@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/http/controllers/index.mjs

@@ -16,8 +16,10 @@ import { IdentityProviderRoleMappingController } from "./entities/identity-provi
 import { KeyController } from "./entities/key/module.mjs";
 import { PermissionController } from "./entities/permission/module.mjs";
 import { PermissionPolicyController } from "./entities/permission-policy/module.mjs";
+import { ConsoleLogin } from "./workflows/console-login/module.mjs";
 import { AccountController } from "./workflows/account/module.mjs";
 import { ActivateController } from "./workflows/activate/module.mjs";
+import { AdminController } from "./workflows/admin/module.mjs";
 import { AuthenticatorChallengeController } from "./workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./workflows/jwks/handlers/read.mjs";
@@ -53,4 +55,4 @@ import { UserPermissionRequestValidator } from "./entities/user-permission/utils
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AdminController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, ConsoleLogin, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/account/index.d.ts

@@ -1,2 +1,3 @@
 export * from './module.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/account/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/account/module.d.ts

@@ -1,24 +1,33 @@
-import type { StatusResponseFeatures } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
-export type AccountControllerOptions = {
-    baseURL: string;
-    features: StatusResponseFeatures;
-    trustedOrigins: string[];
-};
-export type AccountControllerContext = {
-    options: AccountControllerOptions;
-};
+import { ConsoleLogin } from '../console-login/index.ts';
+import type { AccountControllerContext, AccountControllerOptions } from './types.ts';
 /**
- * Serves the account console SPA (`@authup/client-account-console`) shell —
- * client-side routing owns the sub-paths, so every route returns the same
- * shell with the runtime config (apiUrl, base path, feature flags) injected.
- * The bundle's static assets ride the assets middleware (/account/assets).
+ * The account console's server half (plan 088): the login kick and the code
+ * redemption, so no OAuth2 token ever reaches the console's JavaScript.
+ *
+ * The console itself is served by `@authup/server-account-console`, which
+ * owns everything else under `/console/account`. These two routes stay here
+ * because they are sessions, keys and cache, and because the pending-login
+ * cookie has to be issued on the origin that reads it back (plan 101
+ * invariant 3). A proxy therefore routes these two exact paths to the API
+ * set and the rest of the console's segment to the console set.
  */
 export declare class AccountController {
     protected options: AccountControllerOptions;
+    protected consoleLogin: ConsoleLogin;
     constructor(ctx: AccountControllerContext);
-    serve(event: IAppEvent): Promise<string>;
-    servePage(event: IAppEvent): Promise<string>;
-    protected render(event: IAppEvent): Promise<string>;
+    /**
+     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+     * The bare `/login` is the console's own page now, served by the console
+     * service, so there is nothing left here to dispatch against.
+     */
+    login(event: IAppEvent): Promise<Response>;
+    callback(event: IAppEvent): Promise<Response>;
+    /**
+     * Disabled means disabled on the server too: the kick must not mint a
+     * pending login and a session for a console nothing is serving. There is
+     * no shell to answer with any more, so the route simply does not exist.
+     */
+    protected assertEnabled(): void;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/account/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAMpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,qBACa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,wBAAwB;IAKnC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpD,SAAS,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9D,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAOtD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;;;;;;GAUG;AACH,qBACa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;gBAEzB,GAAG,EAAE,wBAAwB;IAoBzC;;;;OAIG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOtD,QAAQ,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAM/D;;;;OAIG;IACH,SAAS,CAAC,aAAa,IAAI,IAAI;CAKlC"}

