@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/utils/error.d.ts

@@ -5,12 +5,29 @@ import { AuthupError } from '@authup/errors';
  * 1. AuthupError instance              → returned as-is
  * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError
  * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues
- * 4. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code
- * 5. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT
- * 6. anything else                     → INTERNAL_ERROR AuthupError
+ * 4. rapiq ParseError / CodecError     → BAD_REQUEST AuthupError (client wire query)
+ * 5. hapic ClientError                 → UPSTREAM_ERROR AuthupError (outbound call)
+ * 6. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code
+ * 7. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT
+ * 8. anything else                     → INTERNAL_ERROR AuthupError
  *
  * The HTTP-status concern is handled separately by `httpStatusFromCode` in
  * the adapter — this function only assigns a semantic `code`.
  */
 export declare function sanitizeError(input: unknown): AuthupError;
+/**
+ * Render an error for the LOG. It is the counterpart of `@authup/errors`'
+ * `serializeError`, which renders one for the response.
+ *
+ * The detail an outbound failure carries never survives `sanitizeError`
+ * (by design: upstream internals must not reach the caller), and
+ * `Error.cause` is non-enumerable, so a plain serialization drops it too.
+ * Both were therefore already gone by the time anything was written,
+ * which left a refused connection and an upstream `invalid_request`
+ * indistinguishable in the log.
+ *
+ * Everything not present is omitted, so an ordinary error still renders
+ * as its bare message.
+ */
+export declare function describeError(input: unknown, headline?: string): string;
 //# sourceMappingURL=error.d.ts.map

package/dist/utils/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,WAAW,EAId,MAAM,gBAAgB,CAAC;AAMxB;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAoEzD"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,WAAW,EAKd,MAAM,gBAAgB,CAAC;AAQxB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAgGzD;AA0ED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BvE"}

package/dist/utils/error.mjs

@@ -2,9 +2,11 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { hasOwnProperty, isObject } from "@authup/kit";
-import { AuthupError, ErrorCode, codeFromHttpStatus, isAuthupError } from "@authup/errors";
+import { AuthupError, ErrorCode, codeFromHttpStatus, isAuthupError, normalizeError } from "@authup/errors";
+import { CodecError, ParseError } from "@rapiq/core";
 import { buildErrorMessageForAttributes, isValidupError, stringifyPath } from "validup";
 import { EntityRelationLookupError } from "typeorm-extension";
+import { isClientError } from "hapic";
 import { isHTTPError } from "@ebec/http";
 //#region src/utils/error.ts
 /**
@@ -13,9 +15,11 @@ import { isHTTPError } from "@ebec/http";
 * 1. AuthupError instance              → returned as-is
 * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError
 * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues
-* 4. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code
-* 5. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT
-* 6. anything else                     → INTERNAL_ERROR AuthupError
+* 4. rapiq ParseError / CodecError     → BAD_REQUEST AuthupError (client wire query)
+* 5. hapic ClientError                 → UPSTREAM_ERROR AuthupError (outbound call)
+* 6. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code
+* 7. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT
+* 8. anything else                     → INTERNAL_ERROR AuthupError
 *
 * The HTTP-status concern is handled separately by `httpStatusFromCode` in
 * the adapter — this function only assigns a semantic `code`.
@@ -36,6 +40,27 @@ import { isHTTPError } from "@ebec/http";
 		error.issues.push(...input.issues);
 		return error;
 	}
+	if (input instanceof ParseError || input instanceof CodecError) return new AuthupError({
+		code: ErrorCode.BAD_REQUEST,
+		message: input.message,
+		stack: input.stack
+	});
+	/**
+	* An outbound call failed. This branch MUST precede the `isHTTPError`
+	* one below: a hapic `HttpResponseError` extends `BaseError` and carries
+	* the upstream `status`, so the duck guard matches it and would mirror
+	* that status onto our own response. An upstream 400 would then read as
+	* "your request was malformed" when the caller's request was fine.
+	*
+	* The message is deliberately dropped rather than forwarded: hapic
+	* embeds the outbound method and URL in it (`400 Bad Request (POST
+	* https://idp.example.com/token)`), which must not reach the caller.
+	* `describeError` is what carries the detail, into the log only.
+	*/ if (isClientError(input)) return new AuthupError({
+		code: ErrorCode.UPSTREAM_ERROR,
+		message: "A request to an upstream service failed.",
+		stack: input.stack
+	});
 	if (isHTTPError(input)) return new AuthupError({
 		code: codeFromHttpStatus(input.status),
 		message: input.message,
@@ -66,7 +91,79 @@ import { isHTTPError } from "@ebec/http";
 	}
 	return new AuthupError({ code: ErrorCode.INTERNAL_ERROR });
 }
+const DESCRIBE_BODY_MAX_LENGTH = 1024;
+const DESCRIBE_CAUSE_MAX_DEPTH = 5;
+const DESCRIBE_CAUSE_KEYS = [
+	"code",
+	"errno",
+	"syscall",
+	"address",
+	"port"
+];
+function describeBody(input) {
+	let value;
+	if (typeof input === "string") value = input;
+	else try {
+		value = JSON.stringify(input) ?? String(input);
+	} catch {
+		value = Object.prototype.toString.call(input);
+	}
+	if (value.length === 0) return;
+	if (value.length > DESCRIBE_BODY_MAX_LENGTH) return `${value.substring(0, DESCRIBE_BODY_MAX_LENGTH)}… (truncated)`;
+	return value;
+}
+function describeCauseLink(input) {
+	const error = input;
+	const parts = [`${typeof error.name === "string" ? error.name : "Error"}: ${error.message}`];
+	const details = [];
+	for (const key of DESCRIBE_CAUSE_KEYS) {
+		const value = input[key];
+		if (typeof value === "string" || typeof value === "number") details.push(`${key}=${value}`);
+	}
+	if (details.length > 0) parts.push(`(${details.join(" ")})`);
+	return parts.join(" ");
+}
+function describeCauseChain(input) {
+	const links = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = isObject(input) ? input.cause : void 0;
+	while (isObject(current) && !seen.has(current) && links.length < DESCRIBE_CAUSE_MAX_DEPTH) {
+		seen.add(current);
+		links.push(describeCauseLink(current));
+		current = current.cause;
+	}
+	if (links.length === 0) return;
+	return links.join(" <- ");
+}
+/**
+* Render an error for the LOG. It is the counterpart of `@authup/errors`'
+* `serializeError`, which renders one for the response.
+*
+* The detail an outbound failure carries never survives `sanitizeError`
+* (by design: upstream internals must not reach the caller), and
+* `Error.cause` is non-enumerable, so a plain serialization drops it too.
+* Both were therefore already gone by the time anything was written,
+* which left a refused connection and an upstream `invalid_request`
+* indistinguishable in the log.
+*
+* Everything not present is omitted, so an ordinary error still renders
+* as its bare message.
+*/ function describeError(input, headline) {
+	const error = normalizeError(input);
+	const lines = [];
+	if (headline) lines.push(headline);
+	lines.push(error.message);
+	if (isClientError(error) && error.response) {
+		lines.push(`  upstream status: ${error.response.status}`);
+		const body = describeBody(error.response.data);
+		if (body) lines.push(`  upstream body:   ${body}`);
+	}
+	const causes = describeCauseChain(error);
+	if (causes) lines.push(`  cause:           ${causes}`);
+	if (error.stack) lines.push(`  stack:           ${error.stack}`);
+	return lines.join("\n");
+}
 //#endregion
-export { sanitizeError };
+export { describeError, sanitizeError };
 
