@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/http/ui/console-packages/module.mjs

@@ -1,70 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { resolveAuthConsoleDistPath, setAuthConsolePackagePath } from "../auth-console/resolve.mjs";
-import "../auth-console/index.mjs";
-import { resolveAccountConsoleDistPath, setAccountConsolePackagePath } from "../account-console/module.mjs";
-import "../account-console/index.mjs";
-import { AuthupError, normalizeError } from "@authup/errors";
-import path from "node:path";
-import { read } from "locter";
-import fs from "node:fs";
-//#region src/adapters/http/ui/console-packages/module.ts
-/**
-* The render-contract version server-core compiles against. Must match the
-* `CONTRACT_VERSION` the auth console bundle exports.
-*
-* Bump alongside `apps/client-auth-console/src/contract.ts` whenever a
-* change breaks a package built against the previous shape.
-*/ const AUTH_CONSOLE_CONTRACT_VERSION = 2;
-/**
-* The marker the account console's index.html must carry. It is that
-* console's entire runtime contract: without it the injected
-* `window.__AUTHUP__` never lands and the SPA silently falls back to
-* deriving its API URL from the origin.
-*/ const ACCOUNT_CONSOLE_CONFIG_MARKER = "<!--account-config-->";
-/**
-* Bind the substituted console packages and verify they still fulfill the
-* contracts, before the first request rather than per render.
-*
-* Only runs for a package the operator actually substituted. With the
-* default resolution the console packages ship from this repo with linked
-* versions, so the assert would compare a constant against itself, and
-* loading the SSR bundle at boot would turn a missing build into a failed
-* start instead of an actionable error on the page.
-*
-* Fail-closed on a mismatch: the operator replaced the login and consent
-* IMPLEMENTATION (the prompt ladder, PKCE and state handling, MFA
-* ordering, redirect gating), so a contract drift must stop the container
-* rather than render subtly wrong auth pages.
-*/ async function bindConsolePackages(options = {}) {
-	setAuthConsolePackagePath(options.authConsolePath);
-	setAccountConsolePackagePath(options.accountConsolePath);
-	if (options.authConsolePath) await assertAuthConsoleContract(options.authConsolePath);
-	if (options.accountConsolePath) assertAccountConsoleContract(options.accountConsolePath);
-}
-async function assertAuthConsoleContract(packagePath) {
-	const distPath = resolveAuthConsoleDistPath();
-	if (!distPath) throw new AuthupError(`The auth console package at "${packagePath}" carries no built bundle (expected dist/client/index.html).`);
-	const entry = path.join(distPath, "server", "server.js");
-	let module;
-	try {
-		module = await read(entry);
-	} catch (e) {
-		const reason = normalizeError(e).message;
-		throw new AuthupError(`The auth console render entry "${entry}" could not be loaded.\n  ${reason}`);
-	}
-	if (typeof module.render !== "function") throw new AuthupError(`The auth console bundle "${entry}" does not export a render() function.`);
-	const version = typeof module.CONTRACT_VERSION === "undefined" ? 1 : module.CONTRACT_VERSION;
-	if (version !== 2) throw new AuthupError(`The auth console package at "${packagePath}" implements render-contract version ${version}, but this authup requires 2. Rebuild it against the current @authup/client-auth-console contract.`);
-}
-function assertAccountConsoleContract(packagePath) {
-	const distPath = resolveAccountConsoleDistPath();
-	if (!distPath) throw new AuthupError(`The account console package at "${packagePath}" carries no built bundle (expected dist/index.html).`);
-	const entry = path.join(distPath, "index.html");
-	if (!fs.readFileSync(entry, "utf-8").includes("<!--account-config-->")) throw new AuthupError(`The account console shell "${entry}" carries no ${ACCOUNT_CONSOLE_CONFIG_MARKER} marker, so its runtime configuration cannot be injected.`);
-}
-//#endregion
-export { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages };
-
-//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/ui/console-packages/module.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.mjs","names":["AuthupError","normalizeError","read","fs","path","resolveAccountConsoleDistPath","setAccountConsolePackagePath","resolveAuthConsoleDistPath","setAuthConsolePackagePath","AUTH_CONSOLE_CONTRACT_VERSION","AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC","ACCOUNT_CONSOLE_CONFIG_MARKER","bindConsolePackages","options","authConsolePath","accountConsolePath","assertAuthConsoleContract","assertAccountConsoleContract","packagePath","distPath","entry","join","module","e","reason","message","render","version","CONTRACT_VERSION","html","readFileSync","includes"],"sources":["../../../../../src/adapters/http/ui/console-packages/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, normalizeError } from '@authup/errors';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport {\n    resolveAccountConsoleDistPath,\n    setAccountConsolePackagePath,\n} from '../account-console/index.ts';\nimport { resolveAuthConsoleDistPath, setAuthConsolePackagePath } from '../auth-console/index.ts';\n// Type position only (see AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC below), so\n// the runtime stays a dist-file read and the layering rule holds.\nimport type { CONTRACT_VERSION as AuthConsoleContractVersion } from '@authup/client-auth-console';\nimport type { ConsolePackageOptions } from './types.ts';\n\n/**\n * The render-contract version server-core compiles against. Must match the\n * `CONTRACT_VERSION` the auth console bundle exports.\n *\n * Bump alongside `apps/client-auth-console/src/contract.ts` whenever a\n * change breaks a package built against the previous shape.\n */\nexport const AUTH_CONSOLE_CONTRACT_VERSION = 2;\n\n/**\n * Compile-time link to the value this constant mirrors.\n *\n * The runtime assert below only fires for a SUBSTITUTED package, so a bump\n * on one side and not the other would otherwise go unnoticed until a\n * substituted console failed at boot in someone else's deployment. The\n * annotation costs nothing at runtime (types are erased) and fails this\n * package's build the moment the two drift.\n */\ntype AuthConsoleContractVersionInSync =    typeof AuthConsoleContractVersion extends typeof AUTH_CONSOLE_CONTRACT_VERSION ?\n    true :\n    never;\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nconst AUTH_CONSOLE_CONTRACT_VERSION_IN_SYNC : AuthConsoleContractVersionInSync = true;\n\n/**\n * The marker the account console's index.html must carry. It is that\n * console's entire runtime contract: without it the injected\n * `window.__AUTHUP__` never lands and the SPA silently falls back to\n * deriving its API URL from the origin.\n */\nexport const ACCOUNT_CONSOLE_CONFIG_MARKER = '<!--account-config-->';\n\n/**\n * Bind the substituted console packages and verify they still fulfill the\n * contracts, before the first request rather than per render.\n *\n * Only runs for a package the operator actually substituted. With the\n * default resolution the console packages ship from this repo with linked\n * versions, so the assert would compare a constant against itself, and\n * loading the SSR bundle at boot would turn a missing build into a failed\n * start instead of an actionable error on the page.\n *\n * Fail-closed on a mismatch: the operator replaced the login and consent\n * IMPLEMENTATION (the prompt ladder, PKCE and state handling, MFA\n * ordering, redirect gating), so a contract drift must stop the container\n * rather than render subtly wrong auth pages.\n */\nexport async function bindConsolePackages(options: ConsolePackageOptions = {}) : Promise<void> {\n    setAuthConsolePackagePath(options.authConsolePath);\n    setAccountConsolePackagePath(options.accountConsolePath);\n\n    if (options.authConsolePath) {\n        await assertAuthConsoleContract(options.authConsolePath);\n    }\n\n    if (options.accountConsolePath) {\n        assertAccountConsoleContract(options.accountConsolePath);\n    }\n}\n\nasync function assertAuthConsoleContract(packagePath: string) : Promise<void> {\n    const distPath = resolveAuthConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" carries no built bundle (expected dist/client/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'server', 'server.js');\n\n    let module : Record<string, any>;\n    try {\n        module = await read(entry) as Record<string, any>;\n    } catch (e) {\n        const reason = normalizeError(e).message;\n\n        throw new AuthupError(`The auth console render entry \"${entry}\" could not be loaded.\\n  ${reason}`);\n    }\n\n    if (typeof module.render !== 'function') {\n        throw new AuthupError(`The auth console bundle \"${entry}\" does not export a render() function.`);\n    }\n\n    // A bundle predating the export counts as version 1, the shape every\n    // package built before the constant existed implements.\n    const version = typeof module.CONTRACT_VERSION === 'undefined' ?\n        1 :\n        module.CONTRACT_VERSION;\n\n    if (version !== AUTH_CONSOLE_CONTRACT_VERSION) {\n        throw new AuthupError(\n            `The auth console package at \"${packagePath}\" implements render-contract version ${version}, but this authup requires ${AUTH_CONSOLE_CONTRACT_VERSION}. Rebuild it against the current @authup/client-auth-console contract.`,\n        );\n    }\n}\n\nfunction assertAccountConsoleContract(packagePath: string) : void {\n    const distPath = resolveAccountConsoleDistPath();\n    if (!distPath) {\n        throw new AuthupError(\n            `The account console package at \"${packagePath}\" carries no built bundle (expected dist/index.html).`,\n        );\n    }\n\n    const entry = path.join(distPath, 'index.html');\n    const html = fs.readFileSync(entry, 'utf-8');\n\n    if (!html.includes(ACCOUNT_CONSOLE_CONFIG_MARKER)) {\n        throw new AuthupError(\n            `The account console shell \"${entry}\" carries no ${ACCOUNT_CONSOLE_CONFIG_MARKER} marker, so its runtime configuration cannot be injected.`,\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;GA4BA,MAAaS,gCAAgC;;;;;;GAuB7C,MAAaE,gCAAgC;;;;;;;;;;;;;;;GAiB7C,eAAsBC,oBAAoBC,UAAiC,CAAC,GAAC;CACzEL,0BAA0BK,QAAQC,eAAe;CACjDR,6BAA6BO,QAAQE,kBAAkB;CAEvD,IAAIF,QAAQC,iBACR,MAAME,0BAA0BH,QAAQC,eAAe;CAG3D,IAAID,QAAQE,oBACRE,6BAA6BJ,QAAQE,kBAAkB;AAE/D;AAEA,eAAeC,0BAA0BE,aAAmB;CACxD,MAAMC,WAAWZ,2BAAAA;CACjB,IAAI,CAACY,UACD,MAAM,IAAInB,YACN,gCAAgCkB,YAAY,6DAA6D;CAIjH,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,UAAU,WAAA;CAE5C,IAAIG;CACJ,IAAI;EACAA,SAAS,MAAMpB,KAAKkB,KAAAA;CACxB,SAASG,GAAG;EACR,MAAMC,SAASvB,eAAesB,CAAAA,CAAAA,CAAGE;EAEjC,MAAM,IAAIzB,YAAY,kCAAkCoB,MAAM,4BAA4BI,QAAQ;CACtG;CAEA,IAAI,OAAOF,OAAOI,WAAW,YACzB,MAAM,IAAI1B,YAAY,4BAA4BoB,MAAM,uCAAuC;CAKnG,MAAMO,UAAU,OAAOL,OAAOM,qBAAqB,cAC/C,IACAN,OAAOM;CAEX,IAAID,YAAAA,GACA,MAAM,IAAI3B,YACN,gCAAgCkB,YAAY,uCAAuCS,QAAQ,mGAAkI;AAGzO;AAEA,SAASV,6BAA6BC,aAAmB;CACrD,MAAMC,WAAWd,8BAAAA;CACjB,IAAI,CAACc,UACD,MAAM,IAAInB,YACN,mCAAmCkB,YAAY,sDAAsD;CAI7G,MAAME,QAAQhB,KAAKiB,KAAKF,UAAU,YAAA;CAGlC,IAAI,CAFShB,GAAG2B,aAAaV,OAAO,OAE/BS,CAAAA,CAAKE,SAAAA,uBAASpB,GACf,MAAM,IAAIX,YACN,8BAA8BoB,MAAM,eAAeT,8BAA8B,0DAA0D;AAGvJ"}