package/dist/adapters/http/controllers/workflows/account/module.mjs

@@ -1,8 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveAccountConsolePage } from "../../../ui/account-console/module.mjs";
-import "../../../ui/index.mjs";
+import { ACCOUNT_CONSOLE_SEGMENT } from "../../../constants.mjs";
+import { ConsoleLogin } from "../console-login/module.mjs";
+import "../console-login/index.mjs";
+import { CLIENT_ACCOUNT_CONSOLE_NAME } from "@authup/core-kit";
+import { NotFoundError } from "@ebec/http";
 import { DContext, DController, DGet } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/account/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -21,39 +24,59 @@ function _ts_param(paramIndex, decorator) {
 }
 var AccountController = class {
 	options;
+	consoleLogin;
 	constructor(ctx) {
 		this.options = ctx.options;
+		this.consoleLogin = new ConsoleLogin({
+			clientName: CLIENT_ACCOUNT_CONSOLE_NAME,
+			segment: ACCOUNT_CONSOLE_SEGMENT,
+			consoleUrl: ctx.options.consoleUrl
+		}, {
+			options: { baseURL: ctx.options.baseURL },
+			loginStore: ctx.loginStore,
+			sessionRepository: ctx.sessionRepository,
+			sessionManager: ctx.sessionManager,
+			tokenVerifier: ctx.tokenVerifier,
+			tokenRevoker: ctx.tokenRevoker,
+			logger: ctx.logger
+		});
 	}
-	async serve(event) {
-		return this.render(event);
+	/**
+	* A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+	* The bare `/login` is the console's own page now, served by the console
+	* service, so there is nothing left here to dispatch against.
+	*/ async login(event) {
+		this.assertEnabled();
+		return this.consoleLogin.login(event);
 	}
-	async servePage(event) {
-		return this.render(event);
+	async callback(event) {
+		this.assertEnabled();
+		return this.consoleLogin.callback(event);
 	}
-	render(event) {
-		return serveAccountConsolePage(event, {
-			baseURL: this.options.baseURL,
-			features: this.options.features,
-			trustedOrigins: this.options.trustedOrigins
-		});
+	/**
+	* Disabled means disabled on the server too: the kick must not mint a
+	* pending login and a session for a console nothing is serving. There is
+	* no shell to answer with any more, so the route simply does not exist.
+	*/ assertEnabled() {
+		if (!this.options.enabled) throw new NotFoundError();
 	}
 };
 _ts_decorate([
-	DGet("", []),
+	DGet("/login/start", []),
 	_ts_param(0, DContext()),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
-], AccountController.prototype, "serve", null);
+], AccountController.prototype, "login", null);
 _ts_decorate([
-	DGet("/:page", []),
+	DGet("/callback", []),
 	_ts_param(0, DContext()),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
-], AccountController.prototype, "servePage", null);
+], AccountController.prototype, "callback", null);
 AccountController = _ts_decorate([
-	DController("/account"),
+	DController(`/${ACCOUNT_CONSOLE_SEGMENT}`),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof AccountControllerContext === "undefined" ? Object : AccountControllerContext])
 ], AccountController);

