAuth2AccessDeniedError","OAuth2ErrorCode","isOAuth2AccessDeniedError","ForceUserLoggedInMiddleware","HTTPOAuth2Authorizer","renderAuthConsolePage","readFromLocations","OAuth2AuthorizationCodeRequestValidator","sanitizeError","AuthorizeController","options","codeRequestVerifier","codeRequestValidator","authorizer","ctx","codeIssuer","sessionManager","eventService","metrics","promptLoginMaxAge","mfaFreshnessMaxAge","mfaChallengeProvider","accessPolicyEvaluator","consentService","logger","confirm","event","result","authorizeWithRequest","url","redirectUri","state","searchParams","set","authorizationCode","href","e","ACCESS_DENIED","serve","codeRequest","client","scopes","realm","redirectUriVerified","error","merged","data","run","verify","id","name","displayName","builtIn","createdAt","normalized","message","query","forClient","requestURL","request","payload","config","baseURL","features","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/authorize/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\n\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type {\n    Client,\n    OAuth2AuthorizationCodeRequest,\n    Realm,\n    Scope,\n} from '@authup/core-kit';\nimport { OAuth2AccessDeniedError, OAuth2ErrorCode, isOAuth2AccessDeniedError } from '@authup/specs';\nimport { ForceUserLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { HTTPOAuth2Authorizer } from '../../../adapters/index.ts';\nimport { renderAuthConsolePage } from '../../../ui/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport type { IOAuth2AuthorizationCodeRequestVerifier } from '../../../../../core/index.ts';\nimport { OAuth2AuthorizationCodeRequestValidator } from '../../../../../core/index.ts';\nimport type { AuthorizeControllerContext, AuthorizeControllerOptions } from './types.ts';\nimport { sanitizeError } from '../../../../../utils/index.ts';\n\ntype RealmSummary = Pick<Realm, 'id' | 'name' | 'displayName'>;\ntype ClientSummary = Pick<Client, 'id' | 'name' | 'displayName' | 'builtIn' | 'createdAt'>;\n\n@DController('/authorize')\nexport class AuthorizeController {\n    // todo: maybe /realms/<realm>/protocol/openid-connect/authorize\n    // todo: maybe /realms/<realm>/[...]/authorize\n\n    protected options: AuthorizeControllerOptions;\n\n    protected codeRequestVerifier : IOAuth2AuthorizationCodeRequestVerifier;\n\n    protected codeRequestValidator : OAuth2AuthorizationCodeRequestValidator;\n\n    protected authorizer: HTTPOAuth2Authorizer;\n\n    // ---------------------------------------------------------\n\n    constructor(ctx: AuthorizeControllerContext) {\n        this.options = ctx.options;\n\n        this.codeRequestVerifier = ctx.codeRequestVerifier;\n\n        this.codeRequestValidator = new OAuth2AuthorizationCodeRequestValidator();\n\n        this.authorizer = new HTTPOAuth2Authorizer({\n            codeRequestVerifier: this.codeRequestVerifier,\n            codeIssuer: ctx.codeIssuer,\n            sessionManager: ctx.sessionManager,\n            eventService: ctx.eventService,\n            metrics: ctx.metrics,\n            promptLoginMaxAge: ctx.options.promptLoginMaxAge,\n            mfaFreshnessMaxAge: ctx.options.mfaFreshnessMaxAge,\n            mfaChallengeProvider: ctx.mfaChallengeProvider,\n            accessPolicyEvaluator: ctx.accessPolicyEvaluator,\n            consentService: ctx.consentService,\n            logger: ctx.logger,\n        });\n    }\n\n    // ---------------------------------------------------------\n\n    @DPost('', [ForceUserLoggedInMiddleware])\n    async confirm(@DContext() event: IAppEvent): Promise<{ url: string }> {\n        try {\n            const result = await this.authorizer.authorizeWithRequest(event);\n\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            if (result.authorizationCode) {\n                url.searchParams.set('code', result.authorizationCode);\n            }\n\n            return { url: url.href };\n        } catch (e) {\n            // Access-policy denial (plan 052): with a pattern-verified\n            // redirect_uri the denial is answered as an error redirect\n            // (RFC 6749 §4.1.2.1) — the kit navigates the returned url like\n            // any success. Unverified → rethrow → 400 body → interactive\n            // denial card.\n            if (isOAuth2AccessDeniedError(e) && e.redirectUri) {\n                const url = new URL(e.redirectUri);\n                url.searchParams.set('error', OAuth2ErrorCode.ACCESS_DENIED);\n                if (e.state) {\n                    url.searchParams.set('state', e.state);\n                }\n\n                return { url: url.href };\n            }\n\n            throw e;\n        }\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        let codeRequest : OAuth2AuthorizationCodeRequest | undefined;\n\n        let client : ClientSummary | undefined;\n        let scopes : Scope[] | undefined;\n\n        // Target realm summary (the client's realm) — the UI names it in the\n        // realm-mismatch notice. codeRequest.realm_id is only the id.\n        let realm : RealmSummary | undefined;\n\n        // Whether the request redirect_uri matched a registered client pattern —\n        // the UI must not offer an automatic \"return to application\" redirect to\n        // an unverified (pattern-less-client) redirect_uri.