package/dist/adapters/http/ui/console-packages/types.d.ts

@@ -1,12 +0,0 @@
-export type ConsolePackageOptions = {
-    /**
-     * Package directory of a substituted @authup/client-auth-console.
-     * Empty resolves the packaged one from node_modules.
-     */
-    authConsolePath?: string;
-    /**
-     * Package directory of a substituted @authup/client-account-console.
-     */
-    accountConsolePath?: string;
-};
-//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/console-packages/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/console-packages/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,qBAAqB,GAAG;IAChC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC"}

package/dist/adapters/http/ui/index.d.ts

@@ -1,6 +0,0 @@
-export * from './account-console/index.ts';
-export * from './auth-console/index.ts';
-export * from './console-packages/index.ts';
-export * from './shared/index.ts';
-export * from './theme/index.ts';
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/ui/index.ts"],"names":[],"mappings":"AAOA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC"}

package/dist/adapters/http/ui/index.mjs

@@ -1,25 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { createInternalUIHttpClient, createPublicToInternalURLRewriter } from "./auth-console/http-client.mjs";
-import { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes } from "./shared/html.mjs";
-import "./shared/index.mjs";
-import { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH } from "./theme/contract/constants.mjs";
-import { buildThemeHead, escapeHtml } from "./theme/contract/head.mjs";
-import { themeAssetExtension } from "./theme/contract/utils.mjs";
-import { ThemeManifestValidator, parseThemeManifest } from "./theme/contract/manifest.mjs";
-import { applyTheme } from "./theme/apply.mjs";
-import { THEME_ASSET_CSP, THEME_MANIFEST_REVALIDATE_INTERVAL } from "./theme/constants.mjs";
-import { createThemeAssetsHandler } from "./theme/assets.mjs";
-import { ThemeProvider } from "./theme/module.mjs";
-import "./theme/index.mjs";
-import { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, setAuthConsolePackagePath } from "./auth-console/resolve.mjs";
-import { renderAuthConsolePage } from "./auth-console/module.mjs";
-import { serveWorkflowPage } from "./auth-console/serve.mjs";
-import "./auth-console/index.mjs";
-import { ACCOUNT_CONSOLE_REF_MAX_LENGTH, resolveAccountConsoleRef } from "./account-console/ref.mjs";
-import { resolveAccountConsoleDistPath, serveAccountConsolePage, setAccountConsolePackagePath } from "./account-console/module.mjs";
-import "./account-console/index.mjs";
-import { ACCOUNT_CONSOLE_CONFIG_MARKER, AUTH_CONSOLE_CONTRACT_VERSION, bindConsolePackages } from "./console-packages/module.mjs";
-import "./console-packages/index.mjs";
-export { ACCOUNT_CONSOLE_CONFIG_MARKER, ACCOUNT_CONSOLE_REF_MAX_LENGTH, AUTH_CONSOLE_CONTRACT_VERSION, THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_CSP, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_REVALIDATE_INTERVAL, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH, ThemeManifestValidator, ThemeProvider, applyTheme, applyUIPageHeaders, bindConsolePackages, buildThemeHead, createInternalUIHttpClient, createPublicToInternalURLRewriter, createThemeAssetsHandler, escapeHtml, injectHeadContent, parseThemeManifest, readUIClientPreferences, rebaseAssetURLs, renderAuthConsolePage, replaceTemplateMarker, resolveAccountConsoleDistPath, resolveAccountConsoleRef, resolveAuthConsoleDistPath, resolveAuthConsolePackagePath, serializeInlineScriptJSON, serveAccountConsolePage, serveWorkflowPage, setAccountConsolePackagePath, setAuthConsolePackagePath, stampDocumentTitle, stampHtmlAttributes, themeAssetExtension };

package/dist/adapters/http/ui/shared/html.d.ts

@@ -1,76 +0,0 @@
-import type { IAppEvent } from 'routup';
-export type UIClientPreferences = {
-    locale?: string;
-    colorMode?: string;
-};
-/**
- * Mirror @vuecs/nuxt's SSR plugins: resolve the shared cookies server-side
- * so the HTML shell already carries the `.dark`/`.light` class and lang
- * attribute (no flash) and the client app hydrates from the same values.
- * The cookies are shared between every console on the origin.
- */
-export declare function readUIClientPreferences(event: IAppEvent): UIClientPreferences;
-/**
- * Stamp the resolved preferences onto the opening `<html>` tag. Matched by
- * pattern rather than an exact literal, so a reformatted tag / dev-mode
- * transformIndexHtml rewrite still gets the lang + color-mode attributes
- * (no silent FOUC).
- */
-export declare function stampHtmlAttributes(html: string, preferences: UIClientPreferences): string;
-/**
- * Replace a template marker (`<!--app-html-->`, `<!--account-config-->`, ...)
- * with a rendered value.
- *
- * The replacement is passed as a FUNCTION on purpose. A string replacement
- * expands the `$&`, `` $` ``, `$'` and `$$` patterns, so a `$'` anywhere in
- * the value splices the template's own text back into the page. The values
- * spliced here carry raw request input (the SSR hydration payload reflects
- * query parameters), which made `?token=$'` return a page whose inline
- * payload script was no longer valid JavaScript. Escaping cannot prevent
- * this: the expansion happens after the value was built.
- */
-export declare function replaceTemplateMarker(html: string, marker: string, value: string): string;
-/**
- * Insert markup immediately before `</head>`.
- *
- * Deliberately not a template marker: injecting at the closing tag works
- * against console bundles that were built BEFORE this feature existed, so
- * server-core never silently loses theming when it runs against an older
- * console package. A shell without a `</head>` is returned unchanged.
- *
- * Function-replacement form for the same reason as replaceTemplateMarker.
- */
-export declare function injectHeadContent(html: string, content: string): string;
-/**
- * Replace the document title. The value must already be HTML-escaped by
- * the caller; matched by pattern so a reformatted tag still hits.
- */
-export declare function stampDocumentTitle(html: string, title: string): string;
-/**
- * Response headers every served console page shares.
- *
- * Clickjacking guard: the pages mutate state behind explicit clicks and
- * hydrate first-party session state, so framing them would make
- * click-gating defeatable via overlay attacks — deny embedding entirely
- * (iframe-based silent renew is therefore unsupported). The URLs routinely
- * carry sensitive query params (id_token_hint, code, redirect, state) —
- * never leak them via Referer.
- */
-export declare function applyUIPageHeaders(event: IAppEvent): void;
-/**
- * Rewrite root-absolute asset references (script/link/preload tags emitted
- * with a fixed vite base, e.g. /public/ or /account/) so they carry the
- * path prefix under which authup is publicly served (e.g. /auth/public/...).
- * The reverse proxy is expected to strip the prefix before the request
- * reaches authup, so the assets middleware keeps serving at the fixed base.
- */
-export declare function rebaseAssetURLs(html: string, basePath: string, viteBase: string): string;
-/**
- * Escape characters that would otherwise let a value break out of an inline
- * `<script>` context (`</script>`) or terminate the JS string literal via
- * the U+2028/U+2029 line separators. Every window-global config/payload a
- * console page inlines must pass through this — never rely on the VALUES
- * staying benign.
- */
-export declare function serializeInlineScriptJSON(value: unknown): string;
-//# sourceMappingURL=html.d.ts.map

package/dist/adapters/http/ui/shared/html.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/shared/html.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAKxC,MAAM,MAAM,mBAAmB,GAAG;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,GAAI,mBAAmB,CAK9E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,mBAAmB,GAAI,MAAM,CAU3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAI,MAAM,CAE1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAI,MAAM,CAWxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAI,MAAM,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAI,IAAI,CAW1D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAI,MAAM,CASzF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAI,MAAM,CAMjE"}