package/dist/adapters/http/controllers/workflows/account/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","serveAccountConsolePage","AccountController","options","ctx","serve","event","render","servePage","baseURL","features","trustedOrigins"],"sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { serveAccountConsolePage } from '../../../ui/index.ts';\n\nexport type AccountControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n    trustedOrigins: string[],\n};\n\nexport type AccountControllerContext = {\n    options: AccountControllerOptions,\n};\n\n/**\n * Serves the account console SPA (`@authup/client-account-console`) shell —\n * client-side routing owns the sub-paths, so every route returns the same\n * shell with the runtime config (apiUrl, base path, feature flags) injected.\n * The bundle's static assets ride the assets middleware (/account/assets).\n */\n@DController('/account')\nexport class AccountController {\n    protected options: AccountControllerOptions;\n\n    constructor(ctx: AccountControllerContext) {\n        this.options = ctx.options;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return this.render(event);\n    }\n\n    @DGet('/:page', [])\n    async servePage(@DContext() event: IAppEvent): Promise<string> {\n        return this.render(event);\n    }\n\n    protected render(event: IAppEvent): Promise<string> {\n        return serveAccountConsolePage(event, {\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            trustedOrigins: this.options.trustedOrigins,\n        });\n    }\n}\n"],"mappings":";;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AA4BD,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAEA,MACME,UAAU,OAA+C;EAC3D,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEUC,OAAOD,OAAmC;EAChD,OAAOL,wBAAwBK,OAAO;GAClCG,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,gBAAgB,KAAKR,QAAQQ;EACjC,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["CLIENT_ACCOUNT_CONSOLE_NAME","NotFoundError","DContext","DController","DGet","ACCOUNT_CONSOLE_SEGMENT","ConsoleLogin","AccountController","options","consoleLogin","ctx","clientName","segment","consoleUrl","baseURL","loginStore","sessionRepository","sessionManager","tokenVerifier","tokenRevoker","logger","login","event","assertEnabled","callback","enabled"],"sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_ACCOUNT_CONSOLE_NAME } from '@authup/core-kit';\nimport { NotFoundError } from '@ebec/http';\nimport {\n    DContext,\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { ACCOUNT_CONSOLE_SEGMENT } from '../../../constants.ts';\nimport { ConsoleLogin } from '../console-login/index.ts';\nimport type { AccountControllerContext, AccountControllerOptions } from './types.ts';\n\n/**\n * The account console's server half (plan 088): the login kick and the code\n * redemption, so no OAuth2 token ever reaches the console's JavaScript.\n *\n * The console itself is served by `@authup/server-account-console`, which\n * owns everything else under `/console/account`. These two routes stay here\n * because they are sessions, keys and cache, and because the pending-login\n * cookie has to be issued on the origin that reads it back (plan 101\n * invariant 3). A proxy therefore routes these two exact paths to the API\n * set and the rest of the console's segment to the console set.\n */\n@DController(`/${ACCOUNT_CONSOLE_SEGMENT}`)\nexport class AccountController {\n    protected options: AccountControllerOptions;\n\n    protected consoleLogin: ConsoleLogin;\n\n    constructor(ctx: AccountControllerContext) {\n        this.options = ctx.options;\n        this.consoleLogin = new ConsoleLogin(\n            {\n                clientName: CLIENT_ACCOUNT_CONSOLE_NAME,\n                segment: ACCOUNT_CONSOLE_SEGMENT,\n                consoleUrl: ctx.options.consoleUrl,\n            },\n            {\n                options: { baseURL: ctx.options.baseURL },\n                loginStore: ctx.loginStore,\n                sessionRepository: ctx.sessionRepository,\n                sessionManager: ctx.sessionManager,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                logger: ctx.logger,\n            },\n        );\n    }\n\n    /**\n     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).\n     * The bare `/login` is the console's own page now, served by the console\n     * service, so there is nothing left here to dispatch against.\n     */\n    @DGet('/login/start', [])\n    async login(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.login(event);\n    }\n\n    @DGet('/callback', [])\n    async callback(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.callback(event);\n    }\n\n    /**\n     * Disabled means disabled on the server too: the kick must not mint a\n     * pending login and a session for a console nothing is serving. There is\n     * no shell to answer with any more, so the route simply does not exist.\n     */\n    protected assertEnabled(): void {\n        if (!this.options.enabled) {\n            throw new NotFoundError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAaO,oBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,eAAe,IAAIH,aACpB;GACIK,YAAYX;GACZY,SAASP;GACTQ,YAAYH,IAAIF,QAAQK;EAC5B,GACA;GACIL,SAAS,EAAEM,SAASJ,IAAIF,QAAQM,QAAQ;GACxCC,YAAYL,IAAIK;GAChBC,mBAAmBN,IAAIM;GACvBC,gBAAgBP,IAAIO;GACpBC,eAAeR,IAAIQ;GACnBC,cAAcT,IAAIS;GAClBC,QAAQV,IAAIU;EAChB,CAAA;CAER;;;;;IAOA,MACMC,MAAM,OAAiD;EACzD,KAAKE,cAAa;EAElB,OAAO,KAAKd,aAAaY,MAAMC,KAAAA;CACnC;CAEA,MACME,SAAS,OAAiD;EAC5D,KAAKD,cAAa;EAElB,OAAO,KAAKd,aAAae,SAASF,KAAAA;CACtC;;;;;IAOA,gBAAgC;EAC5B,IAAI,CAAC,KAAKd,QAAQiB,SACd,MAAM,IAAIxB,cAAAA;CAElB;AACJ;;;;;;;;;;;;;;;;CAvDc,YAAA,IAAGI,yBAAAA"}