 //# sourceMappingURL=error.mjs.map

package/dist/utils/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["AuthupError","ErrorCode","codeFromHttpStatus","isAuthupError","isHTTPError","EntityRelationLookupError","buildErrorMessageForAttributes","isValidupError","stringifyPath","hasOwnProperty","isObject","sanitizeError","input","code","ENTITY_RELATION_INVALID","message","stack","paths","issues","map","issue","path","error","BAD_REQUEST","push","status","undefined","ENTITY_CONFLICT","STORAGE_INSUFFICIENT","INTERNAL_ERROR"],"sources":["../../src/utils/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { \n    AuthupError, \n    ErrorCode, \n    codeFromHttpStatus, \n    isAuthupError, \n} from '@authup/errors';\nimport { isHTTPError } from '@ebec/http';\nimport { EntityRelationLookupError } from 'typeorm-extension';\nimport { buildErrorMessageForAttributes, isValidupError, stringifyPath } from 'validup';\nimport { hasOwnProperty, isObject } from '@authup/kit';\n\n/**\n * Normalize an unknown error to an AuthupError. Recognised shapes:\n *\n * 1. AuthupError instance              → returned as-is\n * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError\n * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues\n * 4. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code\n * 5. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT\n * 6. anything else                     → INTERNAL_ERROR AuthupError\n *\n * The HTTP-status concern is handled separately by `httpStatusFromCode` in\n * the adapter — this function only assigns a semantic `code`.\n */\nexport function sanitizeError(input: unknown): AuthupError {\n    if (isAuthupError(input)) {\n        return input;\n    }\n\n    if (input instanceof EntityRelationLookupError) {\n        return new AuthupError({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isValidupError(input)) {\n        const paths = input.issues.map((issue) => stringifyPath(issue.path));\n        const error = new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            stack: input.stack,\n            message: input.message || buildErrorMessageForAttributes(paths),\n        });\n\n        error.issues.push(...input.issues);\n        return error;\n    }\n\n    if (isHTTPError(input)) {\n        return new AuthupError({\n            code: codeFromHttpStatus(input.status),\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isObject(input)) {\n        const code = hasOwnProperty(input, 'code') &&\n        typeof input.code === 'string' ?\n            input.code :\n            undefined;\n\n        /**\n         * @see https://dev.mysql.com/doc/mysql-errors/8.0/en/server-error-reference.html\n         */\n        switch (code) {\n            case '23505':\n            case 'ER_DUP_ENTRY':\n            case 'SQLITE_CONSTRAINT_UNIQUE': {\n                return new AuthupError({\n                    code: ErrorCode.ENTITY_CONFLICT,\n                    message: 'An entry with some unique attributes already exists.',\n                    stack: input.stack as string | undefined,\n                });\n            }\n            case 'ER_DISK_FULL':\n                return new AuthupError({\n                    code: ErrorCode.STORAGE_INSUFFICIENT,\n                    message: 'No database operation possible, due to the lack of free disk space.',\n                    stack: input.stack as string | undefined,\n                });\n        }\n\n        return new AuthupError({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: input.message as string | undefined,\n            stack: input.stack as string | undefined,\n        });\n    }\n\n    return new AuthupError({ code: ErrorCode.INTERNAL_ERROR });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;GA+BA,SAAgBW,cAAcC,OAAc;CACxC,IAAIT,cAAcS,KAAAA,GACd,OAAOA;CAGX,IAAIA,iBAAiBP,2BACjB,OAAO,IAAIL,YAAY;EACnBa,MAAMZ,UAAUa;EAChBC,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIT,eAAeK,KAAAA,GAAQ;EACvB,MAAMK,QAAQL,MAAMM,OAAOC,KAAKC,UAAUZ,cAAcY,MAAMC,IAAI,CAAA;EAClE,MAAMC,QAAQ,IAAItB,YAAY;GAC1Ba,MAAMZ,UAAUsB;GAChBP,OAAOJ,MAAMI;GACbD,SAASH,MAAMG,WAAWT,+BAA+BW,KAAAA;EAC7D,CAAA;EAEAK,MAAMJ,OAAOM,KAAI,GAAIZ,MAAMM,MAAM;EACjC,OAAOI;CACX;CAEA,IAAIlB,YAAYQ,KAAAA,GACZ,OAAO,IAAIZ,YAAY;EACnBa,MAAMX,mBAAmBU,MAAMa,MAAM;EACrCV,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIN,SAASE,KAAAA,GAAQ;;;KASjB,QARaH,eAAeG,OAAO,MAAA,KACnC,OAAOA,MAAMC,SAAS,WAClBD,MAAMC,OACNa,KAAAA,GAKJ;GACI,KAAK;GACL,KAAK;GACL,KAAK,4BACD,OAAO,IAAI1B,YAAY;IACnBa,MAAMZ,UAAU0B;IAChBZ,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;GAEJ,KAAK,gBACD,OAAO,IAAIhB,YAAY;IACnBa,MAAMZ,UAAU2B;IAChBb,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;EACR;EAEA,OAAO,IAAIhB,YAAY;GACnBa,MAAMZ,UAAU4B;GAChBd,SAASH,MAAMG;GACfC,OAAOJ,MAAMI;EACjB,CAAA;CACJ;CAEA,OAAO,IAAIhB,YAAY,EAAEa,MAAMZ,UAAU4B,eAAe,CAAA;AAC5D"}
+{"version":3,"file":"error.mjs","names":["AuthupError","ErrorCode","codeFromHttpStatus","isAuthupError","normalizeError","isHTTPError","isClientError","CodecError","ParseError","EntityRelationLookupError","buildErrorMessageForAttributes","isValidupError","stringifyPath","hasOwnProperty","isObject","sanitizeError","input","code","ENTITY_RELATION_INVALID","message","stack","paths","issues","map","issue","path","error","BAD_REQUEST","push","UPSTREAM_ERROR","status","undefined","ENTITY_CONFLICT","STORAGE_INSUFFICIENT","INTERNAL_ERROR","DESCRIBE_BODY_MAX_LENGTH","DESCRIBE_CAUSE_MAX_DEPTH","DESCRIBE_CAUSE_KEYS","describeBody","value","JSON","stringify","String","Object","prototype","toString","call","length","substring","describeCauseLink","name","parts","details","key","join","describeCauseChain","links","seen","Set","current","cause","has","add","describeError","headline","lines","response","body","data","causes"],"sources":["../../src/utils/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AuthupError,\n    