package/dist/adapters/http/ui/shared/html.mjs

@@ -1,104 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { LOCALE_COOKIE } from "../../request/helpers/locale.mjs";
-import { useRequestCookie } from "@routup/basic/cookie";
-//#region src/adapters/http/ui/shared/html.ts
-const COLOR_MODE_COOKIE = "vc-color-mode";
-/**
-* Mirror @vuecs/nuxt's SSR plugins: resolve the shared cookies server-side
-* so the HTML shell already carries the `.dark`/`.light` class and lang
-* attribute (no flash) and the client app hydrates from the same values.
-* The cookies are shared between every console on the origin.
-*/ function readUIClientPreferences(event) {
-	return {
-		locale: useRequestCookie(event, LOCALE_COOKIE),
-		colorMode: useRequestCookie(event, COLOR_MODE_COOKIE)
-	};
-}
-/**
-* Stamp the resolved preferences onto the opening `<html>` tag. Matched by
-* pattern rather than an exact literal, so a reformatted tag / dev-mode
-* transformIndexHtml rewrite still gets the lang + color-mode attributes
-* (no silent FOUC).
-*/ function stampHtmlAttributes(html, preferences) {
-	let htmlAttrs = "lang=\"en\"";
-	if (preferences.locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(preferences.locale)) htmlAttrs = `lang="${preferences.locale}"`;
-	if (preferences.colorMode === "dark" || preferences.colorMode === "light") htmlAttrs += ` class="${preferences.colorMode}"`;
-	return html.replace(/<html\b[^>]*>/i, () => `<html ${htmlAttrs}>`);
-}
-/**
-* Replace a template marker (`<!--app-html-->`, `<!--account-config-->`, ...)
-* with a rendered value.
-*
-* The replacement is passed as a FUNCTION on purpose. A string replacement
-* expands the `$&`, `` $` ``, `$'` and `$$` patterns, so a `$'` anywhere in
-* the value splices the template's own text back into the page. The values
-* spliced here carry raw request input (the SSR hydration payload reflects
-* query parameters), which made `?token=$'` return a page whose inline
-* payload script was no longer valid JavaScript. Escaping cannot prevent
-* this: the expansion happens after the value was built.
-*/ function replaceTemplateMarker(html, marker, value) {
-	return html.replace(marker, () => value);
-}
-/**
-* Insert markup immediately before `</head>`.
-*
-* Deliberately not a template marker: injecting at the closing tag works
-* against console bundles that were built BEFORE this feature existed, so
-* server-core never silently loses theming when it runs against an older
-* console package. A shell without a `</head>` is returned unchanged.
-*
-* Function-replacement form for the same reason as replaceTemplateMarker.
-*/ function injectHeadContent(html, content) {
-	if (!content) return html;
-	const index = html.toLowerCase().indexOf("</head>");
-	if (index === -1) return html;
-	return html.slice(0, index) + content + html.slice(index);
-}
-/**
-* Replace the document title. The value must already be HTML-escaped by
-* the caller; matched by pattern so a reformatted tag still hits.
-*/ function stampDocumentTitle(html, title) {
-	return html.replace(/<title\b[^>]*>[\s\S]*?<\/title>/i, () => `<title>${title}</title>`);
-}
-/**
-* Response headers every served console page shares.
-*
-* Clickjacking guard: the pages mutate state behind explicit clicks and
-* hydrate first-party session state, so framing them would make
-* click-gating defeatable via overlay attacks — deny embedding entirely
-* (iframe-based silent renew is therefore unsupported). The URLs routinely
-* carry sensitive query params (id_token_hint, code, redirect, state) —
-* never leak them via Referer.
-*/ function applyUIPageHeaders(event) {
-	event.response.headers.set("content-type", "text/html; charset=utf-8");
-	event.response.headers.set("vary", "cookie");
-	event.response.headers.set("content-security-policy", "frame-ancestors 'none'");
-	event.response.headers.set("x-frame-options", "DENY");
-	event.response.headers.set("referrer-policy", "no-referrer");
-	event.response.headers.set("cache-control", "no-store");
-}
-/**
-* Rewrite root-absolute asset references (script/link/preload tags emitted
-* with a fixed vite base, e.g. /public/ or /account/) so they carry the
-* path prefix under which authup is publicly served (e.g. /auth/public/...).
-* The reverse proxy is expected to strip the prefix before the request
-* reaches authup, so the assets middleware keeps serving at the fixed base.
-*/ function rebaseAssetURLs(html, basePath, viteBase) {
-	if (!basePath) return html;
-	return html.replace(new RegExp(`(src|href)="${viteBase.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}`, "g"), (_match, attribute) => `${attribute}="${basePath}${viteBase}`);
-}
-/**
-* Escape characters that would otherwise let a value break out of an inline
-* `<script>` context (`<\/script>`) or terminate the JS string literal via
-* the U+2028/U+2029 line separators. Every window-global config/payload a
-* console page inlines must pass through this — never rely on the VALUES
-* staying benign.
-*/ function serializeInlineScriptJSON(value) {
-	return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-}
-//#endregion
-export { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes };
-
-//# sourceMappingURL=html.mjs.map