package/dist/adapters/http/controllers/workflows/account/types.d.ts

@@ -0,0 +1,33 @@
+import type { Logger } from '@authup/server-kit';
+import type { IConsoleLoginStore, IOAuth2TokenRevoker, IOAuth2TokenVerifier, ISessionManager, ISessionRepository } from '../../../../../core/index.ts';
+export type AccountControllerOptions = {
+    baseURL: string;
+    /**
+     * Where the console this authenticates for is served. The browser lands
+     * there once the credential is issued, and a refusal renders there.
+     */
+    consoleUrl: string;
+    enabled: boolean;
+};
+export type AccountControllerContext = {
+    options: AccountControllerOptions;
+    /**
+     * Holds the PKCE verifier and `state` while the browser is away at
+     * `/authorize` (plan 088).
+     */
+    loginStore: IConsoleLoginStore;
+    /**
+     * Writes and clears the opaque credential on the session row. The session
+     * MANAGER cannot: the column is `select: false` and has a dedicated write.
+     */
+    sessionRepository: ISessionRepository;
+    sessionManager: ISessionManager;
+    /**
+     * Reads the exchanged access token (session, subject) and the refresh
+     * token, so both can be revoked before either leaves the process.
+     */
+    tokenVerifier: IOAuth2TokenVerifier;
+    tokenRevoker: IOAuth2TokenRevoker;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,wBAAwB,CAAC;IAClC;;;OAGG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAC;IAChC;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/activate/module.d.ts

@@ -1,9 +1,8 @@
 import type { IAppEvent } from 'routup';
-import type { ActivatePayload, StatusResponseFeatures } from '@authup/core-http-kit';
+import type { ActivatePayload } from '@authup/core-http-kit';
 import type { IRegistrationService } from '../../../../../core/index.ts';
 export type ActivateControllerOptions = {
-    baseURL: string;
-    features: StatusResponseFeatures;
+    authConsoleUrl: string;
 };
 export type ActivateControllerContext = {
     options: ActivateControllerOptions;
@@ -13,7 +12,12 @@ export declare class ActivateController {
     protected options: ActivateControllerOptions;
     protected service: IRegistrationService;
     constructor(ctx: ActivateControllerContext);
-    serve(event: IAppEvent): Promise<string>;
+    /**
+     * The page renders in the auth console service; this hop carries the
+     * request's own parameters over to it. The POST below stays here:
+     * server-core keeps the protocol, the service keeps the render.
+     */
+    serve(event: IAppEvent): Promise<Response>;
     execute(data: ActivatePayload, event: IAppEvent): Promise<null>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/activate/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBACa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,yBAAyB;IAMpC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAUpD,OAAO,CACA,IAAI,EAAE,eAAe,EAClB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CASnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GAAG;IACpC,cAAc,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBACa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,yBAAyB;IAK1C;;;;OAIG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKtD,OAAO,CACA,IAAI,EAAE,eAAe,EAClB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CASnB"}

package/dist/adapters/http/controllers/workflows/activate/module.mjs

@@ -1,8 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
-import "../../../ui/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
 import { ActivateRequestValidator } from "./validator.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/activate/module.ts
@@ -27,13 +26,12 @@ var ActivateController = class {
 		this.options = ctx.options;
 		this.service = ctx.service;
 	}
-	async serve(event) {
-		return serveWorkflowPage(event, {
-			url: "/activate",
-			baseURL: this.options.baseURL,
-			features: this.options.features,
-			tokenAware: true
-		});
+	/**
+	* The page renders in the auth console service; this hop carries the
+	* request's own parameters over to it. The POST below stays here:
+	* server-core keeps the protocol, the service keeps the render.
+	*/ async serve(event) {
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/activate");
 	}
 	async execute(data, event) {
 		const validated = await new ActivateRequestValidator().run(data);