ErrorCode,\n    codeFromHttpStatus,\n    isAuthupError,\n    normalizeError,\n} from '@authup/errors';\nimport { isHTTPError } from '@ebec/http';\nimport { isClientError } from 'hapic';\nimport { CodecError, ParseError } from '@rapiq/core';\nimport { EntityRelationLookupError } from 'typeorm-extension';\nimport { buildErrorMessageForAttributes, isValidupError, stringifyPath } from 'validup';\nimport { hasOwnProperty, isObject } from '@authup/kit';\n\n/**\n * Normalize an unknown error to an AuthupError. Recognised shapes:\n *\n * 1. AuthupError instance              → returned as-is\n * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError\n * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues\n * 4. rapiq ParseError / CodecError     → BAD_REQUEST AuthupError (client wire query)\n * 5. hapic ClientError                 → UPSTREAM_ERROR AuthupError (outbound call)\n * 6. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code\n * 7. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT\n * 8. anything else                     → INTERNAL_ERROR AuthupError\n *\n * The HTTP-status concern is handled separately by `httpStatusFromCode` in\n * the adapter — this function only assigns a semantic `code`.\n */\nexport function sanitizeError(input: unknown): AuthupError {\n    if (isAuthupError(input)) {\n        return input;\n    }\n\n    if (input instanceof EntityRelationLookupError) {\n        return new AuthupError({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isValidupError(input)) {\n        const paths = input.issues.map((issue) => stringifyPath(issue.path));\n        const error = new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            stack: input.stack,\n            message: input.message || buildErrorMessageForAttributes(paths),\n        });\n\n        error.issues.push(...input.issues);\n        return error;\n    }\n\n    if (input instanceof ParseError || input instanceof CodecError) {\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    /**\n     * An outbound call failed. This branch MUST precede the `isHTTPError`\n     * one below: a hapic `HttpResponseError` extends `BaseError` and carries\n     * the upstream `status`, so the duck guard matches it and would mirror\n     * that status onto our own response. An upstream 400 would then read as\n     * \"your request was malformed\" when the caller's request was fine.\n     *\n     * The message is deliberately dropped rather than forwarded: hapic\n     * embeds the outbound method and URL in it (`400 Bad Request (POST\n     * https://idp.example.com/token)`), which must not reach the caller.\n     * `describeError` is what carries the detail, into the log only.\n     */\n    if (isClientError(input)) {\n        return new AuthupError({\n            code: ErrorCode.UPSTREAM_ERROR,\n            message: 'A request to an upstream service failed.',\n            stack: input.stack,\n        });\n    }\n\n    if (isHTTPError(input)) {\n        return new AuthupError({\n            code: codeFromHttpStatus(input.status),\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isObject(input)) {\n        const code = hasOwnProperty(input, 'code') &&\n        typeof input.code === 'string' ?\n            input.code :\n            undefined;\n\n        /**\n         * @see https://dev.mysql.com/doc/mysql-errors/8.0/en/server-error-reference.html\n         */\n        switch (code) {\n            case '23505':\n            case 'ER_DUP_ENTRY':\n            case 'SQLITE_CONSTRAINT_UNIQUE': {\n                return new AuthupError({\n                    code: ErrorCode.ENTITY_CONFLICT,\n                    message: 'An entry with some unique attributes already exists.',\n                    stack: input.stack as string | undefined,\n                });\n            }\n            case 'ER_DISK_FULL':\n                return new AuthupError({\n                    code: ErrorCode.STORAGE_INSUFFICIENT,\n                    message: 'No database operation possible, due to the lack of free disk space.',\n                    stack: input.stack as string | undefined,\n                });\n        }\n\n        return new AuthupError({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: input.message as string | undefined,\n            stack: input.stack as string | undefined,\n        });\n    }\n\n    return new AuthupError({ code: ErrorCode.INTERNAL_ERROR });\n}\n\nconst DESCRIBE_BODY_MAX_LENGTH = 1024;\nconst DESCRIBE_CAUSE_MAX_DEPTH = 5;\n\n// Fields node attaches to a syscall error. Without them a transport failure\n// reads as a bare \"connect ECONNREFUSED\" with no way back to the reason.\nconst DESCRIBE_CAUSE_KEYS = ['code', 'errno', 'syscall', 'address', 'port'] as const;\n\nfunction describeBody(input: unknown): string | undefined {\n    let value: string;\n\n    if (typeof input === 'string') {\n        value = input;\n    } else {\n        try {\n            value = JSON.stringify(input) ?? String(input);\n        } catch {\n            // A body that cannot be serialized (circular, a stream) is\n            // still worth naming by shape.