package/dist/adapters/http/ui/shared/html.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"html.mjs","names":["useRequestCookie","LOCALE_COOKIE","COLOR_MODE_COOKIE","readUIClientPreferences","event","locale","colorMode","stampHtmlAttributes","html","preferences","htmlAttrs","test","replace","replaceTemplateMarker","marker","value","injectHeadContent","content","index","toLowerCase","indexOf","slice","stampDocumentTitle","title","applyUIPageHeaders","response","headers","set","rebaseAssetURLs","basePath","viteBase","RegExp","_match","attribute","serializeInlineScriptJSON","JSON","stringify"],"sources":["../../../../../src/adapters/http/ui/shared/html.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport type { IAppEvent } from 'routup';\nimport { LOCALE_COOKIE } from '../../request/helpers/locale.ts';\n\nconst COLOR_MODE_COOKIE = 'vc-color-mode';\n\nexport type UIClientPreferences = {\n    locale?: string,\n    colorMode?: string,\n};\n\n/**\n * Mirror @vuecs/nuxt's SSR plugins: resolve the shared cookies server-side\n * so the HTML shell already carries the `.dark`/`.light` class and lang\n * attribute (no flash) and the client app hydrates from the same values.\n * The cookies are shared between every console on the origin.\n */\nexport function readUIClientPreferences(event: IAppEvent) : UIClientPreferences {\n    return {\n        locale: useRequestCookie(event, LOCALE_COOKIE),\n        colorMode: useRequestCookie(event, COLOR_MODE_COOKIE),\n    };\n}\n\n/**\n * Stamp the resolved preferences onto the opening `<html>` tag. Matched by\n * pattern rather than an exact literal, so a reformatted tag / dev-mode\n * transformIndexHtml rewrite still gets the lang + color-mode attributes\n * (no silent FOUC).\n */\nexport function stampHtmlAttributes(html: string, preferences: UIClientPreferences) : string {\n    let htmlAttrs = 'lang=\"en\"';\n    if (preferences.locale && /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)*$/.test(preferences.locale)) {\n        htmlAttrs = `lang=\"${preferences.locale}\"`;\n    }\n    if (preferences.colorMode === 'dark' || preferences.colorMode === 'light') {\n        htmlAttrs += ` class=\"${preferences.colorMode}\"`;\n    }\n\n    return html.replace(/<html\\b[^>]*>/i, () => `<html ${htmlAttrs}>`);\n}\n\n/**\n * Replace a template marker (`<!--app-html-->`, `<!--account-config-->`, ...)\n * with a rendered value.\n *\n * The replacement is passed as a FUNCTION on purpose. A string replacement\n * expands the `$&`, `` $` ``, `$'` and `$$` patterns, so a `$'` anywhere in\n * the value splices the template's own text back into the page. The values\n * spliced here carry raw request input (the SSR hydration payload reflects\n * query parameters), which made `?token=$'` return a page whose inline\n * payload script was no longer valid JavaScript. Escaping cannot prevent\n * this: the expansion happens after the value was built.\n */\nexport function replaceTemplateMarker(html: string, marker: string, value: string) : string {\n    return html.replace(marker, () => value);\n}\n\n/**\n * Insert markup immediately before `</head>`.\n *\n * Deliberately not a template marker: injecting at the closing tag works\n * against console bundles that were built BEFORE this feature existed, so\n * server-core never silently loses theming when it runs against an older\n * console package. A shell without a `</head>` is returned unchanged.\n *\n * Function-replacement form for the same reason as replaceTemplateMarker.\n */\nexport function injectHeadContent(html: string, content: string) : string {\n    if (!content) {\n        return html;\n    }\n\n    const index = html.toLowerCase().indexOf('</head>');\n    if (index === -1) {\n        return html;\n    }\n\n    return html.slice(0, index) + content + html.slice(index);\n}\n\n/**\n * Replace the document title. The value must already be HTML-escaped by\n * the caller; matched by pattern so a reformatted tag still hits.\n */\nexport function stampDocumentTitle(html: string, title: string) : string {\n    return html.replace(/<title\\b[^>]*>[\\s\\S]*?<\\/title>/i, () => `<title>${title}</title>`);\n}\n\n/**\n * Response headers every served console page shares.\n *\n * Clickjacking guard: the pages mutate state behind explicit clicks and\n * hydrate first-party session state, so framing them would make\n * click-gating defeatable via overlay attacks — deny embedding entirely\n * (iframe-based silent renew is therefore unsupported). The URLs routinely\n * carry sensitive query params (id_token_hint, code, redirect, state) —\n * never leak them via Referer.\n */\nexport function applyUIPageHeaders(event: IAppEvent) : void {\n    event.response.headers.set('content-type', 'text/html; charset=utf-8');\n    // The shell is stamped from the vc-locale / vc-color-mode cookies, so\n    // it genuinely varies by them. It carried no Vary header at all.\n    event.response.headers.set('vary', 'cookie');\n    event.response.headers.set('content-security-policy', \"frame-ancestors 'none'\");\n    event.response.headers.set('x-frame-options', 'DENY');\n    event.response.headers.set('referrer-policy', 'no-referrer');\n    // Login pages, and the federated callback's interstitial carries a\n    // fresh authorization code in its payload.\n    event.response.headers.set('cache-control', 'no-store');\n}\n\n/**\n * Rewrite root-absolute asset references (script/link/preload tags emitted\n * with a fixed vite base, e.g. /public/ or /account/) so they carry the\n * path prefix under which authup is publicly served (e.g. /auth/public/...).\n * The reverse proxy is expected to strip the prefix before the request\n * reaches authup, so the assets middleware keeps serving at the fixed base.\n */\nexport function rebaseAssetURLs(html: string, basePath: string, viteBase: string) : string {\n    if (!basePath) {\n        return html;\n    }\n\n    return html.replace(\n        new RegExp(`(src|href)=\"${viteBase.replace(/[.*+?^${}()|[\\]\\\\/]/g, '\\\\$&')}`, 'g'),\n        (_match, attribute) => `${attribute}=\"${basePath}${viteBase}`,\n    );\n}\n\n/**\n * Escape characters that would otherwise let a value break out of an inline\n * `<script>` context (`</script>`) or terminate the JS string literal via\n * the U+2028/U+2029 line separators. Every window-global config/payload a\n * console page inlines must pass through this — never rely on the VALUES\n * staying benign.\n */\nexport function serializeInlineScriptJSON(value: unknown) : string {\n    return JSON.stringify(value)\n        .replace(/</g, '\\\\u003c')\n        .replace(/>/g, '\\\\u003e')\n        .replace(/\\u2028/g, '\\\\u2028')\n        .replace(/\\u2029/g, '\\\\u2029');\n}\n"],"mappings":";;;;;;AAWA,MAAME,oBAAoB;;;;;;GAa1B,SAAgBC,wBAAwBC,OAAgB;CACpD,OAAO;EACHC,QAAQL,iBAAiBI,OAAOH,aAAAA;EAChCK,WAAWN,iBAAiBI,OAAOF,iBAAAA;CACvC;AACJ;;;;;;GAQA,SAAgBK,oBAAoBC,MAAcC,aAAgC;CAC9E,IAAIC,YAAY;CAChB,IAAID,YAAYJ,UAAU,kCAAkCM,KAAKF,YAAYJ,MAAM,GAC/EK,YAAY,SAASD,YAAYJ,OAAO;CAE5C,IAAII,YAAYH,cAAc,UAAUG,YAAYH,cAAc,SAC9DI,aAAa,WAAWD,YAAYH,UAAU;CAGlD,OAAOE,KAAKI,QAAQ,wBAAwB,SAASF,UAAU,EAAE;AACrE;;;;;;;;;;;;GAcA,SAAgBG,sBAAsBL,MAAcM,QAAgBC,OAAa;CAC7E,OAAOP,KAAKI,QAAQE,cAAcC,KAAAA;AACtC;;;;;;;;;;GAYA,SAAgBC,kBAAkBR,MAAcS,SAAe;CAC3D,IAAI,CAACA,SACD,OAAOT;CAGX,MAAMU,QAAQV,KAAKW,YAAW,CAAA,CAAGC,QAAQ,SAAA;CACzC,IAAIF,UAAU,IACV,OAAOV;CAGX,OAAOA,KAAKa,MAAM,GAAGH,KAAAA,IAASD,UAAUT,KAAKa,MAAMH,KAAAA;AACvD;;;;GAMA,SAAgBI,mBAAmBd,MAAce,OAAa;CAC1D,OAAOf,KAAKI,QAAQ,0CAA0C,UAAUW,MAAM,SAAS;AAC3F;;;;;;;;;;GAYA,SAAgBC,mBAAmBpB,OAAgB;CAC/CA,MAAMqB,SAASC,QAAQC,IAAI,gBAAgB,0BAAA;CAG3CvB,MAAMqB,SAASC,QAAQC,IAAI,QAAQ,QAAA;CACnCvB,MAAMqB,SAASC,QAAQC,IAAI,2BAA2B,wBAAA;CACtDvB,MAAMqB,SAASC,QAAQC,IAAI,mBAAmB,MAAA;CAC9CvB,MAAMqB,SAASC,QAAQC,IAAI,mBAAmB,aAAA;CAG9CvB,MAAMqB,SAASC,QAAQC,IAAI,iBAAiB,UAAA;AAChD;;;;;;;GASA,SAAgBC,gBAAgBpB,MAAcqB,UAAkBC,UAAgB;CAC5E,IAAI,CAACD,UACD,OAAOrB;CAGX,OAAOA,KAAKI,QACR,IAAImB,OAAO,eAAeD,SAASlB,QAAQ,wBAAwB,MAAA,KAAW,GAAA,IAC7EoB,QAAQC,cAAc,GAAGA,UAAU,IAAIJ,WAAWC,UAAU;AAErE;;;;;;;GASA,SAAgBI,0BAA0BnB,OAAc;CACpD,OAAOoB,KAAKC,UAAUrB,KAAAA,CAAAA,CACjBH,QAAQ,MAAM,SAAA,CAAA,CACdA,QAAQ,MAAM,SAAA,CAAA,CACdA,QAAQ,WAAW,SAAA,CAAA,CACnBA,QAAQ,WAAW,SAAA;AAC5B"}

package/dist/adapters/http/ui/shared/index.d.ts

@@ -1,2 +0,0 @@
-export * from './html.ts';
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/shared/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/shared/index.ts"],"names":[],"mappings":"AAOA,cAAc,WAAW,CAAC"}

package/dist/adapters/http/ui/shared/index.mjs

@@ -1,5 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes } from "./html.mjs";
-export { applyUIPageHeaders, injectHeadContent, readUIClientPreferences, rebaseAssetURLs, replaceTemplateMarker, serializeInlineScriptJSON, stampDocumentTitle, stampHtmlAttributes };