package/dist/adapters/http/controllers/workflows/activate/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","serveWorkflowPage","ActivateRequestValidator","ActivateController","options","service","ctx","serve","event","url","baseURL","features","tokenAware","execute","data","validator","validated","run","activate","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { ActivatePayload, StatusResponseFeatures } from '@authup/core-http-kit';\nimport type { IRegistrationService } from '../../../../../core/index.ts';\nimport { serveWorkflowPage } from '../../../ui/index.ts';\nimport { ActivateRequestValidator } from './validator.ts';\n\nexport type ActivateControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n};\n\nexport type ActivateControllerContext = {\n    options: ActivateControllerOptions,\n    service: IRegistrationService,\n};\n\n@DController('/activate')\nexport class ActivateController {\n    protected options: ActivateControllerOptions;\n\n    protected service: IRegistrationService;\n\n    constructor(ctx: ActivateControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return serveWorkflowPage(event, {\n            url: '/activate',\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            tokenAware: true,\n        });\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: ActivatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        const validator = new ActivateRequestValidator();\n        const validated = await validator.run(data);\n\n        await this.service.activate(validated);\n\n        event.response.status = 202;\n        return null;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAaO,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAON,kBAAkBO,OAAO;GAC5BC,KAAK;GACLC,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,YAAY;EAChB,CAAA;CACJ;CAEA,MACMC,QACF,MACA,OACa;EAEb,MAAMG,YAAY,MAAMD,IADFb,yBACEa,CAAAA,CAAUE,IAAIH,IAAAA;EAEtC,MAAM,KAAKT,QAAQa,SAASF,SAAAA;EAE5BR,MAAMW,SAASC,SAAS;EACxB,OAAO;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","redirectToAuthConsole","ActivateRequestValidator","ActivateController","options","service","ctx","serve","event","authConsoleUrl","execute","data","validator","validated","run","activate","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { ActivatePayload } from '@authup/core-http-kit';\nimport type { IRegistrationService } from '../../../../../core/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\nimport { ActivateRequestValidator } from './validator.ts';\n\nexport type ActivateControllerOptions = {\n    authConsoleUrl: string,\n};\n\nexport type ActivateControllerContext = {\n    options: ActivateControllerOptions,\n    service: IRegistrationService,\n};\n\n@DController('/activate')\nexport class ActivateController {\n    protected options: ActivateControllerOptions;\n\n    protected service: IRegistrationService;\n\n    constructor(ctx: ActivateControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    /**\n     * The page renders in the auth console service; this hop carries the\n     * request's own parameters over to it. The POST below stays here:\n     * server-core keeps the protocol, the service keeps the render.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/activate');\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: ActivatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        const validator = new ActivateRequestValidator();\n        const validated = await validator.run(data);\n\n        await this.service.activate(validated);\n\n        event.response.status = 202;\n        return null;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA8BA,IAAaO,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;;;;;IAOA,MACME,MAAM,OAAiD;EACzD,OAAON,sBAAsBO,OAAO,KAAKJ,QAAQK,gBAAgB,WAAA;CACrE;CAEA,MACMC,QACF,MACA,OACa;EAEb,MAAMG,YAAY,MAAMD,IADFV,yBACEU,CAAAA,CAAUE,IAAIH,IAAAA;EAEtC,MAAM,KAAKN,QAAQU,SAASF,SAAAA;EAE5BL,MAAMQ,SAASC,SAAS;EACxB,OAAO;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/admin/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/admin/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AdminController } from "./module.mjs";
+export { AdminController };