\n            value = Object.prototype.toString.call(input);\n        }\n    }\n\n    if (value.length === 0) {\n        return undefined;\n    }\n\n    if (value.length > DESCRIBE_BODY_MAX_LENGTH) {\n        return `${value.substring(0, DESCRIBE_BODY_MAX_LENGTH)}… (truncated)`;\n    }\n\n    return value;\n}\n\nfunction describeCauseLink(input: object): string {\n    const error = input as Error;\n    const name = typeof error.name === 'string' ? error.name : 'Error';\n    const parts: string[] = [`${name}: ${error.message}`];\n\n    const details: string[] = [];\n    for (const key of DESCRIBE_CAUSE_KEYS) {\n        const value = (input as Record<string, unknown>)[key];\n        if (typeof value === 'string' || typeof value === 'number') {\n            details.push(`${key}=${value}`);\n        }\n    }\n\n    if (details.length > 0) {\n        parts.push(`(${details.join(' ')})`);\n    }\n\n    return parts.join(' ');\n}\n\nfunction describeCauseChain(input: unknown): string | undefined {\n    const links: string[] = [];\n    const seen = new Set<unknown>();\n\n    let current: unknown = isObject(input) ? (input as { cause?: unknown }).cause : undefined;\n\n    while (isObject(current) && !seen.has(current) && links.length < DESCRIBE_CAUSE_MAX_DEPTH) {\n        seen.add(current);\n        links.push(describeCauseLink(current));\n        current = (current as { cause?: unknown }).cause;\n    }\n\n    if (links.length === 0) {\n        return undefined;\n    }\n\n    return links.join(' <- ');\n}\n\n/**\n * Render an error for the LOG. It is the counterpart of `@authup/errors`'\n * `serializeError`, which renders one for the response.\n *\n * The detail an outbound failure carries never survives `sanitizeError`\n * (by design: upstream internals must not reach the caller), and\n * `Error.cause` is non-enumerable, so a plain serialization drops it too.\n * Both were therefore already gone by the time anything was written,\n * which left a refused connection and an upstream `invalid_request`\n * indistinguishable in the log.\n *\n * Everything not present is omitted, so an ordinary error still renders\n * as its bare message.\n */\nexport function describeError(input: unknown, headline?: string): string {\n    const error = normalizeError(input);\n\n    const lines: string[] = [];\n    if (headline) {\n        lines.push(headline);\n    }\n    lines.push(error.message);\n\n    // hapic attaches the decoded body to the response through a getter, so\n    // it is non-enumerable and only reachable by an explicit read.\n    if (isClientError(error) && error.response) {\n        lines.push(`  upstream status: ${error.response.status}`);\n\n        const body = describeBody(error.response.data);\n        if (body) {\n            lines.push(`  upstream body:   ${body}`);\n        }\n    }\n\n    const causes = describeCauseChain(error);\n    if (causes) {\n        lines.push(`  cause:           ${causes}`);\n    }\n\n    if (error.stack) {\n        lines.push(`  stack:           ${error.stack}`);\n    }\n\n    return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAoCA,SAAgBe,cAAcC,OAAc;CACxC,IAAIb,cAAca,KAAAA,GACd,OAAOA;CAGX,IAAIA,iBAAiBP,2BACjB,OAAO,IAAIT,YAAY;EACnBiB,MAAMhB,UAAUiB;EAChBC,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIT,eAAeK,KAAAA,GAAQ;EACvB,MAAMK,QAAQL,MAAMM,OAAOC,KAAKC,UAAUZ,cAAcY,MAAMC,IAAI,CAAA;EAClE,MAAMC,QAAQ,IAAI1B,YAAY;GAC1BiB,MAAMhB,UAAU0B;GAChBP,OAAOJ,MAAMI;GACbD,SAASH,MAAMG,WAAWT,+BAA+BW,KAAAA;EAC7D,CAAA;EAEAK,MAAMJ,OAAOM,KAAI,GAAIZ,MAAMM,MAAM;EACjC,OAAOI;CACX;CAEA,IAAIV,iBAAiBR,cAAcQ,iBAAiBT,YAChD,OAAO,IAAIP,YAAY;EACnBiB,MAAMhB,UAAU0B;EAChBR,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;;;;;;;;;;;;IAeJ,IAAId,cAAcU,KAAAA,GACd,OAAO,IAAIhB,YAAY;EACnBiB,MAAMhB,UAAU4B;EAChBV,SAAS;EACTC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIf,YAAYW,KAAAA,GACZ,OAAO,IAAIhB,YAAY;EACnBiB,MAAMf,mBAAmBc,MAAMc,MAAM;EACrCX,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIN,SAASE,KAAAA,GAAQ;;;KASjB,QARaH,eAAeG,OAAO,MAAA,KACnC,OAAOA,MAAMC,SAAS,WAClBD,MAAMC,OACNc,KAAAA,GAKJ;GACI,KAAK;GACL,KAAK;GACL,KAAK,4BACD,OAAO,IAAI/B,YAAY;IACnBiB,MAAMhB,UAAU+B;IAChBb,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;GAEJ,KAAK,gBACD,OAAO,IAAIpB,YAAY;IACnBiB,MAAMhB,UAAUgC;IAChBd,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;EACR;EAEA,OAAO,IAAIpB,YAAY;GACnBiB,MAAMhB,UAAUiC;GAChBf,SAASH,MAAMG;GACfC,OAAOJ,MAAMI;EACjB,CAAA;CACJ;CAEA,OAAO,IAAIpB,YAAY,EAAEiB,MAAMhB,UAAUiC,eAAe,CAAA;AAC5D;AAEA,MAAMC,2BAA2B;AACjC,MAAMC,2BAA2B;AAIjC,MAAMC,sBAAsB;CAAC;CAAQ;CAAS;CAAW;CAAW;AAAO;AAE3E,SAASC,aAAatB,OAAc;CAChC,IAAIuB;CAEJ,IAAI,OAAOvB,UAAU,UACjBuB,QAAQvB;MAER,IAAI;EACAuB,QAAQC,KAAKC,UAAUzB,KAAAA,KAAU0B,OAAO1B,KAAAA;CAC5C,QAAQ;EAGJuB,QAAQI,OAAOC,UAAUC,SAASC,KAAK9B,KAAAA;CAC3C;CAGJ,IAAIuB,MAAMQ,WAAW,GACjB;CAGJ,IAAIR,MAAMQ,SAASZ,0BACf,OAAO,GAAGI,MAAMS,UAAU,GAAGb,wBAAAA,EAA0B;CAG3D,OAAOI;AACX;AAEA,SAASU,kBAAkBjC,OAAa;CACpC,MAAMU,QAAQV;CAEd,MAAMmC,QAAkB,CAAC,GADZ,OAAOzB,MAAMwB,SAAS,WAAWxB,MAAMwB,OAAO,QAC1B,IAAIxB,MAAMP,SAAU;CAErD,MAAMiC,UAAoB,CAAA;CAC1B,KAAK,MAAMC,OAAOhB,qBAAqB;EACnC,MAAME,QAAQ,MAAmCc;EACjD,IAAI,OAAOd,UAAU,YAAY,OAAOA,UAAU,UAC9Ca,QAAQxB,KAAK,GAAGyB,IAAI,GAAGd,OAAO;CAEtC;CAEA,IAAIa,QAAQL,SAAS,GACjBI,MAAMvB,KAAK,IAAIwB,QAAQE,KAAK,GAAA,EAAK,EAAE;CAGvC,OAAOH,MAAMG,KAAK,GAAA;AACtB;AAEA,SAASC,mBAAmBvC,OAAc;CACtC,MAAMwC,QAAkB,CAAA;CACxB,MAAMC,uBAAO,IAAIC,IAAAA;CAEjB,IAAIC,UAAmB7C,SAASE,KAAAA,IAAS,MAA+B4C,QAAQ7B,KAAAA;CAEhF,OAAOjB,SAAS6C,OAAAA,KAAY,CAACF,KAAKI,IAAIF,OAAAA,KAAYH,MAAMT,SAASX,0BAA0B;EACvFqB,KAAKK,IAAIH,OAAAA;EACTH,MAAM5B,KAAKqB,kBAAkBU,OAAAA,CAAAA;EAC7BA,UAAU,QAAiCC;CAC/C;CAEA,IAAIJ,MAAMT,WAAW,GACjB;CAGJ,OAAOS,MAAMF,KAAK,MAAA;AACtB;;;;;;;;;;;;;;GAgBA,SAAgBS,cAAc/C,OAAgBgD,UAAiB;CAC3D,MAAMtC,QAAQtB,eAAeY,KAAAA;CAE7B,MAAMiD,QAAkB,CAAA;CACxB,IAAID,UACAC,MAAMrC,KAAKoC,QAAAA;CAEfC,MAAMrC,KAAKF,MAAMP,OAAO;CAIxB,IAAIb,cAAcoB,KAAAA,KAAUA,MAAMwC,UAAU;EACxCD,MAAMrC,KAAK,sBAAsBF,MAAMwC,SAASpC,QAAQ;EAExD,MAAMqC,OAAO7B,aAAaZ,MAAMwC,SAASE,IAAI;EAC7C,IAAID,MACAF,MAAMrC,KAAK,sBAAsBuC,MAAM;CAE/C;CAEA,MAAME,SAASd,mBAAmB7B,KAAAA;CAClC,IAAI2C,QACAJ,MAAMrC,KAAK,sBAAsByC,QAAQ;CAG7C,IAAI3C,MAAMN,OACN6C,MAAMrC,KAAK,sBAAsBF,MAAMN,OAAO;CAGlD,OAAO6C,MAAMX,KAAK,IAAA;AACtB"}