\n        let redirectUriVerified = false;\n\n        let error : Error | undefined;\n\n        try {\n            const merged = await readFromLocations(event, ['body', 'query']);\n            const data = await this.codeRequestValidator.run(merged);\n\n            const result = await this.codeRequestVerifier.verify(data);\n\n            // Trim the client to a deliberate DTO before it reaches the\n            // anonymous SSR hydration payload — never disclose redirect_uri\n            // patterns (the trusted-origin set), grant_types, internal\n            // base/root URLs, auth methods, or the secret storage flags to an\n            // unauthenticated visitor. (ClientEntity.secret is additionally\n            // select:false, so the secret is never loaded — but the DTO must not\n            // rely on that alone: a future entity/query change could unset it.)\n            client = {\n                id: result.client.id,\n                name: result.client.name,\n                displayName: result.client.displayName,\n                builtIn: result.client.builtIn,\n                createdAt: result.client.createdAt,\n            };\n            scopes = result.scopes;\n            redirectUriVerified = result.redirectUriVerified;\n\n            if (result.client.realm) {\n                realm = {\n                    id: result.client.realm.id,\n                    name: result.client.realm.name,\n                    displayName: result.client.realm.displayName,\n                };\n            }\n\n            codeRequest = result.data;\n        } catch (e) {\n            const normalized = sanitizeError(e);\n            error = {\n                ...normalized,\n                message: normalized.message,\n            };\n        }\n\n        // A recognized `error` query param (the federated-IdP callback\n        // redirects back here with error=access_denied on a policy denial)\n        // is mapped onto the hydration payload's error — neutral message,\n        // never attacker-controlled text.\n        if (!error) {\n            const query = useRequestQuery(event);\n            if (query.error === OAuth2ErrorCode.ACCESS_DENIED) {\n                const normalized = sanitizeError(OAuth2AccessDeniedError.forClient());\n                error = {\n                    ...normalized,\n                    message: normalized.message,\n                };\n            }\n        }\n\n        // Path + query of the original request — the SSR page uses it as\n        // the same-origin `redirect` parameter on register / password links\n        // so those pages can lead back into this authorize request.\n        const requestURL = new URL(event.request.url);\n\n        return renderAuthConsolePage(event, {\n            url: '/authorize',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    codeRequest,\n                    error,\n                    client,\n                    scopes,\n                    realm,\n                    redirectUriVerified,\n                    features: this.options.features,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAae,sBAAb,MAAaA;CAICC;CAEAC;CAEAC;CAEAC;CAIV,YAAYC,KAAiC;EACzC,KAAKJ,UAAUI,IAAIJ;EAEnB,KAAKC,sBAAsBG,IAAIH;EAE/B,KAAKC,uBAAuB,IAAIL,wCAAAA;EAEhC,KAAKM,aAAa,IAAIT,qBAAqB;GACvCO,qBAAqB,KAAKA;GAC1BI,YAAYD,IAAIC;GAChBC,gBAAgBF,IAAIE;GACpBC,cAAcH,IAAIG;GAClBC,SAASJ,IAAII;GACbC,mBAAmBL,IAAIJ,QAAQS;GAC/BC,oBAAoBN,IAAIJ,QAAQU;GAChCC,sBAAsBP,IAAIO;GAC1BC,uBAAuBR,IAAIQ;GAC3BC,gBAAgBT,IAAIS;GACpBC,QAAQV,IAAIU;EAChB,CAAA;CACJ;CAIA,MACMC,QAAQ,OAAwD;EAClE,IAAI;GACA,MAAME,SAAS,MAAM,KAAKd,WAAWe,qBAAqBF,KAAAA;GAE1D,MAAMG,MAAM,IAAI/B,IAAI6B,OAAOG,WAAW;GACtC,IAAIH,OAAOI,OACPF,IAAIG,aAAaC,IAAI,SAASN,OAAOI,KAAK;GAG9C,IAAIJ,OAAOO,mBACPL,IAAIG,aAAaC,IAAI,QAAQN,OAAOO,iBAAiB;GAGzD,OAAO,EAAEL,KAAKA,IAAIM,KAAK;EAC3B,SAASC,GAAG;GAMR,IAAIlC,0BAA0BkC,CAAAA,KAAMA,EAAEN,aAAa;IAC/C,MAAMD,MAAM,IAAI/B,IAAIsC,EAAEN,WAAW;IACjCD,IAAIG,aAAaC,IAAI,SAAShC,gBAAgBoC,aAAa;IAC3D,IAAID,EAAEL,OACFF,IAAIG,aAAaC,IAAI,SAASG,EAAEL,KAAK;IAGzC,OAAO,EAAEF,KAAKA,IAAIM,KAAK;GAC3B;GAEA,MAAMC;EACV;CACJ;CAEA,MACME,MAAM,OAA+C;EACvD,IAAIC;EAEJ,IAAIC;EACJ,IAAIC;EAIJ,IAAIC;EAKJ,IAAIC,sBAAsB;EAE1B,IAAIC;EAEJ,IAAI;GACA,MAAMC,SAAS,MAAMvC,kBAAkBoB,OAAO,CAAC,QAAQ,OAAQ,CAAA;GAC/D,MAAMoB,OAAO,MAAM,KAAKlC,qBAAqBmC,IAAIF,MAAAA;GAEjD,MAAMlB,SAAS,MAAM,KAAKhB,oBAAoBqC,OAAOF,IAAAA;GASrDN,SAAS;IACLS,IAAItB,OAAOa,OAAOS;IAClBC,MAAMvB,OAAOa,OAAOU;IACpBC,aAAaxB,OAAOa,OAAOW;IAC3BC,SAASzB,OAAOa,OAAOY;IACvBC,WAAW1B,OAAOa,OAAOa;GAC7B;GACAZ,SAASd,OAAOc;GAChBE,sBAAsBhB,OAAOgB;GAE7B,IAAIhB,OAAOa,OAAOE,OACdA,QAAQ;IACJO,IAAItB,OAAOa,OAAOE,MAAMO;IACxBC,MAAMvB,OAAOa,OAAOE,MAAMQ;IAC1BC,aAAaxB,OAAOa,OAAOE,MAAMS;GACrC;GAGJZ,cAAcZ,OAAOmB;EACzB,SAASV,GAAG;GACR,MAAMkB,aAAa9C,cAAc4B,CAAAA;GACjCQ,QAAQ;IACJ,GAAGU;IACHC,SAASD,WAAWC;GACxB;EACJ;EAMA,IAAI,CAACX,OACa7C;OAAAA,gBAAgB2B,KAC1B8B,CAAAA,CAAMZ,UAAU3C,gBAAgBoC,eAAe;IAC/C,MAAMiB,aAAa9C,cAAcR,wBAAwByD,UAAS,CAAA;IAClEb,QAAQ;KACJ,GAAGU;KACHC,SAASD,WAAWC;IACxB;GACJ;;EAMJ,MAAMG,aAAa,IAAI5D,IAAI4B,MAAMiC,QAAQ9B,GAAG;EAE5C,OAAOxB,sBAAsBqB,OAAO;GAChCG,KAAK;GACL+B,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAKpD,QAAQoD,QAAQ;IACxChB,MAAM;KACFP;KACAK;KACAJ;KACAC;KACAC;KACAC;KACAoB,UAAU,KAAKrD,QAAQqD;KACvBC,aAAa,GAAGN,WAAWO,WAAWP,WAAWQ;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ;;CAlIgB/D,MAAAA,IAAAA,CAAAA,2BAAAA,CAAAA"}