package/dist/adapters/http/controllers/workflows/admin/module.d.ts

@@ -0,0 +1,30 @@
+import type { IAppEvent } from 'routup';
+import { ConsoleLogin } from '../console-login/index.ts';
+import type { AdminControllerContext, AdminControllerOptions } from './types.ts';
+/**
+ * The admin console's server half (plan 088): the login kick and the code
+ * redemption, bound to the per-realm `admin-console` client.
+ *
+ * The console itself is served by `@authup/server-admin-console`. See
+ * {@link AccountController} for why these two routes stay on the API.
+ */
+export declare class AdminController {
+    protected options: AdminControllerOptions;
+    protected consoleLogin: ConsoleLogin;
+    constructor(ctx: AdminControllerContext);
+    /**
+     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+     * One URL used to mean two things: with a realm the server-side kick,
+     * without one the console's own login PAGE. The page is served by the
+     * console service now, so the kick can no longer fall back to it and the
+     * split became required rather than optional.
+     */
+    login(event: IAppEvent): Promise<Response>;
+    callback(event: IAppEvent): Promise<Response>;
+    /**
+     * Disabled means disabled on the server too: the kick must not mint a
+     * pending login and a session for a console nothing is serving.
+     */
+    protected assertEnabled(): void;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/admin/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/admin/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEjF;;;;;;GAMG;AACH,qBACa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;gBAEzB,GAAG,EAAE,sBAAsB;IAwBvC;;;;;;OAMG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOtD,QAAQ,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAM/D;;;OAGG;IACH,SAAS,CAAC,aAAa,IAAI,IAAI;CAKlC"}