package/dist/adapters/http/ui/theme/apply.d.ts

@@ -1,12 +0,0 @@
-import type { IThemeProvider } from './types.ts';
-/**
- * Apply the operator theme to a rendered console shell. A no-op when
- * theming is off or the directory carries no manifest, so both console
- * serve paths can call it unconditionally.
- *
- * Lives outside contract/ because it takes a provider (filesystem-backed)
- * and splices into a served document: contract/ stays a pure description
- * of what a theme IS.
- */
-export declare function applyTheme(html: string, provider: IThemeProvider | undefined, basePath: string): Promise<string>;
-//# sourceMappingURL=apply.d.ts.map

package/dist/adapters/http/ui/theme/apply.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/apply.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAoBlB"}

package/dist/adapters/http/ui/theme/apply.mjs

@@ -1,29 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { injectHeadContent, stampDocumentTitle } from "../shared/html.mjs";
-import "../shared/index.mjs";
-import { escapeHtml } from "./contract/head.mjs";
-import "./contract/index.mjs";
-//#region src/adapters/http/ui/theme/apply.ts
-/**
-* Apply the operator theme to a rendered console shell. A no-op when
-* theming is off or the directory carries no manifest, so both console
-* serve paths can call it unconditionally.
-*
-* Lives outside contract/ because it takes a provider (filesystem-backed)
-* and splices into a served document: contract/ stays a pure description
-* of what a theme IS.
-*/ async function applyTheme(html, provider, basePath) {
-	if (!provider) return html;
-	let body = html;
-	const manifest = await provider.getManifest();
-	if (manifest?.title) body = stampDocumentTitle(body, escapeHtml(manifest.title));
-	const head = await provider.getHead(basePath);
-	if (head) body = injectHeadContent(body, head);
-	return body;
-}
-//#endregion
-export { applyTheme };
-
-//# sourceMappingURL=apply.mjs.map

package/dist/adapters/http/ui/theme/apply.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"apply.mjs","names":["injectHeadContent","stampDocumentTitle","escapeHtml","applyTheme","html","provider","basePath","body","manifest","getManifest","title","head","getHead"],"sources":["../../../../../src/adapters/http/ui/theme/apply.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { injectHeadContent, stampDocumentTitle } from '../shared/index.ts';\nimport { escapeHtml } from './contract/index.ts';\nimport type { IThemeProvider } from './types.ts';\n\n/**\n * Apply the operator theme to a rendered console shell. A no-op when\n * theming is off or the directory carries no manifest, so both console\n * serve paths can call it unconditionally.\n *\n * Lives outside contract/ because it takes a provider (filesystem-backed)\n * and splices into a served document: contract/ stays a pure description\n * of what a theme IS.\n */\nexport async function applyTheme(\n    html: string,\n    provider: IThemeProvider | undefined,\n    basePath: string,\n) : Promise<string> {\n    if (!provider) {\n        return html;\n    }\n\n    let body = html;\n\n    // A directory may carry only a fragment, or only a stylesheet, so the\n    // manifest is not a precondition for applying the theme.\n    const manifest = await provider.getManifest();\n    if (manifest?.title) {\n        body = stampDocumentTitle(body, escapeHtml(manifest.title));\n    }\n\n    const head = await provider.getHead(basePath);\n    if (head) {\n        body = injectHeadContent(body, head);\n    }\n\n    return body;\n}\n"],"mappings":";;;;;;;;;;;;;;;;GAoBA,eAAsBG,WAClBC,MACAC,UACAC,UAAgB;CAEhB,IAAI,CAACD,UACD,OAAOD;CAGX,IAAIG,OAAOH;CAIX,MAAMI,WAAW,MAAMH,SAASI,YAAW;CAC3C,IAAID,UAAUE,OACVH,OAAON,mBAAmBM,MAAML,WAAWM,SAASE,KAAK,CAAA;CAG7D,MAAMC,OAAO,MAAMN,SAASO,QAAQN,QAAAA;CACpC,IAAIK,MACAJ,OAAOP,kBAAkBO,MAAMI,IAAAA;CAGnC,OAAOJ;AACX"}

package/dist/adapters/http/ui/theme/assets.d.ts

@@ -1,20 +0,0 @@
-import type { Handler } from 'routup';
-import type { IThemeProvider } from './types.ts';
-/**
- * Serves the operator theme's `assets/` directory.
- *
- * Deliberately NOT `@routup/assets`' createHandler, for three reasons that
- * matter for an operator-supplied root:
- * - its lookup walks PATH SUFFIXES, so `/theme/anything/logo.svg` would
- *   serve `/logo.svg`; the same file becomes reachable at unbounded
- *   distinct URLs.
- * - it probes `.html` / `index.html` by default, which would make a stray
- *   index.html a servable document on the IdP origin.
- * - it performs no realpath containment check, so a symlink inside the
- *   mounted directory pointing outside it is served with a 200. A
- *   read-only mount does not prevent that, and refusing symlinks outright
- *   is not an option: a Kubernetes ConfigMap volume IS a symlink farm
- *   (`key -> ..data/key`).
- */
-export declare function createThemeAssetsHandler(provider: IThemeProvider): Handler;
-//# sourceMappingURL=assets.d.ts.map

package/dist/adapters/http/ui/theme/assets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/assets.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAQtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,GAAI,OAAO,CAqG3E"}