package/dist/utils/index.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { sanitizeError } from "./error.mjs";
+import { describeError, sanitizeError } from "./error.mjs";
 import { isSelfToken } from "./self-id.mjs";
 import { resolveURL } from "./url.mjs";
-export { isSelfToken, resolveURL, sanitizeError };
+export { describeError, isSelfToken, resolveURL, sanitizeError };

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/server-core",
     "type": "module",
-    "version": "1.0.0-beta.58",
+    "version": "1.0.0-beta.60",
     "description": "This is a standalone application.",
     "license": "AGPL-3.0-only",
     "main": "dist/index.mjs",
@@ -15,18 +15,17 @@
         "cli-dev": "npm run build:server && npm run cli",
         "cli-dev-src": "nodemon --watch src --exec \"npm run build:server && node dist/cli/index.mjs\"",
         "cli-dev-dist": "nodemon --watch dist --exec \"node dist/cli/index.mjs\"",
-        "build:ui:client": "vite build --config ui/vite.config.ts --ssrManifest .vite/ssr-manifest.json --outDir ../dist/ui/client ui",
-        "build:ui:server": "vite build --config ui/vite.config.ts --ssr src/server.ts --outDir ../dist/ui/server ui",
-        "build:ui": "npm run build:ui:server && npm run build:ui:client",
         "build:server:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
         "build:server:js": "tsdown",
         "build:server": "npm run build:server:js && npm run build:server:types && npm run build:swagger",
         "build:swagger": "trapi generate",
-        "build": "rimraf ./dist && npm run build:server && npm run build:ui",
+        "build": "rimraf ./dist && npm run build:server",
         "test": "cross-env NODE_ENV=test vitest run --config test/vitest.config.ts",
         "test:mysql": "cross-env DB_TYPE=mysql DB_HOST=127.0.0.1 DB_USERNAME=root DB_PASSWORD=start123 DB_DATABASE=app vitest run --config test/vitest.config.ts",
         "test:psql": "cross-env DB_TYPE=postgres DB_HOST=127.0.0.1 DB_USERNAME=postgres DB_PASSWORD=start123 DB_DATABASE=app vitest run --config test/vitest.config.ts",
         "test:coverage": "cross-env NODE_ENV=test vitest run --config test/vitest.config.ts --coverage",
+        "test:schema-drift": "node scripts/assert-schema-drift.mjs",
+        "test:migration-latest": "node scripts/verify-latest-migration.mjs",
         "check:types": "tsc -p tsconfig.test.json"
     },
     "engines": {
@@ -68,22 +67,24 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/access": "^1.0.0-beta.58",
-        "@authup/core-http-kit": "^1.0.0-beta.58",
-        "@authup/core-kit": "^1.0.0-beta.58",
-        "@authup/errors": "^1.0.0-beta.58",
-        "@authup/i18n": "^1.0.0-beta.58",
-        "@authup/kit": "^1.0.0-beta.58",
-        "@authup/server-kit": "^1.0.0-beta.58",
-        "@authup/specs": "^1.0.0-beta.58",
+        "@authup/access": "^1.0.0-beta.60",
+        "@authup/client-account-console": "^1.0.0-beta.60",
+        "@authup/client-auth-console": "^1.0.0-beta.60",
+        "@authup/core-http-kit": "^1.0.0-beta.60",
+        "@authup/core-kit": "^1.0.0-beta.60",
+        "@authup/errors": "^1.0.0-beta.60",
+        "@authup/i18n": "^1.0.0-beta.60",
+        "@authup/kit": "^1.0.0-beta.60",
+        "@authup/server-kit": "^1.0.0-beta.60",
+        "@authup/specs": "^1.0.0-beta.60",
         "@ebec/http": "^4.2.0",
         "@hapic/oauth2": "^4.0.1",
         "@peculiar/x509": "^2.0.0",
-        "@rapiq/adapter-memory": "^2.0.0-beta.13",
-        "@rapiq/adapter-sql": "^2.0.0-beta.13",
-        "@rapiq/adapter-typeorm": "^2.0.0-beta.13",
-        "@rapiq/codec-url": "^2.0.0-beta.13",
-        "@rapiq/core": "^2.0.0-beta.13",
+        "@rapiq/adapter-memory": "^2.1.0",
+        "@rapiq/adapter-sql": "^2.1.0",
+        "@rapiq/adapter-typeorm": "^2.1.0",
+        "@rapiq/codec-url": "^2.1.0",
+        "@rapiq/core": "^2.1.0",
         "@routup/assets": "^5.0.0",
         "@routup/basic": "^3.0.0",
         "@routup/cors": "^2.0.0",
@@ -108,7 +109,7 @@
         "locter": "^4.0.0",
         "mysql2": "^3.23.2",
         "node-cron": "^4.6.0",
-        "nodemailer": "^9.0.3",
+        "nodemailer": "^9.0.4",
         "orkos": "^1.1.1",
         "otpauth": "^9.5.1",
         "pg": "^8.22.0",
@@ -119,64 +120,27 @@
         "smob": "^1.6.1",
         "tsyringe": "^4.10.0",
         "typeorm": "1.1.0",
-        "typeorm-extension": "^4.0.0-beta.1",
+        "typeorm-extension": "^4.0.0-beta.3",
         "uncrypto": "^0.1.3",
         "validup": "^1.0.0",
         "zod": "^4.4.3"
     },
     "devDependencies": {
-        "@authup/client-web-kit": "^1.0.0-beta.58",
-        "@authup/client-web-kit-theme": "^1.0.0-beta.58",
-        "@authup/client-web-theme": "^1.0.0-beta.58",
-        "@authup/server-test-kit": "^1.0.0-beta.58",
+        "@authup/server-test-kit": "^1.0.0-beta.60",
         "@faker-js/faker": "^10.5.0",
-        "@fontsource/asap": "^5.3.0",
-        "@fontsource/nunito": "^5.3.0",
-        "@iconify-json/fa6-brands": "^1.2.0",
-        "@iconify-json/fa6-solid": "^1.2.0",
-        "@iconify/vue": "^5.0.0",
-        "@ilingo/validup": "^1.1.0",
-        "@ilingo/validup-vue": "^1.1.0",
-        "@ilingo/vue": "^6.1.0",
-        "@nuxt/icon": "^2.4.1",
-        "@tailwindcss/vite": "^4.3.3",
         "@trapi/cli": "^2.0.4",
         "@types/ldapjs": "^3.0.6",
         "@types/nodemailer": "^8.0.0",
         "@types/qrcode": "^1.5.6",
         "@types/supertest": "^7.2.1",
-        "@validup/vue": "^1.0.0",
-        "@vitejs/plugin-vue": "^6.0.8",
-        "@vuecs/button": "^1.4.0",
-        "@vuecs/core": "^3.5.0",
-        "@vuecs/countdown": "^2.1.0",
-        "@vuecs/design": "^1.1.0",
-        "@vuecs/elements": "^1.5.0",
-        "@vuecs/forms": "^5.4.0",
-        "@vuecs/icon": "^1.1.0",
-        "@vuecs/icons-font-awesome": "^1.3.0",
-        "@vuecs/link": "^2.1.0",
-        "@vuecs/list": "^1.2.0",
-        "@vuecs/locale": "^1.1.0",
-        "@vuecs/navigation": "^4.4.0",
-        "@vuecs/overlays": "^1.3.0",
-        "@vuecs/pagination": "^2.2.0",
-        "@vuecs/placeholder": "^1.1.0",
-        "@vuecs/table": "^1.6.0",
-        "@vuecs/theme-tailwind": "^6.4.0",
-        "@vuecs/timeago": "^2.2.0",
         "jest-serial-runner": "^1.2.1",
         "nodemon": "^3.1.14",
-        "pinia": "^3.0.0",
         "supertest": "^7.2.2",
-        "tailwindcss": "^4.3.1",
-        "testcontainers": "^12.0.4",
+        "testcontainers": "^12.1.0",
         "ts-node": "^10.8.2",
-        "unplugin-swc": "^1.5.9",
+        "unplugin-swc": "^1.5.10",
         "vite": "^8.1.3",
-        "vitest": "^4.0.14",
-        "vue": "^3.5.40",
-        "vue-router": "^5.0.7"
+        "vitest": "^4.0.14"
     },
     "publishConfig": {
         "access": "public"

package/dist/adapters/http/ui/base-path.d.ts

@@ -1,9 +0,0 @@
-/**
- * Rewrite root-absolute /public/ asset references (script/link/preload tags
- * emitted with the fixed vite base) so they carry the path prefix under which
- * authup is publicly served (e.g. /auth/public/...). The reverse proxy is
- * expected to strip the prefix before the request reaches authup, so the
- * assets middleware keeps serving at /public.
- */
-export declare function rebasePublicAssetURLs(html: string, basePath: string): string;
-//# sourceMappingURL=base-path.d.ts.map

package/dist/adapters/http/ui/base-path.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-path.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/base-path.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,MAAM,CAM7E"}

package/dist/adapters/http/ui/base-path.mjs

@@ -1,18 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-//#region src/adapters/http/ui/base-path.ts
-/**
-* Rewrite root-absolute /public/ asset references (script/link/preload tags
-* emitted with the fixed vite base) so they carry the path prefix under which
-* authup is publicly served (e.g. /auth/public/...). The reverse proxy is
-* expected to strip the prefix before the request reaches authup, so the
-* assets middleware keeps serving at /public.
-*/ function rebasePublicAssetURLs(html, basePath) {
-	if (!basePath) return html;
-	return html.replace(/(src|href)="\/public\//g, `$1="${basePath}/public/`);
-}
-//#endregion
-export { rebasePublicAssetURLs };
-
-//# sourceMappingURL=base-path.mjs.map