package/dist/adapters/http/controllers/workflows/index.d.ts

@@ -1,3 +1,4 @@
+export * from './account/index.ts';
 export * from './activate/index.ts';
 export * from './authenticator-challenge/index.ts';
 export * from './authorize/index.ts';

package/dist/adapters/http/controllers/workflows/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/adapters/http/controllers/workflows/index.mjs

@@ -1,6 +1,8 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { AccountController } from "./account/module.mjs";
+import "./account/index.mjs";
 import { ActivateController } from "./activate/module.mjs";
 import "./activate/index.mjs";
 import { AuthenticatorChallengeController } from "./authenticator-challenge/module.mjs";
@@ -26,4 +28,4 @@ import { TokenController } from "./token/module.mjs";
 import "./token/index.mjs";
 import { UserInfoController } from "./userinfo/module.mjs";
 import "./userinfo/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, JwkController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, RegisterController, StatusController, TokenController, UserInfoController, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/logout/module.mjs

@@ -5,7 +5,7 @@ import { OAuth2EndSessionRequestValidator } from "../../../../../core/oauth2/end
 import "../../../../../core/index.mjs";
 import { readFromLocations } from "../../../request/helpers/locations.mjs";
 import "../../../request/index.mjs";
-import { renderUIPage } from "../../../ui/render.mjs";
+import { renderAuthConsolePage } from "../../../ui/auth-console/module.mjs";
 import "../../../ui/index.mjs";
 import { URL } from "node:url";
 import { sendRedirect } from "routup";
@@ -63,7 +63,7 @@ var LogoutController = class {
 		}
 		if (serverRevoked && redirect) return sendRedirect(event, redirect);
 		const requestURL = new URL(event.request.url);
-		return renderUIPage(event, {
+		return renderAuthConsolePage(event, {
 			url: "/logout",
 			payload: {
 				config: { baseURL: this.options.baseURL },

package/dist/adapters/http/controllers/workflows/logout/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderUIPage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","id_token_hint","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderUIPage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error, nor discard a valid\n        // id_token_hint: a bad *cosmetic* param (post_logout_redirect_uri /\n        // state / client_id / realm hint) must NOT cancel the\n        // security-critical revoke the hint authorizes. So on a full-request\n        // validation failure, retry with the hint ALONE — the revoke needs\n        // nothing else: its subject/session come from the verified hint's\n        // claims, and client resolution degrades gracefully (the service\n        // falls back to the hint's sole `aud`, scoped by the hint's own realm\n        // claim — the dropped request params only affected the confirm page's\n        // client name and the redirect, which is dropped anyway). Only a\n        // malformed hint itself falls through to the parameter-less confirm\n        // page.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            try {\n                data = await this.validator.run({ id_token_hint: merged.id_token_hint });\n            } catch {\n                data = {};\n            }\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderUIPage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAe/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJ,IAAI;IACAC,OAAO,MAAM,KAAKP,UAAUQ,IAAI,EAAEC,eAAeH,OAAOG,cAAc,CAAA;GAC1E,QAAQ;IACJF,OAAO,CAAC;GACZ;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKX,kBAAkBY,OAAOJ,IAAAA;EAMnD,IAAIK,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKb,kBAAkBkB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI5B,IAAIkB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOzB,aAAaU,OAAOe,QAAAA;EAG/B,MAAMO,aAAa,IAAIjC,IAAIW,MAAMuB,QAAQN,GAAG;EAE5C,OAAOxB,aAAaO,OAAO;GACvBiB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK/B,QAAQ+B,QAAQ;IACxCtB,MAAM;KACFuB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DPost","URL","sendRedirect","OAuth2EndSessionRequestValidator","readFromLocations","renderAuthConsolePage","LogoutController","options","endSessionService","validator","ctx","serve","event","handle","execute","merged","data","run","id_token_hint","result","verify","serverRevoked","hintVerified","sessionId","sub","subKind","revoke","redirect","redirectUri","url","state","searchParams","set","href","requestURL","request","payload","config","baseURL","client","clientName","name","undefined","hintSub","hintSubKind","requestPath","pathname","search"],"sources":["../../../../../../src/adapters/http/controllers/workflows/logout/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport { URL } from 'node:url';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\nimport type { IOAuth2EndSessionService, OAuth2EndSessionRequest } from '../../../../../core/index.ts';\nimport { OAuth2EndSessionRequestValidator } from '../../../../../core/index.ts';\nimport { readFromLocations } from '../../../request/index.ts';\nimport { renderAuthConsolePage } from '../../../ui/index.ts';\nimport type { LogoutControllerContext, LogoutControllerOptions } from './types.ts';\n\n@DController('/logout')\nexport class LogoutController {\n    protected options: LogoutControllerOptions;\n\n    protected endSessionService: IOAuth2EndSessionService;\n\n    protected validator: OAuth2EndSessionRequestValidator;\n\n    constructor(ctx: LogoutControllerContext) {\n        this.options = ctx.options;\n        this.endSessionService = ctx.endSessionService;\n        this.validator = new OAuth2EndSessionRequestValidator();\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    // OIDC RP-Initiated Logout allows form_post on the same endpoint.\n    @DPost('', [])\n    async execute(@DContext() event: IAppEvent): Promise<string | Response> {\n        return this.handle(event);\n    }\n\n    protected async handle(event: IAppEvent): Promise<string | Response> {\n        const merged = await readFromLocations(event, ['body', 'query']);\n\n        // Malformed input (oversized / duplicated params) must never dead-end\n        // the human behind the browser on a JSON error, nor discard a valid\n        // id_token_hint: a bad *cosmetic* param (post_logout_redirect_uri /\n        // state / client_id / realm hint) must NOT cancel the\n        // security-critical revoke the hint authorizes. So on a full-request\n        // validation failure, retry with the hint ALONE — the revoke needs\n        // nothing else: its subject/session come from the verified hint's\n        // claims, and client resolution degrades gracefully (the service\n        // falls back to the hint's sole `aud`, scoped by the hint's own realm\n        // claim — the dropped request params only affected the confirm page's\n        // client name and the redirect, which is dropped anyway). Only a\n        // malformed hint itself falls through to the parameter-less confirm\n        // page.\n        let data: OAuth2EndSessionRequest;\n        try {\n            data = await this.validator.run(merged);\n        } catch {\n            try {\n                data = await this.validator.run({ id_token_hint: merged.id_token_hint });\n            } catch {\n                data = {};\n            }\n        }\n\n        const result = await this.endSessionService.verify(data);\n\n        // A signature-verified id_token_hint proves possession — revoke the\n        // referenced session server-side immediately (only if it belongs to the\n        // hint's subject). Without a hint we mutate nothing; the SSR page's\n        // sign-out is a click-gated, bearer-authenticated action.\n        let serverRevoked = false;\n        if (result.hintVerified && result.sessionId && result.sub && result.subKind) {\n            serverRevoked = await this.endSessionService.revoke(\n                result.sessionId,\n                result.sub,\n                result.subKind,\n            );\n        }\n\n        // Build the validated post-logout redirect (the open-redirect guard\n        // lives in the service; `state` rides only alongside a validated uri).\n        let redirect: string | undefined;\n        if (result.redirectUri) {\n            const url = new URL(result.redirectUri);\n            if (result.state) {\n                url.searchParams.set('state', result.state);\n            }\n\n            redirect = url.href;\n        }\n\n        // Bounce straight back to the RP ONLY when the logout was actually\n        // performed server-side (a verified hint revoked the session). A\n        // hint-less or forged request MUST NOT silently redirect without ending\n        // the session — otherwise the RP treats a no-op round-trip as a\n        // successful logout while the authup session survives. Instead render\n        // the click-gated confirm page, which performs the bearer-authenticated\n        // sign-out and then redirects.\n        if (serverRevoked && redirect) {\n            return sendRedirect(event, redirect);\n        }\n\n        const requestURL = new URL(event.request.url);\n\n        return renderAuthConsolePage(event, {\n            url: '/logout',\n            payload: {\n                config: { baseURL: this.options.baseURL },\n                data: {\n                    client: result.clientName ? { name: result.clientName } : undefined,\n                    hintVerified: result.hintVerified,\n                    // never reflect an unverified hint's claims\n                    hintSub: result.hintVerified ? result.sub : undefined,\n                    hintSubKind: result.hintVerified ? result.subKind : undefined,\n                    serverRevoked,\n                    // the (already validated) uri to return to after a click-gated\n                    // sign-out; carries `state` when present\n                    redirect,\n                    requestPath: `${requestURL.pathname}${requestURL.search}`,\n                },\n            },\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAaS,mBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAA8B;EACtC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,oBAAoBE,IAAIF;EAC7B,KAAKC,YAAY,IAAIN,iCAAAA;CACzB;CAEA,MACMQ,MAAM,OAA0D;EAClE,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAGA,MACME,QAAQ,OAA0D;EACpE,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEA,MAAgBC,OAAOD,OAA8C;EACjE,MAAMG,SAAS,MAAMX,kBAAkBQ,OAAO,CAAC,QAAQ,OAAQ,CAAA;EAe/D,IAAII;EACJ,IAAI;GACAA,OAAO,MAAM,KAAKP,UAAUQ,IAAIF,MAAAA;EACpC,QAAQ;GACJ,IAAI;IACAC,OAAO,MAAM,KAAKP,UAAUQ,IAAI,EAAEC,eAAeH,OAAOG,cAAc,CAAA;GAC1E,QAAQ;IACJF,OAAO,CAAC;GACZ;EACJ;EAEA,MAAMG,SAAS,MAAM,KAAKX,kBAAkBY,OAAOJ,IAAAA;EAMnD,IAAIK,gBAAgB;EACpB,IAAIF,OAAOG,gBAAgBH,OAAOI,aAAaJ,OAAOK,OAAOL,OAAOM,SAChEJ,gBAAgB,MAAM,KAAKb,kBAAkBkB,OACzCP,OAAOI,WACPJ,OAAOK,KACPL,OAAOM,OAAO;EAMtB,IAAIE;EACJ,IAAIR,OAAOS,aAAa;GACpB,MAAMC,MAAM,IAAI5B,IAAIkB,OAAOS,WAAW;GACtC,IAAIT,OAAOW,OACPD,IAAIE,aAAaC,IAAI,SAASb,OAAOW,KAAK;GAG9CH,WAAWE,IAAII;EACnB;EASA,IAAIZ,iBAAiBM,UACjB,OAAOzB,aAAaU,OAAOe,QAAAA;EAG/B,MAAMO,aAAa,IAAIjC,IAAIW,MAAMuB,QAAQN,GAAG;EAE5C,OAAOxB,sBAAsBO,OAAO;GAChCiB,KAAK;GACLO,SAAS;IACLC,QAAQ,EAAEC,SAAS,KAAK/B,QAAQ+B,QAAQ;IACxCtB,MAAM;KACFuB,QAAQpB,OAAOqB,aAAa,EAAEC,MAAMtB,OAAOqB,WAAW,IAAIE,KAAAA;KAC1DpB,cAAcH,OAAOG;KAErBqB,SAASxB,OAAOG,eAAeH,OAAOK,MAAMkB,KAAAA;KAC5CE,aAAazB,OAAOG,eAAeH,OAAOM,UAAUiB,KAAAA;KACpDrB;KAGAM;KACAkB,aAAa,GAAGX,WAAWY,WAAWZ,WAAWa;IACrD;GACJ;EACJ,CAAA;CACJ;AACJ"}