package/dist/adapters/http/ui/theme/assets.mjs

@@ -1,86 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { THEME_ASSET_CONTENT_TYPES, THEME_ASSET_EXTENSIONS } from "./contract/constants.mjs";
-import { themeAssetExtension } from "./contract/utils.mjs";
-import "./contract/index.mjs";
-import { THEME_ASSET_CSP } from "./constants.mjs";
-import path from "node:path";
-import { HeaderName, defineCoreHandler, sendFile } from "routup";
-import fs from "node:fs";
-import { Readable } from "node:stream";
-//#region src/adapters/http/ui/theme/assets.ts
-const REQUEST_PATH_PATTERN = /^[a-z0-9][a-z0-9._/-]*$/i;
-/**
-* Serves the operator theme's `assets/` directory.
-*
-* Deliberately NOT `@routup/assets`' createHandler, for three reasons that
-* matter for an operator-supplied root:
-* - its lookup walks PATH SUFFIXES, so `/theme/anything/logo.svg` would
-*   serve `/logo.svg`; the same file becomes reachable at unbounded
-*   distinct URLs.
-* - it probes `.html` / `index.html` by default, which would make a stray
-*   index.html a servable document on the IdP origin.
-* - it performs no realpath containment check, so a symlink inside the
-*   mounted directory pointing outside it is served with a 200. A
-*   read-only mount does not prevent that, and refusing symlinks outright
-*   is not an option: a Kubernetes ConfigMap volume IS a symlink farm
-*   (`key -> ..data/key`).
-*/ function createThemeAssetsHandler(provider) {
-	return defineCoreHandler(async (event) => {
-		const assetsPath = await provider.getAssetsPath();
-		if (!assetsPath) {
-			event.response.status = 404;
-			return null;
-		}
-		let requestPath = event.path;
-		const { mountPath } = event;
-		if (requestPath.startsWith(mountPath)) requestPath = requestPath.substring(mountPath.length);
-		if (requestPath.includes("%")) try {
-			requestPath = decodeURIComponent(requestPath);
-		} catch {
-			event.response.status = 404;
-			return null;
-		}
-		requestPath = requestPath.replace(/^\/+/, "");
-		const extension = themeAssetExtension(requestPath);
-		if (!requestPath || !REQUEST_PATH_PATTERN.test(requestPath) || requestPath.split("/").includes("..") || !THEME_ASSET_EXTENSIONS.includes(extension)) {
-			event.response.status = 404;
-			return null;
-		}
-		let root;
-		let filePath;
-		let stats;
-		try {
-			root = await fs.promises.realpath(assetsPath);
-			filePath = await fs.promises.realpath(path.join(assetsPath, requestPath));
-			stats = await fs.promises.stat(filePath);
-		} catch {
-			event.response.status = 404;
-			return null;
-		}
-		if (!stats.isFile() || filePath !== root && !filePath.startsWith(root + path.sep)) {
-			event.response.status = 404;
-			return null;
-		}
-		const etag = `W/"${stats.size}-${stats.mtime.getTime()}"`;
-		event.response.headers.set(HeaderName.CACHE_CONTROL, "public, max-age=0, must-revalidate");
-		if (event.headers.get(HeaderName.IF_NONE_MATCH) === etag) {
-			event.response.status = 304;
-			return null;
-		}
-		const response = await sendFile(event, {
-			content: (options) => Readable.toWeb(fs.createReadStream(filePath, options)),
-			stats: () => stats,
-			name: filePath
-		});
-		response.headers.set(HeaderName.CONTENT_TYPE, THEME_ASSET_CONTENT_TYPES[extension]);
-		response.headers.set("x-content-type-options", "nosniff");
-		response.headers.set("content-security-policy", THEME_ASSET_CSP);
-		return response;
-	});
-}
-//#endregion
-export { createThemeAssetsHandler };
-
-//# sourceMappingURL=assets.mjs.map

package/dist/adapters/http/ui/theme/assets.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.mjs","names":["fs","path","Readable","HeaderName","defineCoreHandler","sendFile","THEME_ASSET_CSP","THEME_ASSET_CONTENT_TYPES","THEME_ASSET_EXTENSIONS","themeAssetExtension","REQUEST_PATH_PATTERN","createThemeAssetsHandler","provider","event","assetsPath","getAssetsPath","response","status","requestPath","mountPath","startsWith","substring","length","includes","decodeURIComponent","replace","extension","test","split","root","filePath","stats","promises","realpath","join","stat","isFile","sep","etag","size","mtime","getTime","headers","set","CACHE_CONTROL","get","IF_NONE_MATCH","content","options","toWeb","createReadStream","name","CONTENT_TYPE"],"sources":["../../../../../src/adapters/http/ui/theme/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { Readable } from 'node:stream';\nimport type { Handler } from 'routup';\nimport { HeaderName, defineCoreHandler, sendFile } from 'routup';\nimport { THEME_ASSET_CSP } from './constants.ts';\nimport {\n    THEME_ASSET_CONTENT_TYPES,\n    THEME_ASSET_EXTENSIONS,\n    themeAssetExtension,\n} from './contract/index.ts';\nimport type { IThemeProvider } from './types.ts';\n\nconst REQUEST_PATH_PATTERN = /^[a-z0-9][a-z0-9._/-]*$/i;\n\n/**\n * Serves the operator theme's `assets/` directory.\n *\n * Deliberately NOT `@routup/assets`' createHandler, for three reasons that\n * matter for an operator-supplied root:\n * - its lookup walks PATH SUFFIXES, so `/theme/anything/logo.svg` would\n *   serve `/logo.svg`; the same file becomes reachable at unbounded\n *   distinct URLs.\n * - it probes `.html` / `index.html` by default, which would make a stray\n *   index.html a servable document on the IdP origin.\n * - it performs no realpath containment check, so a symlink inside the\n *   mounted directory pointing outside it is served with a 200. A\n *   read-only mount does not prevent that, and refusing symlinks outright\n *   is not an option: a Kubernetes ConfigMap volume IS a symlink farm\n *   (`key -> ..data/key`).