package/dist/adapters/http/ui/base-path.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-path.mjs","names":["rebasePublicAssetURLs","html","basePath","replace"],"sources":["../../../../src/adapters/http/ui/base-path.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Rewrite root-absolute /public/ asset references (script/link/preload tags\n * emitted with the fixed vite base) so they carry the path prefix under which\n * authup is publicly served (e.g. /auth/public/...). The reverse proxy is\n * expected to strip the prefix before the request reaches authup, so the\n * assets middleware keeps serving at /public.\n */\nexport function rebasePublicAssetURLs(html: string, basePath: string) : string {\n    if (!basePath) {\n        return html;\n    }\n\n    return html.replace(/(src|href)=\"\\/public\\//g, `$1=\"${basePath}/public/`);\n}\n"],"mappings":";;;;;;;;;;GAcA,SAAgBA,sBAAsBC,MAAcC,UAAgB;CAChE,IAAI,CAACA,UACD,OAAOD;CAGX,OAAOA,KAAKE,QAAQ,2BAA2B,OAAOD,SAAS,SAAS;AAC5E"}

package/dist/adapters/http/ui/internal-http-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"internal-http-client.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GACnB,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAmC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAOrF"}

package/dist/adapters/http/ui/internal-http-client.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"internal-http-client.mjs","names":["Client","FetchTransport","fetch","createPublicToInternalURLRewriter","publicURL","internalURL","publicParsed","URL","internalParsed","hostname","basePath","pathname","replace","url","parsed","origin","startsWith","substring","length","search","href","createInternalUIHttpClient","ctx","rewriteURL","baseURL","transport","input","init"],"sources":["../../../../src/adapters/http/ui/internal-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport type { IClient } from '@authup/core-http-kit';\nimport { FetchTransport, fetch } from 'hapic';\nimport type { InternalUIHttpClientContext } from './types.ts';\n\n/**\n * Build a rewriter that maps URLs under the public base URL\n * (scheme://host[/prefix]) onto the server's own listen address. URLs\n * outside the public origin/prefix pass through untouched.\n */\nexport function createPublicToInternalURLRewriter(\n    publicURL: string,\n    internalURL: string,\n) : (url: string) => string {\n    const publicParsed = new URL(publicURL);\n    const internalParsed = new URL(internalURL);\n    // a wildcard listen address (0.0.0.0 / [::]) is not reliably dialable —\n    // loop back explicitly\n    if (internalParsed.hostname === '0.0.0.0' || internalParsed.hostname === '[::]') {\n        internalParsed.hostname = '127.0.0.1';\n    }\n    const basePath = publicParsed.pathname.replace(/\\/+$/, '');\n\n    return (url: string) => {\n        let parsed : URL;\n        try {\n            parsed = new URL(url);\n        } catch {\n            return url;\n        }\n\n        if (parsed.origin !== publicParsed.origin) {\n            return url;\n        }\n\n        let { pathname } = parsed;\n        if (basePath) {\n            if (pathname === basePath) {\n                pathname = '/';\n            } else if (pathname.startsWith(`${basePath}/`)) {\n                pathname = pathname.substring(basePath.length);\n            } else {\n                return url;\n            }\n        }\n\n        return new URL(pathname + parsed.search, internalParsed.origin).href;\n    };\n}\n\n/**\n * HTTP client for the SSR'd UI pages: the render's API calls target the\n * server itself, so they are dispatched against its own listen address —\n * no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate\n * would otherwise fail Node's fetch), no dependency on the public hostname\n * resolving from inside the deployment.\n *\n * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the\n * public URL because the rendered HTML derives user-facing URLs from it\n * (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and\n * hydration does not patch attribute mismatches.\n */\nexport function createInternalUIHttpClient(ctx: InternalUIHttpClientContext) : IClient {\n    const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);\n\n    return new Client({\n        baseURL: ctx.publicURL,\n        transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) }),\n    });\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBG,kCACZC,WACAC,aAAmB;CAEnB,MAAMC,eAAe,IAAIC,IAAIH,SAAAA;CAC7B,MAAMI,iBAAiB,IAAID,IAAIF,WAAAA;CAG/B,IAAIG,eAAeC,aAAa,aAAaD,eAAeC,aAAa,QACrED,eAAeC,WAAW;CAE9B,MAAMC,WAAWJ,aAAaK,SAASC,QAAQ,QAAQ,EAAA;CAEvD,QAAQC,QAAAA;EACJ,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIP,IAAIM,GAAAA;EACrB,QAAQ;GACJ,OAAOA;EACX;EAEA,IAAIC,OAAOC,WAAWT,aAAaS,QAC/B,OAAOF;EAGX,IAAI,EAAEF,aAAaG;EACnB,IAAIJ,UACA,IAAIC,aAAaD,UACbC,WAAW;OACR,IAAIA,SAASK,WAAW,GAAGN,SAAS,EAAE,GACzCC,WAAWA,SAASM,UAAUP,SAASQ,MAAM;OAE7C,OAAOL;EAIf,OAAO,IAAIN,IAAII,WAAWG,OAAOK,QAAQX,eAAeO,MAAM,CAAA,CAAEK;CACpE;AACJ;;;;;;;;;;;;GAcA,SAAgBC,2BAA2BC,KAAgC;CACvE,MAAMC,aAAapB,kCAAkCmB,IAAIlB,WAAWkB,IAAIjB,WAAW;CAEnF,OAAO,IAAIL,OAAO;EACdwB,SAASF,IAAIlB;EACbqB,WAAW,IAAIxB,eAAe,EAAEC,QAAQwB,OAAOC,SAASzB,MAAMqB,WAAWG,KAAAA,GAAQC,IAAAA,EAAM,CAAA;CAC3F,CAAA;AACJ"}

package/dist/adapters/http/ui/render.d.ts

@@ -1,4 +0,0 @@
-import type { IAppEvent } from 'routup';
-import type { UIRenderContext } from './types.ts';
-export declare function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string>;
-//# sourceMappingURL=render.d.ts.map

package/dist/adapters/http/ui/render.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/render.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAQxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAYlD,wBAAsB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAqF1F"}

package/dist/adapters/http/ui/render.mjs

@@ -1,63 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { LOCALE_COOKIE } from "../request/helpers/locale.mjs";
-import { rebasePublicAssetURLs } from "./base-path.mjs";
-import { UI_DIST_PATH, UI_SOURCE_PATH } from "../../../path.mjs";
-import { VITE_SERVER_STORE_KEY } from "../middleware/built-in/assets.mjs";
-import { UI_HTTP_CLIENT_FACTORY_STORE_KEY } from "../middleware/built-in/ui-http-client.mjs";
-import "../middleware/index.mjs";
-import { getURLBasePath } from "@authup/kit";
-import path from "node:path";
-import { useRequestCookie } from "@routup/basic/cookie";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
-import { read } from "locter";
-import fs from "node:fs";
-//#region src/adapters/http/ui/render.ts
-const COLOR_MODE_COOKIE = "vc-color-mode";
-let cachedHtml;
-let cachedManifest;
-let cachedRender;
-async function renderUIPage(event, ctx) {
-	const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);
-	const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);
-	ctx.payload.config.colorMode = colorMode;
-	const locale = useRequestCookie(event, LOCALE_COOKIE);
-	ctx.payload.config.locale = locale;
-	let html;
-	let manifest;
-	let render;
-	if (isJIT) {
-		const vite = event.store[VITE_SERVER_STORE_KEY];
-		html = await fs.promises.readFile(path.join(UI_SOURCE_PATH, "index.html"), "utf-8");
-		html = await vite.transformIndexHtml("/", html);
-		manifest = {};
-		render = (await vite.ssrLoadModule("/src/server.ts")).render;
-	} else {
-		html = cachedHtml ??= await fs.promises.readFile(path.join(UI_DIST_PATH, "client", "index.html"), "utf-8");
-		manifest = cachedManifest ??= JSON.parse(await fs.promises.readFile(path.join(UI_DIST_PATH, "client", ".vite", "ssr-manifest.json"), "utf-8"));
-		render = cachedRender ??= (await read(path.join(UI_DIST_PATH, "server", "server.js"))).render;
-	}
-	const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY];
-	const [appHtml, preloadLinks] = await render({
-		url: ctx.url,
-		manifest,
-		payload: ctx.payload,
-		httpClient: httpClientFactory ? httpClientFactory() : void 0
-	});
-	let body = html.replace("<!--preload-links-->", preloadLinks).replace("<!--app-html-->", appHtml);
-	let htmlAttrs = "lang=\"en\"";
-	if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) htmlAttrs = `lang="${locale}"`;
-	if (colorMode === "dark" || colorMode === "light") htmlAttrs += ` class="${colorMode}"`;
-	body = body.replace(/<html\b[^>]*>/i, `<html ${htmlAttrs}>`);
-	body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));
-	event.response.headers.set("content-type", "text/html; charset=utf-8");
-	event.response.headers.set("content-security-policy", "frame-ancestors 'none'");
-	event.response.headers.set("x-frame-options", "DENY");
-	event.response.headers.set("referrer-policy", "no-referrer");
-	return body;
-}
-//#endregion
-export { renderUIPage };
-
-//# sourceMappingURL=render.mjs.map