package/dist/adapters/http/controllers/workflows/admin/module.mjs

@@ -0,0 +1,88 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ADMIN_CONSOLE_SEGMENT } from "../../../constants.mjs";
+import { ConsoleLogin } from "../console-login/module.mjs";
+import "../console-login/index.mjs";
+import { CLIENT_ADMIN_CONSOLE_NAME } from "@authup/core-kit";
+import { NotFoundError } from "@ebec/http";
+import { DContext, DController, DGet } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/admin/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var AdminController = class {
+	options;
+	consoleLogin;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.consoleLogin = new ConsoleLogin({
+			clientName: CLIENT_ADMIN_CONSOLE_NAME,
+			segment: ADMIN_CONSOLE_SEGMENT,
+			consoleUrl: ctx.options.consoleUrl,
+			refusalPath: "login"
+		}, {
+			options: { baseURL: ctx.options.baseURL },
+			loginStore: ctx.loginStore,
+			sessionRepository: ctx.sessionRepository,
+			sessionManager: ctx.sessionManager,
+			tokenVerifier: ctx.tokenVerifier,
+			tokenRevoker: ctx.tokenRevoker,
+			logger: ctx.logger
+		});
+	}
+	/**
+	* A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+	* One URL used to mean two things: with a realm the server-side kick,
+	* without one the console's own login PAGE. The page is served by the
+	* console service now, so the kick can no longer fall back to it and the
+	* split became required rather than optional.
+	*/ async login(event) {
+		this.assertEnabled();
+		return this.consoleLogin.login(event);
+	}
+	async callback(event) {
+		this.assertEnabled();
+		return this.consoleLogin.callback(event);
+	}
+	/**
+	* Disabled means disabled on the server too: the kick must not mint a
+	* pending login and a session for a console nothing is serving.
+	*/ assertEnabled() {
+		if (!this.options.enabled) throw new NotFoundError();
+	}
+};
+_ts_decorate([
+	DGet("/login/start", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AdminController.prototype, "login", null);
+_ts_decorate([
+	DGet("/callback", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AdminController.prototype, "callback", null);
+AdminController = _ts_decorate([
+	DController(`/${ADMIN_CONSOLE_SEGMENT}`),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof AdminControllerContext === "undefined" ? Object : AdminControllerContext])
+], AdminController);
+//#endregion
+export { AdminController };
+
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/controllers/workflows/admin/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["CLIENT_ADMIN_CONSOLE_NAME","NotFoundError","DContext","DController","DGet","ADMIN_CONSOLE_SEGMENT","ConsoleLogin","AdminController","options","consoleLogin","ctx","clientName","segment","consoleUrl","refusalPath","baseURL","loginStore","sessionRepository","sessionManager","tokenVerifier","tokenRevoker","logger","login","event","assertEnabled","callback","enabled"],"sources":["../../../../../../src/adapters/http/controllers/workflows/admin/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_ADMIN_CONSOLE_NAME } from '@authup/core-kit';\nimport { NotFoundError } from '@ebec/http';\nimport {\n    DContext,\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { ADMIN_CONSOLE_SEGMENT } from '../../../constants.ts';\nimport { ConsoleLogin } from '../console-login/index.ts';\nimport type { AdminControllerContext, AdminControllerOptions } from './types.ts';\n\n/**\n * The admin console's server half (plan 088): the login kick and the code\n * redemption, bound to the per-realm `admin-console` client.\n *\n * The console itself is served by `@authup/server-admin-console`. See\n * {@link AccountController} for why these two routes stay on the API.\n */\n@DController(`/${ADMIN_CONSOLE_SEGMENT}`)\nexport class AdminController {\n    protected options: AdminControllerOptions;\n\n    protected consoleLogin: ConsoleLogin;\n\n    constructor(ctx: AdminControllerContext) {\n        this.options = ctx.options;\n        this.consoleLogin = new ConsoleLogin(\n            {\n                clientName: CLIENT_ADMIN_CONSOLE_NAME,\n                segment: ADMIN_CONSOLE_SEGMENT,\n                consoleUrl: ctx.options.consoleUrl,\n                // The page that renders the error marker: the console root is\n                // a logged-in page, whose guard would bounce to /login and\n                // drop the query.\n                refusalPath: 'login',\n            },\n            {\n                options: { baseURL: ctx.options.baseURL },\n                loginStore: ctx.loginStore,\n                sessionRepository: ctx.sessionRepository,\n                sessionManager: ctx.sessionManager,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                logger: ctx.logger,\n            },\n        );\n    }\n\n    /**\n     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).\n     * One URL used to mean two things: with a realm the server-side kick,\n     * without one the console's own login PAGE. The page is served by the\n     * console service now, so the kick can no longer fall back to it and the\n     * split became required rather than optional.\n     */\n    @DGet('/login/start', [])\n    async login(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.login(event);\n    }\n\n    @DGet('/callback', [])\n    async callback(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.callback(event);\n    }\n\n    /**\n     * Disabled means disabled on the server too: the kick must not mint a\n     * pending login and a session for a console nothing is serving.\n     */\n    protected assertEnabled(): void {\n        if (!this.options.enabled) {\n            throw new NotFoundError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA2BA,IAAaO,kBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA6B;EACrC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,eAAe,IAAIH,aACpB;GACIK,YAAYX;GACZY,SAASP;GACTQ,YAAYH,IAAIF,QAAQK;GAIxBC,aAAa;EACjB,GACA;GACIN,SAAS,EAAEO,SAASL,IAAIF,QAAQO,QAAQ;GACxCC,YAAYN,IAAIM;GAChBC,mBAAmBP,IAAIO;GACvBC,gBAAgBR,IAAIQ;GACpBC,eAAeT,IAAIS;GACnBC,cAAcV,IAAIU;GAClBC,QAAQX,IAAIW;EAChB,CAAA;CAER;;;;;;;IASA,MACMC,MAAM,OAAiD;EACzD,KAAKE,cAAa;EAElB,OAAO,KAAKf,aAAaa,MAAMC,KAAAA;CACnC;CAEA,MACME,SAAS,OAAiD;EAC5D,KAAKD,cAAa;EAElB,OAAO,KAAKf,aAAagB,SAASF,KAAAA;CACtC;;;;IAMA,gBAAgC;EAC5B,IAAI,CAAC,KAAKf,QAAQkB,SACd,MAAM,IAAIzB,cAAAA;CAElB;AACJ;;;;;;;;;;;;;;;;CA5Dc,YAAA,IAAGI,uBAAAA"}