package/dist/adapters/http/controllers/workflows/password-forgot/module.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { useRequestLocale } from "../../../request/helpers/locale.mjs";
 import "../../../request/index.mjs";
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/password-forgot/module.ts

package/dist/adapters/http/controllers/workflows/password-reset/module.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/password-reset/module.ts

package/dist/adapters/http/controllers/workflows/register/module.mjs

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { useRequestLocale } from "../../../request/helpers/locale.mjs";
 import "../../../request/index.mjs";
-import { serveWorkflowPage } from "../../../ui/serve.mjs";
+import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
 import "../../../ui/index.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/register/module.ts

package/dist/adapters/http/controllers/workflows/userinfo/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAIjE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,qBAEa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;gBAEpB,GAAG,EAAE,yBAAyB;IAKpC,GAAG,CACO,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CAanB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAIjE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF;;;;;GAKG;AACH,qBAEa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;gBAEpB,GAAG,EAAE,yBAAyB;IAKpC,GAAG,CACO,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CAwBnB"}

package/dist/adapters/http/controllers/workflows/userinfo/module.mjs

@@ -31,7 +31,11 @@ var UserInfoController = class {
 		const actor = buildActorContext(event);
 		let id = "@me";
 		if (actor.identity && actor.identity.type === "user") id = actor.identity.data.id;
-		return this.service.getOne(id, actor, useRequestQuery(event));
+		const query = useRequestQuery(event);
+		return this.service.getOne(id, actor, {
+			...query,
+			fields: query.fields || "+email"
+		});
 	}
 };
 _ts_decorate([

package/dist/adapters/http/controllers/workflows/userinfo/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserInfoController","service","ctx","get","event","actor","id","identity","type","data","getOne"],"sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { User } from '@authup/core-kit';\nimport type { IUserService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type UserInfoControllerContext = {\n    service: IUserService,\n};\n\n/**\n * The OIDC userinfo endpoint (advertised via discovery). It serves the\n * authenticated user's own record as a FLAT claims document — it must\n * never adopt the `{ data, meta }` entity-record envelope, which is why\n * it is a dedicated route instead of an alias of `GET /users/@me`.\n */\n@DTags('auth')\n@DController('/userinfo')\nexport class UserInfoController {\n    protected service: IUserService;\n\n    constructor(ctx: UserInfoControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async get(\n        @DContext() event: IAppEvent,\n    ): Promise<User> {\n        const actor = buildActorContext(event);\n\n        let id = '@me';\n        if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            id = actor.identity.data.id;\n        }\n\n        return this.service.getOne(id, actor, useRequestQuery(event));\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAaO,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,IACF,OACa;EACb,MAAME,QAAQN,kBAAkBK,KAAAA;EAEhC,IAAIE,KAAK;EACT,IACID,MAAME,YACNF,MAAME,SAASC,SAAS,QAExBF,KAAKD,MAAME,SAASE,KAAKH;EAG7B,OAAO,KAAKL,QAAQS,OAAOJ,IAAID,OAAOR,gBAAgBO,KAAAA,CAAAA;CAC1D;AACJ;;CAhBeN,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","DTags","useRequestQuery","ForceLoggedInMiddleware","buildActorContext","UserInfoController","service","ctx","get","event","actor","id","identity","type","data","query","getOne","fields"],"sources":["../../../../../../src/adapters/http/controllers/workflows/userinfo/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DGet,\n    DTags,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { User } from '@authup/core-kit';\nimport type { IUserService } from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext } from '../../../request/index.ts';\n\nexport type UserInfoControllerContext = {\n    service: IUserService,\n};\n\n/**\n * The OIDC userinfo endpoint (advertised via discovery). It serves the\n * authenticated user's own record as a FLAT claims document — it must\n * never adopt the `{ data, meta }` entity-record envelope, which is why\n * it is a dedicated route instead of an alias of `GET /users/@me`.\n */\n@DTags('auth')\n@DController('/userinfo')\nexport class UserInfoController {\n    protected service: IUserService;\n\n    constructor(ctx: UserInfoControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async get(\n        @DContext() event: IAppEvent,\n    ): Promise<User> {\n        const actor = buildActorContext(event);\n\n        let id = '@me';\n        if (\n            actor.identity &&\n            actor.identity.type === 'user'\n        ) {\n            id = actor.identity.data.id;\n        }\n\n        // `email` is a standard OIDC claim, but the column is `select: false`\n        // (opt-in projection), so the default field set leaves it out and the\n        // claims document arrives without it. This endpoint only ever serves\n        // the CALLER'S OWN record, so the claim rides on top of the defaults.\n        // A caller stating its own `fields` keeps full control: the opt-in\n        // stays opt-in wherever the projection is explicit.\n        const query = useRequestQuery(event);\n\n        return this.service.getOne(id, actor, {\n            ...query,\n            fields: query.fields || '+email',\n        });\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAaO,qBAAb,MAAaA;CACCC;CAEV,YAAYC,KAAgC;EACxC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,IACF,OACa;EACb,MAAME,QAAQN,kBAAkBK,KAAAA;EAEhC,IAAIE,KAAK;EACT,IACID,MAAME,YACNF,MAAME,SAASC,SAAS,QAExBF,KAAKD,MAAME,SAASE,KAAKH;EAS7B,MAAMI,QAAQb,gBAAgBO,KAAAA;EAE9B,OAAO,KAAKH,QAAQU,OAAOL,IAAID,OAAO;GAClC,GAAGK;GACHE,QAAQF,MAAME,UAAU;EAC5B,CAAA;CACJ;AACJ;;CA3Bed,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA"}