package/dist/adapters/http/ui/render.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"render.mjs","names":["getURLBasePath","useRequestCookie","read","fs","path","CodeTransformation","isCodeTransformation","UI_DIST_PATH","UI_SOURCE_PATH","UI_HTTP_CLIENT_FACTORY_STORE_KEY","VITE_SERVER_STORE_KEY","LOCALE_COOKIE","rebasePublicAssetURLs","COLOR_MODE_COOKIE","cachedHtml","cachedManifest","cachedRender","renderUIPage","event","ctx","isJIT","JUST_IN_TIME","colorMode","payload","config","locale","html","manifest","render","vite","store","promises","readFile","join","transformIndexHtml","ssrLoadModule","JSON","parse","httpClientFactory","appHtml","preloadLinks","url","httpClient","undefined","body","replace","htmlAttrs","test","baseURL","response","headers","set"],"sources":["../../../../src/adapters/http/ui/render.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { IAppEvent } from 'routup';\nimport type { ViteDevServer } from 'vite';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport type { IClient } from '@authup/core-http-kit';\nimport { UI_DIST_PATH, UI_SOURCE_PATH } from '../../../path.ts';\nimport { UI_HTTP_CLIENT_FACTORY_STORE_KEY, VITE_SERVER_STORE_KEY } from '../middleware/index.ts';\nimport { LOCALE_COOKIE } from '../request/helpers/locale.ts';\nimport { rebasePublicAssetURLs } from './base-path.ts';\nimport type { UIRenderContext } from './types.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\n// Process-lifetime caches for the immutable production SSR assets. The dist\n// template, manifest and server bundle don't change after boot, so read them\n// once instead of per request (the auth/login routes are hot paths). The JIT\n// (dev) path deliberately re-reads so HMR keeps working.\nlet cachedHtml: string | undefined;\nlet cachedManifest: Record<string, any> | undefined;\nlet cachedRender: CallableFunction | undefined;\n\nexport async function renderUIPage(event: IAppEvent, ctx: UIRenderContext): Promise<string> {\n    const isJIT = isCodeTransformation(CodeTransformation.JUST_IN_TIME);\n\n    // Mirror @vuecs/nuxt's SSR plugins: resolve the cookies server-side so\n    // the HTML shell already carries the `.dark`/`.light` class and lang\n    // attribute (no flash) and the client app hydrates from the same values.\n    const colorMode = useRequestCookie(event, COLOR_MODE_COOKIE);\n    ctx.payload.config.colorMode = colorMode;\n\n    const locale = useRequestCookie(event, LOCALE_COOKIE);\n    ctx.payload.config.locale = locale;\n\n    let html : string;\n    let manifest : Record<string, any>;\n    let render : CallableFunction;\n\n    if (isJIT) {\n        const vite = event.store[VITE_SERVER_STORE_KEY] as ViteDevServer;\n\n        html = await fs.promises.readFile(\n            path.join(UI_SOURCE_PATH, 'index.html'),\n            'utf-8',\n        );\n        html = await vite.transformIndexHtml('/', html);\n        manifest = {};\n        render = (await vite.ssrLoadModule('/src/server.ts')).render;\n    } else {\n        html = (cachedHtml ??= await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', 'index.html'),\n            'utf-8',\n        ));\n        manifest = (cachedManifest ??= JSON.parse(await fs.promises.readFile(\n            path.join(UI_DIST_PATH, 'client', '.vite', 'ssr-manifest.json'),\n            'utf-8',\n        )));\n        render = (cachedRender ??= (await read(\n            path.join(UI_DIST_PATH, 'server', 'server.js'),\n        )).render);\n    }\n\n    const httpClientFactory = event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] as (() => IClient) | undefined;\n\n    const [appHtml, preloadLinks] = await render({\n        url: ctx.url,\n        manifest,\n        payload: ctx.payload,\n        httpClient: httpClientFactory ? httpClientFactory() : undefined,\n    });\n\n    let body = html\n        .replace('<!--preload-links-->', preloadLinks)\n        .replace('<!--app-html-->', appHtml);\n\n    let htmlAttrs = 'lang=\"en\"';\n    if (locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(locale)) {\n        htmlAttrs = `lang=\"${locale}\"`;\n    }\n    if (colorMode === 'dark' || colorMode === 'light') {\n        htmlAttrs += ` class=\"${colorMode}\"`;\n    }\n    // Match the opening <html> tag by pattern rather than an exact literal,\n    // so a reformatted tag / dev-mode transformIndexHtml rewrite still gets\n    // the lang + color-mode attributes (no silent FOUC).\n    body = body.replace(/<html\\b[^>]*>/i, `<html ${htmlAttrs}>`);\n\n    // When authup is publicly served under a sub-path (publicUrl carries a\n    // pathname, e.g. https://example.com/auth), the fixed /public/ vite base\n    // would bypass the proxy mapping — rebase asset URLs onto the prefix.\n    body = rebasePublicAssetURLs(body, getURLBasePath(ctx.payload.config.baseURL));\n\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n\n    // Clickjacking guard: the SSR auth pages (login, consent, realm-mismatch,\n    // logout) mutate state behind explicit clicks and hydrate the logged-in\n    // session from first-party cookies. Framing them would make click-gating\n    // defeatable via overlay attacks, so deny embedding entirely. (Iframe-based\n    // silent renew is therefore unsupported — auth state is JS-readable anyway.)\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n\n    // The auth pages' URLs routinely carry sensitive query params\n    // (id_token_hint, code, redirect, state) — never leak them via Referer.\n    event.response.headers.set('referrer-policy', 'no-referrer');\n\n    return body;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,MAAMa,oBAAoB;AAM1B,IAAIC;AACJ,IAAIC;AACJ,IAAIC;AAEJ,eAAsBC,aAAaC,OAAkBC,KAAoB;CACrE,MAAMC,QAAQd,qBAAqBD,mBAAmBgB,YAAY;CAKlE,MAAMC,YAAYrB,iBAAiBiB,OAAOL,iBAAAA;CAC1CM,IAAII,QAAQC,OAAOF,YAAYA;CAE/B,MAAMG,SAASxB,iBAAiBiB,OAAOP,aAAAA;CACvCQ,IAAII,QAAQC,OAAOC,SAASA;CAE5B,IAAIC;CACJ,IAAIC;CACJ,IAAIC;CAEJ,IAAIR,OAAO;EACP,MAAMS,OAAOX,MAAMY,MAAMpB;EAEzBgB,OAAO,MAAMvB,GAAG4B,SAASC,SACrB5B,KAAK6B,KAAKzB,gBAAgB,YAAA,GAC1B,OAAA;EAEJkB,OAAO,MAAMG,KAAKK,mBAAmB,KAAKR,IAAAA;EAC1CC,WAAW,CAAC;EACZC,UAAU,MAAMC,KAAKM,cAAc,gBAAA,EAAA,CAAmBP;CAC1D,OAAO;EACHF,OAAQZ,eAAe,MAAMX,GAAG4B,SAASC,SACrC5B,KAAK6B,KAAK1B,cAAc,UAAU,YAAA,GAClC,OAAA;EAEJoB,WAAYZ,mBAAmBqB,KAAKC,MAAM,MAAMlC,GAAG4B,SAASC,SACxD5B,KAAK6B,KAAK1B,cAAc,UAAU,SAAS,mBAAA,GAC3C,OAAA,CAAA;EAEJqB,SAAUZ,kBAAkB,MAAMd,KAC9BE,KAAK6B,KAAK1B,cAAc,UAAU,WAAA,CAAA,EAAA,CACnCqB;CACP;CAEA,MAAMU,oBAAoBpB,MAAMY,MAAMrB;CAEtC,MAAM,CAAC8B,SAASC,gBAAgB,MAAMZ,OAAO;EACzCa,KAAKtB,IAAIsB;EACTd;EACAJ,SAASJ,IAAII;EACbmB,YAAYJ,oBAAoBA,kBAAAA,IAAsBK,KAAAA;CAC1D,CAAA;CAEA,IAAIC,OAAOlB,KACNmB,QAAQ,wBAAwBL,YAAAA,CAAAA,CAChCK,QAAQ,mBAAmBN,OAAAA;CAEhC,IAAIO,YAAY;CAChB,IAAIrB,UAAU,kCAAkCsB,KAAKtB,MAAAA,GACjDqB,YAAY,SAASrB,OAAO;CAEhC,IAAIH,cAAc,UAAUA,cAAc,SACtCwB,aAAa,WAAWxB,UAAU;CAKtCsB,OAAOA,KAAKC,QAAQ,kBAAkB,SAASC,UAAU,EAAE;CAK3DF,OAAOhC,sBAAsBgC,MAAM5C,eAAemB,IAAII,QAAQC,OAAOwB,OAAO,CAAA;CAE5E9B,MAAM+B,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAO3CjC,MAAM+B,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAI9CjC,MAAM+B,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAE9C,OAAOP;AACX"}