\n */\nexport function createThemeAssetsHandler(provider: IThemeProvider) : Handler {\n    return defineCoreHandler(async (event) => {\n        const assetsPath = await provider.getAssetsPath();\n        if (!assetsPath) {\n            event.response.status = 404;\n\n            return null;\n        }\n\n        let requestPath = event.path;\n        const { mountPath } = event;\n        if (requestPath.startsWith(mountPath)) {\n            requestPath = requestPath.substring(mountPath.length);\n        }\n\n        if (requestPath.includes('%')) {\n            try {\n                requestPath = decodeURIComponent(requestPath);\n            } catch {\n                event.response.status = 404;\n\n                return null;\n            }\n        }\n\n        requestPath = requestPath.replace(/^\\/+/, '');\n\n        // The contract's own parser, so the set the handler serves cannot\n        // drift from the set the manifest validator accepts.\n        const extension = themeAssetExtension(requestPath);\n\n        if (\n            !requestPath ||\n            !REQUEST_PATH_PATTERN.test(requestPath) ||\n            requestPath.split('/').includes('..') ||\n            !THEME_ASSET_EXTENSIONS.includes(extension)\n        ) {\n            event.response.status = 404;\n\n            return null;\n        }\n\n        // Both the root and the file are realpathed HERE, per request, and\n        // never cached. A Kubernetes ConfigMap update swaps the `..data`\n        // symlink to a new timestamped directory and deletes the old one,\n        // so a root realpath captured at boot dangles after the first\n        // update and every asset 404s until the pod restarts.\n        //\n        // The realpath is also the control that survives a symlink pointing\n        // out of the mount; the pattern check above is only the cheap first\n        // pass. Resolving both within the same request keeps the comparison\n        // consistent: a swap landing between the two calls fails closed\n        // (a transient 404), never open.\n        let root : string;\n        let filePath : string;\n        let stats : fs.Stats;\n        try {\n            root = await fs.promises.realpath(assetsPath);\n            filePath = await fs.promises.realpath(path.join(assetsPath, requestPath));\n            stats = await fs.promises.stat(filePath);\n        } catch {\n            event.response.status = 404;\n\n            return null;\n        }\n\n        if (\n            !stats.isFile() ||\n            (filePath !== root && !filePath.startsWith(root + path.sep))\n        ) {\n            event.response.status = 404;\n\n            return null;\n        }\n\n        const etag = `W/\"${stats.size}-${stats.mtime.getTime()}\"`;\n        event.response.headers.set(HeaderName.CACHE_CONTROL, 'public, max-age=0, must-revalidate');\n\n        if (event.headers.get(HeaderName.IF_NONE_MATCH) === etag) {\n            event.response.status = 304;\n\n            return null;\n        }\n\n        const response = await sendFile(event, {\n            content: (options) => Readable.toWeb(\n                fs.createReadStream(filePath, options),\n            ) as ReadableStream,\n            stats: () => stats,\n            name: filePath,\n        });\n\n        // Pin the content type from our own extension map rather than\n        // letting it be sniffed or inferred, and neutralize SVG as active\n        // content (an SVG navigated to directly executes inline script).\n        response.headers.set(HeaderName.CONTENT_TYPE, THEME_ASSET_CONTENT_TYPES[extension]);\n        response.headers.set('x-content-type-options', 'nosniff');\n        response.headers.set('content-security-policy', THEME_ASSET_CSP);\n\n        return response;\n    });\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,MAAMU,uBAAuB;;;;;;;;;;;;;;;;GAkB7B,SAAgBC,yBAAyBC,UAAwB;CAC7D,OAAOR,kBAAkB,OAAOS,UAAAA;EAC5B,MAAMC,aAAa,MAAMF,SAASG,cAAa;EAC/C,IAAI,CAACD,YAAY;GACbD,MAAMG,SAASC,SAAS;GAExB,OAAO;EACX;EAEA,IAAIC,cAAcL,MAAMZ;EACxB,MAAM,EAAEkB,cAAcN;EACtB,IAAIK,YAAYE,WAAWD,SAAAA,GACvBD,cAAcA,YAAYG,UAAUF,UAAUG,MAAM;EAGxD,IAAIJ,YAAYK,SAAS,GAAA,GACrB,IAAI;GACAL,cAAcM,mBAAmBN,WAAAA;EACrC,QAAQ;GACJL,MAAMG,SAASC,SAAS;GAExB,OAAO;EACX;EAGJC,cAAcA,YAAYO,QAAQ,QAAQ,EAAA;EAI1C,MAAMC,YAAYjB,oBAAoBS,WAAAA;EAEtC,IACI,CAACA,eACD,CAACR,qBAAqBiB,KAAKT,WAAAA,KAC3BA,YAAYU,MAAM,GAAA,CAAA,CAAKL,SAAS,IAAA,KAChC,CAACf,uBAAuBe,SAASG,SAAAA,GACnC;GACEb,MAAMG,SAASC,SAAS;GAExB,OAAO;EACX;EAaA,IAAIY;EACJ,IAAIC;EACJ,IAAIC;EACJ,IAAI;GACAF,OAAO,MAAM7B,GAAGgC,SAASC,SAASnB,UAAAA;GAClCgB,WAAW,MAAM9B,GAAGgC,SAASC,SAAShC,KAAKiC,KAAKpB,YAAYI,WAAAA,CAAAA;GAC5Da,QAAQ,MAAM/B,GAAGgC,SAASG,KAAKL,QAAAA;EACnC,QAAQ;GACJjB,MAAMG,SAASC,SAAS;GAExB,OAAO;EACX;EAEA,IACI,CAACc,MAAMK,OAAM,KACZN,aAAaD,QAAQ,CAACC,SAASV,WAAWS,OAAO5B,KAAKoC,GAAG,GAC5D;GACExB,MAAMG,SAASC,SAAS;GAExB,OAAO;EACX;EAEA,MAAMqB,OAAO,MAAMP,MAAMQ,KAAK,GAAGR,MAAMS,MAAMC,QAAO,EAAG;EACvD5B,MAAMG,SAAS0B,QAAQC,IAAIxC,WAAWyC,eAAe,oCAAA;EAErD,IAAI/B,MAAM6B,QAAQG,IAAI1C,WAAW2C,aAAa,MAAMR,MAAM;GACtDzB,MAAMG,SAASC,SAAS;GAExB,OAAO;EACX;EAEA,MAAMD,WAAW,MAAMX,SAASQ,OAAO;GACnCkC,UAAUC,YAAY9C,SAAS+C,MAC3BjD,GAAGkD,iBAAiBpB,UAAUkB,OAAAA,CAAAA;GAElCjB,aAAaA;GACboB,MAAMrB;EACV,CAAA;EAKAd,SAAS0B,QAAQC,IAAIxC,WAAWiD,cAAc7C,0BAA0BmB,UAAU;EAClFV,SAAS0B,QAAQC,IAAI,0BAA0B,SAAA;EAC/C3B,SAAS0B,QAAQC,IAAI,2BAA2BrC,eAAAA;EAEhD,OAAOU;CACX,CAAA;AACJ"}