package/dist/adapters/http/index.mjs

@@ -25,6 +25,7 @@ import { ForceLoggedInMiddleware } from "./middleware/built-in/loggedin/module.m
 import { ForceUserLoggedInMiddleware } from "./middleware/built-in/loggedin/user.mjs";
 import { RealmResolverMiddleware } from "./middleware/built-in/realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./middleware/built-in/realm-resolver/factory.mjs";
+import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./middleware/built-in/theme.mjs";
 import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./middleware/built-in/assets.mjs";
 import { registerBasicMiddleware } from "./middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./middleware/built-in/cors.mjs";
@@ -56,10 +57,12 @@ import { ClientScopeRequestValidator } from "./controllers/entities/client-scope
 import { ConsentController } from "./controllers/entities/consent/module.mjs";
 import { EventController } from "./controllers/entities/event/module.mjs";
 import { IdentityProviderController } from "./controllers/entities/identity-provider/module.mjs";
+import { IdentityProviderAccountController } from "./controllers/entities/identity-provider-account/module.mjs";
 import { IdentityProviderRoleMappingController } from "./controllers/entities/identity-provide-role/module.mjs";
 import { KeyController } from "./controllers/entities/key/module.mjs";
 import { PermissionController } from "./controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./controllers/entities/permission-policy/module.mjs";
+import { AccountController } from "./controllers/workflows/account/module.mjs";
 import { ActivateController } from "./controllers/workflows/activate/module.mjs";
 import { AuthenticatorChallengeController } from "./controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./controllers/workflows/authorize/module.mjs";
@@ -84,6 +87,7 @@ import { PolicyAttributesValidator } from "./controllers/entities/policy/utils/a
 import { PolicyValidator } from "./controllers/entities/policy/utils/validation.mjs";
 import { ScopeController } from "./controllers/entities/scope/module.mjs";
 import { SessionController } from "./controllers/entities/session/module.mjs";
+import { SessionTokenController } from "./controllers/entities/session-token/module.mjs";
 import { TrustAnchorController } from "./controllers/entities/trust-anchor/module.mjs";
 import { UserController } from "./controllers/entities/user/module.mjs";
 import { UserAttributeController } from "./controllers/entities/user-attribute/module.mjs";
@@ -94,4 +98,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, StatusController, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };
+export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };

package/dist/adapters/http/middleware/built-in/assets.d.ts

@@ -1,4 +1,11 @@
 import type { App } from 'routup';
+import type { ViteDevServer } from 'vite';
+import type { AssetsMiddlewareOptions } from './types.ts';
 export declare const VITE_SERVER_STORE_KEY: unique symbol;
-export declare function registerAssetsMiddleware(router: App): Promise<void>;
+/**
+ * Returns the vite dev server it created (JIT mode only), so the caller can
+ * close it on teardown. It owns a file watcher and an HMR websocket, which
+ * outlive the http listener otherwise.
+ */
+export declare function registerAssetsMiddleware(router: App, options?: AssetsMiddlewareOptions): Promise<ViteDevServer | undefined>;
 //# sourceMappingURL=assets.d.ts.map

package/dist/adapters/http/middleware/built-in/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAOlC,eAAO,MAAM,qBAAqB,eAAuB,CAAC;AAE1D,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,GAAG,iBAyCzD"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAM1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,qBAAqB,eAAuB,CAAC;AAE1D;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC1C,MAAM,EAAE,GAAG,EACX,OAAO,GAAE,uBAA4B,GACrC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAgFrC"}

package/dist/adapters/http/middleware/built-in/assets.mjs

@@ -1,29 +1,53 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from "../../../../path.mjs";
+import { PACKAGE_PATH } from "../../../../path.mjs";
+import { THEME_ASSET_MOUNT_PATH } from "../../ui/theme/contract/constants.mjs";
+import { createThemeAssetsHandler } from "../../ui/theme/assets.mjs";
+import { ThemeProvider } from "../../ui/theme/module.mjs";
+import "../../ui/theme/index.mjs";
+import { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from "../../ui/auth-console/resolve.mjs";
+import "../../ui/auth-console/index.mjs";
+import { registerThemeMiddleware } from "./theme.mjs";
+import { resolveAccountConsoleDistPath } from "../../ui/account-console/module.mjs";
+import "../../ui/account-console/index.mjs";
+import { InternalError } from "@authup/errors";
 import path from "node:path";
 import { defineCoreHandler } from "routup";
 import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
 import { fromNodeMiddleware } from "routup/node";
 import { read } from "locter";
+import fs from "node:fs";
 import { createHandler } from "@routup/assets";
 //#region src/adapters/http/middleware/built-in/assets.ts
 const VITE_SERVER_STORE_KEY = Symbol("ViteServer");
-async function registerAssetsMiddleware(router) {
+/**
+* Returns the vite dev server it created (JIT mode only), so the caller can
+* close it on teardown. It owns a file watcher and an HMR websocket, which
+* outlive the http listener otherwise.
+*/ async function registerAssetsMiddleware(router, options = {}) {
+	await registerThemeAssets(router, options);
+	const accountDistPath = resolveAccountConsoleDistPath();
+	if (accountDistPath) router.use("account/assets", createHandler(path.posix.join(accountDistPath, "assets"), {
+		fallthrough: false,
+		scan: false
+	}));
 	if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {
 		router.use("public", createHandler(path.posix.join(PACKAGE_PATH, "public"), {
 			fallthrough: true,
 			scan: false
 		}));
-		router.use("public", createHandler(path.posix.join(UI_DIST_PATH, "client"), {
+		const authConsoleDistPath = resolveAuthConsoleDistPath();
+		if (authConsoleDistPath) router.use("public", createHandler(path.posix.join(authConsoleDistPath, "client"), {
 			fallthrough: false,
 			scan: false
 		}));
 		return;
 	}
+	const authConsolePackagePath = resolveAuthConsolePackagePath();
+	if (!authConsolePackagePath) throw new InternalError("The auth console package (@authup/client-auth-console) is not installed.");
 	const server = await (await read("vite")).createServer({
-		root: UI_SOURCE_PATH,
+		root: authConsolePackagePath,
 		base: "/public/",
 		logLevel: "error",
 		server: {
@@ -40,6 +64,26 @@ async function registerAssetsMiddleware(router) {
 		event.store[VITE_SERVER_STORE_KEY] = server;
 		return event.next();
 	}));
+	return server;
+}
+/**
+* Load the operator theme and mount its `assets/` directory at /theme.
+*
+* A missing directory disables the feature entirely: no provider is
+* created, no middleware is registered, and both console serve paths keep
+* returning byte-identical un-themed pages. So the default configuration
+* pays nothing, not even a per-request core handler.
+*/ async function registerThemeAssets(router, options) {
+	const { themeDirectoryPath } = options;
+	if (!themeDirectoryPath || !fs.existsSync(themeDirectoryPath)) return;
+	const provider = new ThemeProvider({
+		directoryPath: themeDirectoryPath,
+		fragmentsEnabled: options.themeFragmentsEnabled,
+		logger: options.logger
+	});
+	await provider.load();
+	registerThemeMiddleware(router, provider);
+	router.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(provider));
 }
 //#endregion
 export { VITE_SERVER_STORE_KEY, registerAssetsMiddleware };