package/dist/adapters/http/ui/serve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IAIjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/adapters/http/ui/serve.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve.mjs","names":["useRequestQuery","sanitizeRelativeRedirect","renderUIPage","serveWorkflowPage","event","options","query","data","features","redirect","realmAware","realmId","realm_id","undefined","tokenAware","token","url","payload","config","baseURL"],"sources":["../../../../src/adapters/http/ui/serve.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sanitizeRelativeRedirect } from '../request/index.ts';\nimport { renderUIPage } from './render.ts';\n\nexport type ServeWorkflowPageOptions = {\n    url: string,\n    baseURL: string,\n    features: StatusResponseFeatures,\n    // Whether the page consumes the `realmId` (legacy `realm_id`) / `token`\n    // query params (e.g. prefill from an email deep link). Off by default so\n    // a page never reflects a param it doesn't use.\n    realmAware?: boolean,\n    tokenAware?: boolean,\n};\n\n/**\n * Single SSR payload-assembly path for the auth workflow GET routes:\n * whitelists query params, applies the open-redirect guard, and renders.\n * Keeps the four workflow controllers as thin POST adapters.\n */\nexport function serveWorkflowPage(\n    event: IAppEvent,\n    options: ServeWorkflowPageOptions,\n): Promise<string> {\n    const query = useRequestQuery(event);\n\n    const data: Record<string, any> = {\n        features: options.features,\n        redirect: sanitizeRelativeRedirect(query.redirect),\n    };\n\n    if (options.realmAware) {\n        const realmId = typeof query.realmId === 'string' ? query.realmId : query.realm_id;\n        data.realmId = typeof realmId === 'string' ? realmId : undefined;\n    }\n\n    if (options.tokenAware) {\n        data.token = typeof query.token === 'string' ? query.token : undefined;\n    }\n\n    return renderUIPage(event, {\n        url: options.url,\n        payload: {\n            config: { baseURL: options.baseURL },\n            data,\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;GA6BA,SAAgBG,kBACZC,OACAC,SAAiC;CAEjC,MAAMC,QAAQN,gBAAgBI,KAAAA;CAE9B,MAAMG,OAA4B;EAC9BC,UAAUH,QAAQG;EAClBC,UAAUR,yBAAyBK,MAAMG,QAAQ;CACrD;CAEA,IAAIJ,QAAQK,YAAY;EACpB,MAAMC,UAAU,OAAOL,MAAMK,YAAY,WAAWL,MAAMK,UAAUL,MAAMM;EAC1EL,KAAKI,UAAU,OAAOA,YAAY,WAAWA,UAAUE,KAAAA;CAC3D;CAEA,IAAIR,QAAQS,YACRP,KAAKQ,QAAQ,OAAOT,MAAMS,UAAU,WAAWT,MAAMS,QAAQF,KAAAA;CAGjE,OAAOX,aAAaE,OAAO;EACvBY,KAAKX,QAAQW;EACbC,SAAS;GACLC,QAAQ,EAAEC,SAASd,QAAQc,QAAQ;GACnCZ;EACJ;CACJ,CAAA;AACJ"}

package/dist/adapters/http/ui/types.d.ts

@@ -1,20 +0,0 @@
-export type UIRenderContext = {
-    url: string;
-    payload: {
-        config: Record<string, any>;
-        data: Record<string, any>;
-    };
-};
-export type InternalUIHttpClientContext = {
-    /**
-     * The public base URL (config `publicUrl`) — stays the client's
-     * `baseURL` so URLs rendered into the HTML remain user-facing.
-     */
-    publicURL: string;
-    /**
-     * The server's own listen address (e.g. http://localhost:3010/) —
-     * where the transport actually dispatches requests.
-     */
-    internalURL: string;
-};
-//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KAC7B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/app/modules/identity/repositories/provider/account/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/app/modules/identity/repositories/provider/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}

package/dist/app/modules/identity/repositories/provider/account/index.mjs

@@ -1,5 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { IdentityProviderAccountRepository } from "./module.mjs";
-export { IdentityProviderAccountRepository };

package/dist/app/modules/identity/repositories/provider/account/module.d.ts

@@ -1,10 +0,0 @@
-import type { IdentityProviderAccount } from '@authup/core-kit';
-import type { DataSource, DeepPartial } from 'typeorm';
-import type { IIdentityProviderAccountRepository, IdentityProviderIdentity } from '../../../../../../core/index.ts';
-export declare class IdentityProviderAccountRepository implements IIdentityProviderAccountRepository {
-    protected dataSource: DataSource;
-    constructor(dataSource: DataSource);
-    findOneByProviderIdentity(identity: IdentityProviderIdentity): Promise<IdentityProviderAccount | null>;
-    save(entity: DeepPartial<IdentityProviderAccount>): Promise<IdentityProviderAccount>;
-}
-//# sourceMappingURL=module.d.ts.map

package/dist/app/modules/identity/repositories/provider/account/module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../../src/app/modules/identity/repositories/provider/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,kCAAkC,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGpH,qBAAa,iCAAkC,YAAW,kCAAkC;IACxF,SAAS,CAAC,UAAU,EAAG,UAAU,CAAC;gBAEtB,UAAU,EAAE,UAAU;IAI5B,yBAAyB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAYtG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAK7F"}