package/dist/adapters/http/ui/theme/constants.d.ts

@@ -1,16 +0,0 @@
-/**
- * SERVING constants. The theme's own vocabulary (layout, manifest, tokens,
- * asset kinds) lives in contract/, which stays portable.
- */
-/**
- * Debounce for the manifest mtime re-check. A burst of renders costs one
- * stat; an edit takes effect on the next render after the window.
- */
-export declare const THEME_MANIFEST_REVALIDATE_INTERVAL = 1000;
-/**
- * An SVG navigated to directly executes inline script, and a theme
- * directory is exactly where operator SVGs land. This neutralizes that
- * while leaving `<img>` and `background-image` rendering intact.
- */
-export declare const THEME_ASSET_CSP = "default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox";
-//# sourceMappingURL=constants.d.ts.map

package/dist/adapters/http/ui/theme/constants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/constants.ts"],"names":[],"mappings":"AAOA;;;GAGG;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC,OAAQ,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,eAAe,0EAA0E,CAAC"}

package/dist/adapters/http/ui/theme/constants.mjs

@@ -1,20 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-//#region src/adapters/http/ui/theme/constants.ts
-/**
-* SERVING constants. The theme's own vocabulary (layout, manifest, tokens,
-* asset kinds) lives in contract/, which stays portable.
-*/ /**
-* Debounce for the manifest mtime re-check. A burst of renders costs one
-* stat; an edit takes effect on the next render after the window.
-*/ const THEME_MANIFEST_REVALIDATE_INTERVAL = 1e3;
-/**
-* An SVG navigated to directly executes inline script, and a theme
-* directory is exactly where operator SVGs land. This neutralizes that
-* while leaving `<img>` and `background-image` rendering intact.
-*/ const THEME_ASSET_CSP = "default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox";
-//#endregion
-export { THEME_ASSET_CSP, THEME_MANIFEST_REVALIDATE_INTERVAL };
-
-//# sourceMappingURL=constants.mjs.map

package/dist/adapters/http/ui/theme/constants.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.mjs","names":["THEME_MANIFEST_REVALIDATE_INTERVAL","THEME_ASSET_CSP"],"sources":["../../../../../src/adapters/http/ui/theme/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * SERVING constants. The theme's own vocabulary (layout, manifest, tokens,\n * asset kinds) lives in contract/, which stays portable.\n */\n\n/**\n * Debounce for the manifest mtime re-check. A burst of renders costs one\n * stat; an edit takes effect on the next render after the window.\n */\nexport const THEME_MANIFEST_REVALIDATE_INTERVAL = 1_000;\n\n/**\n * An SVG navigated to directly executes inline script, and a theme\n * directory is exactly where operator SVGs land. This neutralizes that\n * while leaving `<img>` and `background-image` rendering intact.\n */\nexport const THEME_ASSET_CSP = \"default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox\";\n"],"mappings":";;;;;;;;;;GAgBA,MAAaA,qCAAqC;;;;;GAOlD,MAAaC,kBAAkB"}