package/dist/adapters/http/middleware/built-in/assets.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"assets.mjs","names":["read","CodeTransformation","isCodeTransformation","createHandler","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","UI_DIST_PATH","UI_SOURCE_PATH","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","JUST_IN_TIME","use","posix","join","fallthrough","scan","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type * as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH, UI_DIST_PATH, UI_SOURCE_PATH } from '../../../../path.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\nexport async function registerAssetsMiddleware(router: App) {\n    if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        router.use('public', createHandler(\n            path.posix.join(PACKAGE_PATH, 'public'),\n            {\n                fallthrough: true,\n                scan: false,\n            },\n        ));\n\n        router.use('public', createHandler(\n            path.posix.join(UI_DIST_PATH, 'client'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n        return;\n    }\n\n    const vite = await read('vite') as typeof Vite;\n\n    const server: ViteDevServer = await vite.createServer({\n        root: UI_SOURCE_PATH,\n        base: '/public/',\n        logLevel: 'error',\n        server: {\n            middlewareMode: true,\n            watch: {\n                usePolling: true,\n                interval: 100,\n            },\n        },\n        appType: 'custom',\n    });\n\n    router.use('public', fromNodeMiddleware(server.middlewares));\n    router.use(defineCoreHandler((event) => {\n        event.store[VITE_SERVER_STORE_KEY] = server;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAaU,wBAAwBC,OAAO,YAAA;AAE5C,eAAsBC,yBAAyBC,QAAW;CACtD,IAAI,CAACX,qBAAqBD,mBAAmBa,YAAY,GAAG;EACxDD,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKV,cAAc,QAAA,GAC9B;GACIW,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGJN,OAAOE,IAAI,UAAUZ,cACjBC,KAAKY,MAAMC,KAAKT,cAAc,QAAA,GAC9B;GACIU,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAEJ;CACJ;CAIA,MAAME,SAAwB,OAAMD,MAFjBpB,KAAK,MAAA,EAAA,CAEiBsB,aAAa;EAClDC,MAAMd;EACNe,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAjB,OAAOE,IAAI,UAAUT,mBAAmBe,OAAOU,WAAW,CAAA;CAC1DlB,OAAOE,IAAIV,mBAAmB2B,UAAAA;EAC1BA,MAAMC,MAAMvB,yBAAyBW;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}
+{"version":3,"file":"assets.mjs","names":["InternalError","read","CodeTransformation","isCodeTransformation","createHandler","fs","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","resolveAccountConsoleDistPath","resolveAuthConsoleDistPath","resolveAuthConsolePackagePath","THEME_ASSET_MOUNT_PATH","ThemeProvider","createThemeAssetsHandler","registerThemeMiddleware","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","options","registerThemeAssets","accountDistPath","use","posix","join","fallthrough","scan","JUST_IN_TIME","authConsoleDistPath","undefined","authConsolePackagePath","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next","themeDirectoryPath","existsSync","provider","directoryPath","fragmentsEnabled","themeFragmentsEnabled","logger","load"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { InternalError } from '@authup/errors';\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type * as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH } from '../../../../path.ts';\nimport { resolveAccountConsoleDistPath } from '../../ui/account-console/index.ts';\nimport { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from '../../ui/auth-console/index.ts';\nimport { THEME_ASSET_MOUNT_PATH, ThemeProvider, createThemeAssetsHandler } from '../../ui/theme/index.ts';\nimport { registerThemeMiddleware } from './theme.ts';\nimport type { AssetsMiddlewareOptions } from './types.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\n/**\n * Returns the vite dev server it created (JIT mode only), so the caller can\n * close it on teardown. It owns a file watcher and an HMR websocket, which\n * outlive the http listener otherwise.\n */\nexport async function registerAssetsMiddleware(\n    router: App,\n    options: AssetsMiddlewareOptions = {},\n) : Promise<ViteDevServer | undefined> {\n    // Mounted FIRST, and outside the JIT early-return below, so an\n    // operator theme applies in dev mode too. An invalid manifest throws\n    // here and fails the boot.\n    await registerThemeAssets(router, options);\n\n    // Static assets of the account console SPA (its fixed vite base is\n    // /account/). Served in dev mode too — the bundle is prebuilt, not\n    // vite-transformed. A missing bundle only disables the mount; the page\n    // route reports the actionable error.\n    const accountDistPath = resolveAccountConsoleDistPath();\n    if (accountDistPath) {\n        router.use('account/assets', createHandler(\n            path.posix.join(accountDistPath, 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n    }\n\n    if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        router.use('public', createHandler(\n            path.posix.join(PACKAGE_PATH, 'public'),\n            {\n                fallthrough: true,\n                scan: false,\n            },\n        ));\n\n        // Static assets of the auth console SSR bundle (its fixed vite base\n        // is /public/). A missing bundle only disables the mount; the page\n        // routes report the actionable error.\n        const authConsoleDistPath = resolveAuthConsoleDistPath();\n        if (authConsoleDistPath) {\n            router.use('public', createHandler(\n                path.posix.join(authConsoleDistPath, 'client'),\n                {\n                    fallthrough: false,\n                    scan: false,\n                },\n            ));\n        }\n        return undefined;\n    }\n\n    // JIT (dev) mode serves the auth console straight from the package\n    // SOURCE directory (the workspace symlink carries index.html + src/ +\n    // vite.config.ts; a published install has no JIT). Vite auto-loads the\n    // package's own vite.config.ts from the root.\n    const authConsolePackagePath = resolveAuthConsolePackagePath();\n    if (!authConsolePackagePath) {\n        throw new InternalError(\n            'The auth console package (@authup/client-auth-console) is not installed.',\n        );\n    }\n\n    const vite = await read('vite') as typeof Vite;\n\n    const server: ViteDevServer = await vite.createServer({\n        root: authConsolePackagePath,\n        base: '/public/',\n        logLevel: 'error',\n        server: {\n            middlewareMode: true,\n            watch: {\n                usePolling: true,\n                interval: 100,\n            },\n        },\n        appType: 'custom',\n    });\n\n    router.use('public', fromNodeMiddleware(server.middlewares));\n    router.use(defineCoreHandler((event) => {\n        event.store[VITE_SERVER_STORE_KEY] = server;\n        return event.next();\n    }));\n\n    return server;\n}\n\n/**\n * Load the operator theme and mount its `assets/` directory at /theme.\n *\n * A missing directory disables the feature entirely: no provider is\n * created, no middleware is registered, and both console serve paths keep\n * returning byte-identical un-themed pages. So the default configuration\n * pays nothing, not even a per-request core handler.\n */\nasync function registerThemeAssets(router: App, options: AssetsMiddlewareOptions) : Promise<void> {\n    const { themeDirectoryPath } = options;\n    if (!themeDirectoryPath || !fs.existsSync(themeDirectoryPath)) {\n        return;\n    }\n\n    const provider = new ThemeProvider({\n        directoryPath: themeDirectoryPath,\n        fragmentsEnabled: options.themeFragmentsEnabled,\n        logger: options.logger,\n    });\n\n    await provider.load();\n\n    registerThemeMiddleware(router, provider);\n\n    router.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(provider));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAaiB,wBAAwBC,OAAO,YAAA;;;;;GAO5C,eAAsBC,yBAClBC,QACAC,UAAmC,CAAC,GAAC;CAKrC,MAAMC,oBAAoBF,QAAQC,OAAAA;CAMlC,MAAME,kBAAkBb,8BAAAA;CACxB,IAAIa,iBACAH,OAAOI,IAAI,kBAAkBpB,cACzBE,KAAKmB,MAAMC,KAAKH,iBAAiB,QAAA,GACjC;EACII,aAAa;EACbC,MAAM;CACV,CAAA,CAAA;CAIR,IAAI,CAACzB,qBAAqBD,mBAAmB2B,YAAY,GAAG;EACxDT,OAAOI,IAAI,UAAUpB,cACjBE,KAAKmB,MAAMC,KAAKjB,cAAc,QAAA,GAC9B;GACIkB,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAMJ,MAAME,sBAAsBnB,2BAAAA;EAC5B,IAAImB,qBACAV,OAAOI,IAAI,UAAUpB,cACjBE,KAAKmB,MAAMC,KAAKI,qBAAqB,QAAA,GACrC;GACIH,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGR;CACJ;CAMA,MAAMI,yBAAyBpB,8BAAAA;CAC/B,IAAI,CAACoB,wBACD,MAAM,IAAIhC,cACN,0EAAA;CAMR,MAAMkC,SAAwB,OAAMD,MAFjBhC,KAAK,MAAA,EAAA,CAEiBkC,aAAa;EAClDC,MAAMJ;EACNK,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAvB,OAAOI,IAAI,UAAUhB,mBAAmB0B,OAAOU,WAAW,CAAA;CAC1DxB,OAAOI,IAAIjB,mBAAmBsC,UAAAA;EAC1BA,MAAMC,MAAM7B,yBAAyBiB;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;CAEA,OAAOb;AACX;;;;;;;;GAUA,eAAeZ,oBAAoBF,QAAaC,SAAgC;CAC5E,MAAM,EAAE2B,uBAAuB3B;CAC/B,IAAI,CAAC2B,sBAAsB,CAAC3C,GAAG4C,WAAWD,kBAAAA,GACtC;CAGJ,MAAME,WAAW,IAAIpC,cAAc;EAC/BqC,eAAeH;EACfI,kBAAkB/B,QAAQgC;EAC1BC,QAAQjC,QAAQiC;CACpB,CAAA;CAEA,MAAMJ,SAASK,KAAI;CAEnBvC,wBAAwBI,QAAQ8B,QAAAA;CAEhC9B,OAAOI,IAAIX,wBAAwBE,yBAAyBmC,QAAAA,CAAAA;AAChE"}

package/dist/adapters/http/middleware/built-in/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,sBAA2B,QAiBxF"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,KAAK,sBAAsB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,sBAA2B,QAyBxF"}

package/dist/adapters/http/middleware/built-in/error.mjs

@@ -1,18 +1,19 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { sanitizeError } from "../../../../utils/error.mjs";
+import { describeError, sanitizeError } from "../../../../utils/error.mjs";
 import "../../../../utils/index.mjs";
 import { httpStatusFromCode, serializeError } from "@authup/errors";
 import { defineErrorHandler } from "routup";
 //#region src/adapters/http/middleware/built-in/error.ts
 function registerErrorMiddleware(router, options = {}) {
 	router.use(defineErrorHandler((error, event) => {
-		const next = sanitizeError(error.cause ?? error);
+		const original = error.cause ?? error;
+		const next = sanitizeError(original);
 		const status = httpStatusFromCode(next.code);
 		const payload = serializeError(next);
 		if (status >= 500) {
-			if (options.logger) options.logger.error(next);
+			if (options.logger) options.logger.error(describeError(original));
 			payload.message = "An internal server error occurred.";
 		}
 		event.response.status = status;

package/dist/adapters/http/middleware/built-in/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["defineErrorHandler","httpStatusFromCode","serializeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","next","cause","status","code","payload","logger","message","response"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { httpStatusFromCode, serializeError } from '@authup/errors';\nimport { sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: App, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        const next = sanitizeError(error.cause ?? error);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                options.logger.error(next);\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;AAiBA,SAAgBI,wBAAwBC,QAAaC,UAAkC,CAAC,GAAC;CACrFD,OAAOE,IAAIP,oBAAoBQ,OAAOC,UAAAA;EAClC,MAAMC,OAAOP,cAAcK,MAAMG,SAASH,KAAAA;EAC1C,MAAMI,SAASX,mBAAmBS,KAAKG,IAAI;EAE3C,MAAMC,UAAUZ,eAAeQ,IAAAA;EAE/B,IAAIE,UAAU,KAAK;GACf,IAAIN,QAAQS,QACRT,QAAQS,OAAOP,MAAME,IAAAA;GAEzBI,QAAQE,UAAU;EACtB;EAEAP,MAAMQ,SAASL,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}
+{"version":3,"file":"error.mjs","names":["defineErrorHandler","httpStatusFromCode","serializeError","describeError","sanitizeError","registerErrorMiddleware","router","options","use","error","event","original","cause","next","status","code","payload","logger","message","response"],"sources":["../../../../../src/adapters/http/middleware/built-in/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App } from 'routup';\nimport { defineErrorHandler } from 'routup';\nimport type { Logger } from '@authup/server-kit';\nimport { httpStatusFromCode, serializeError } from '@authup/errors';\nimport { describeError, sanitizeError } from '../../../../utils/index.ts';\n\ntype ErrorMiddlewareOptions = {\n    logger?: Logger\n};\n\nexport function registerErrorMiddleware(router: App, options: ErrorMiddlewareOptions = {}) {\n    router.use(defineErrorHandler((error, event) => {\n        // routup wraps whatever a handler threw into an AppError carrying it\n        // as `cause`, so this is the error as it was actually raised.\n        const original = error.cause ?? error;\n\n        const next = sanitizeError(original);\n        const status = httpStatusFromCode(next.code);\n\n        const payload = serializeError(next);\n\n        if (status >= 500) {\n            if (options.logger) {\n                // The ORIGINAL error, never the sanitized copy. Sanitizing\n                // discards the transport reason and the upstream response\n                // body on purpose, and those are the only things that make\n                // an outbound failure diagnosable.\n                options.logger.error(describeError(original));\n            }\n            payload.message = 'An internal server error occurred.';\n        }\n\n        event.response.status = status;\n        return payload;\n    }));\n}\n"],"mappings":";;;;;;;;AAiBA,SAAgBK,wBAAwBC,QAAaC,UAAkC,CAAC,GAAC;CACrFD,OAAOE,IAAIR,oBAAoBS,OAAOC,UAAAA;EAGlC,MAAMC,WAAWF,MAAMG,SAASH;EAEhC,MAAMI,OAAOT,cAAcO,QAAAA;EAC3B,MAAMG,SAASb,mBAAmBY,KAAKE,IAAI;EAE3C,MAAMC,UAAUd,eAAeW,IAAAA;EAE/B,IAAIC,UAAU,KAAK;GACf,IAAIP,QAAQU,QAKRV,QAAQU,OAAOR,MAAMN,cAAcQ,QAAAA,CAAAA;GAEvCK,QAAQE,UAAU;EACtB;EAEAR,MAAMS,SAASL,SAASA;EACxB,OAAOE;CACX,CAAA,CAAA;AACJ"}

package/dist/adapters/http/middleware/built-in/index.d.ts

@@ -9,5 +9,7 @@ export * from './logger.ts';
 export * from './prometheus.ts';
 export * from './rate-limit.ts';
 export * from './swagger.ts';
+export * from './theme.ts';
+export * from './types.ts';
 export * from './ui-http-client.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/middleware/built-in/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAE1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/index.ts"],"names":[],"mappings":"AAOA,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAE1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC"}

package/dist/adapters/http/middleware/built-in/index.mjs

@@ -10,6 +10,7 @@ import "./loggedin/index.mjs";
 import { RealmResolverMiddleware } from "./realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./realm-resolver/factory.mjs";
 import "./realm-resolver/index.mjs";
+import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./theme.mjs";
 import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./assets.mjs";
 import { registerBasicMiddleware } from "./basic.mjs";
 import { registerCorsMiddleware } from "./cors.mjs";
@@ -19,4 +20,4 @@ import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "
 import { registerRateLimitMiddleware } from "./rate-limit.mjs";
 import { createSwaggerMiddleware } from "./swagger.mjs";
 import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./ui-http-client.mjs";
-export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerUIHttpClientMiddleware };
+export { AuthorizationMiddleware, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, RealmResolverMiddleware, THEME_STORE_KEY, UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, useRequestTheme };

package/dist/adapters/http/middleware/built-in/theme.d.ts

@@ -0,0 +1,15 @@
+import type { App, IAppEvent } from 'routup';
+import type { IThemeProvider } from '../../ui/theme/index.ts';
+/**
+ * Per-request handoff of the operator theme into the two console serve
+ * paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.
+ *
+ * A store handoff rather than module-scope state, so two applications in
+ * one process (the test suite) never share a theme, and rather than
+ * threading the provider through seven workflow controllers, which is a
+ * lot of plumbing for decoration.
+ */
+export declare const THEME_STORE_KEY: unique symbol;
+export declare function registerThemeMiddleware(router: App, provider: IThemeProvider): void;
+export declare function useRequestTheme(event: IAppEvent): IThemeProvider | undefined;
+//# sourceMappingURL=theme.d.ts.map

package/dist/adapters/http/middleware/built-in/theme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/theme.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,eAAkB,CAAC;AAE/C,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,QAM5E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc,GAAG,SAAS,CAE7E"}

package/dist/adapters/http/middleware/built-in/theme.mjs

@@ -0,0 +1,27 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { defineCoreHandler } from "routup";
+//#region src/adapters/http/middleware/built-in/theme.ts
+/**
+* Per-request handoff of the operator theme into the two console serve
+* paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.
+*
+* A store handoff rather than module-scope state, so two applications in
+* one process (the test suite) never share a theme, and rather than
+* threading the provider through seven workflow controllers, which is a
+* lot of plumbing for decoration.
+*/ const THEME_STORE_KEY = Symbol("Theme");
+function registerThemeMiddleware(router, provider) {
+	router.use(defineCoreHandler((event) => {
+		event.store[THEME_STORE_KEY] = provider;
+		return event.next();
+	}));
+}
+function useRequestTheme(event) {
+	return event.store[THEME_STORE_KEY];
+}
+//#endregion
+export { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme };
+
+//# sourceMappingURL=theme.mjs.map

package/dist/adapters/http/middleware/built-in/theme.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme.mjs","names":["defineCoreHandler","THEME_STORE_KEY","Symbol","registerThemeMiddleware","router","provider","use","event","store","next","useRequestTheme"],"sources":["../../../../../src/adapters/http/middleware/built-in/theme.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App, IAppEvent } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport type { IThemeProvider } from '../../ui/theme/index.ts';\n\n/**\n * Per-request handoff of the operator theme into the two console serve\n * paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.\n *\n * A store handoff rather than module-scope state, so two applications in\n * one process (the test suite) never share a theme, and rather than\n * threading the provider through seven workflow controllers, which is a\n * lot of plumbing for decoration.\n */\nexport const THEME_STORE_KEY = Symbol('Theme');\n\nexport function registerThemeMiddleware(router: App, provider: IThemeProvider) {\n    router.use(defineCoreHandler((event) => {\n        event.store[THEME_STORE_KEY] = provider;\n\n        return event.next();\n    }));\n}\n\nexport function useRequestTheme(event: IAppEvent) : IThemeProvider | undefined {\n    return event.store[THEME_STORE_KEY] as IThemeProvider | undefined;\n}\n"],"mappings":";;;;;;;;;;;;;GAoBA,MAAaC,kBAAkBC,OAAO,OAAA;AAEtC,SAAgBC,wBAAwBC,QAAaC,UAAwB;CACzED,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,mBAAmBI;EAE/B,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ;AAEA,SAAgBC,gBAAgBH,OAAgB;CAC5C,OAAOA,MAAMC,MAAMP;AACvB"}

package/dist/adapters/http/middleware/built-in/types.d.ts

@@ -0,0 +1,14 @@
+import type { Logger } from '@authup/server-kit';
+export type AssetsMiddlewareOptions = {
+    /**
+     * Absolute path of the operator theme directory. Empty or missing
+     * disables theming entirely.
+     */
+    themeDirectoryPath?: string;
+    /**
+     * Opt in to reading the theme's `fragments/head.html`. Default off.
+     */
+    themeFragmentsEnabled?: boolean;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/middleware/built-in/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,uBAAuB,GAAG;IAClC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/middleware/built-in/ui-http-client.d.ts

@@ -1,7 +1,7 @@
 import type { IClient } from '@authup/core-http-kit';
 import type { App } from 'routup';
 /**
- * Per-request handoff of an HTTP-client factory into renderUIPage —
+ * Per-request handoff of an HTTP-client factory into renderAuthConsolePage —
  * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk
  * over the DI container (`() => container.resolve(UIHttpClient)`)
  * whose registration carries `lifetime: 'transient'`, so every SSR

package/dist/adapters/http/middleware/built-in/ui-http-client.mjs

@@ -4,7 +4,7 @@ import.meta.url;
 import { defineCoreHandler } from "routup";
 //#region src/adapters/http/middleware/built-in/ui-http-client.ts
 /**
-* Per-request handoff of an HTTP-client factory into renderUIPage —
+* Per-request handoff of an HTTP-client factory into renderAuthConsolePage —
 * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk
 * over the DI container (`() => container.resolve(UIHttpClient)`)
 * whose registration carries `lifetime: 'transient'`, so every SSR