package/dist/adapters/http/controllers/workflows/admin/types.d.ts

@@ -0,0 +1,14 @@
+import type { ConsoleLoginContext } from '../console-login/index.ts';
+export type AdminControllerOptions = {
+    baseURL: string;
+    /**
+     * Where the console this authenticates for is served. The browser lands
+     * there once the credential is issued, and a refusal renders there.
+     */
+    consoleUrl: string;
+    enabled: boolean;
+};
+export type AdminControllerContext = Omit<ConsoleLoginContext, 'options'> & {
+    options: AdminControllerOptions;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/admin/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/admin/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,GAAG;IACxE,OAAO,EAAE,sBAAsB,CAAC;CACnC,CAAC"}

package/dist/adapters/http/controllers/workflows/auth-console.d.ts

@@ -0,0 +1,16 @@
+import type { IAppEvent } from 'routup';
+/**
+ * Hand a hosted page over to the auth console service (plan 101 D2).
+ *
+ * server-core keeps the protocol: the endpoints, the issuer, every POST
+ * that mints or ends something. What moves is where the page RENDERS, so
+ * these GETs become a stateless hop, with the request's own parameters
+ * re-carried, and nothing decided here.
+ *
+ * Stateless is the point. There is no server-side handle for the pending
+ * request: the request is the application's own public URL, a cookie
+ * handle would clobber across tabs, and a TTL would break the mail-borne
+ * `redirect=` chain that arrives days later.
+ */
+export declare function redirectToAuthConsole(event: IAppEvent, authConsoleUrl: string, page: string, params?: Record<string, any>): Response;
+//# sourceMappingURL=auth-console.d.ts.map

package/dist/adapters/http/controllers/workflows/auth-console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-console.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/controllers/workflows/auth-console.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,QAAQ,CAkBX"}

package/dist/adapters/http/controllers/workflows/auth-console.mjs

@@ -0,0 +1,32 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { sendRedirect } from "routup";
+import { useRequestQuery } from "@routup/basic/query";
+//#region src/adapters/http/controllers/workflows/auth-console.ts
+/**
+* Hand a hosted page over to the auth console service (plan 101 D2).
+*
+* server-core keeps the protocol: the endpoints, the issuer, every POST
+* that mints or ends something. What moves is where the page RENDERS, so
+* these GETs become a stateless hop, with the request's own parameters
+* re-carried, and nothing decided here.
+*
+* Stateless is the point. There is no server-side handle for the pending
+* request: the request is the application's own public URL, a cookie
+* handle would clobber across tabs, and a TTL would break the mail-borne
+* `redirect=` chain that arrives days later.
+*/ function redirectToAuthConsole(event, authConsoleUrl, page, params) {
+	const target = new URL(`${authConsoleUrl.replace(/\/+$/, "")}${page}`);
+	const source = params ?? useRequestQuery(event);
+	for (const [key, value] of Object.entries(source)) {
+		const values = Array.isArray(value) ? value : [value];
+		for (const item of values) if (typeof item !== "undefined" && item !== null) target.searchParams.append(key, `${item}`);
+	}
+	event.response.headers.set("cache-control", "no-store");
+	return sendRedirect(event, target.href);
+}
+//#endregion
+export { redirectToAuthConsole };
+
+//# sourceMappingURL=auth-console.mjs.map

package/dist/adapters/http/controllers/workflows/auth-console.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-console.mjs","names":["useRequestQuery","sendRedirect","redirectToAuthConsole","event","authConsoleUrl","page","params","target","URL","replace","source","key","value","Object","entries","values","Array","isArray","item","searchParams","append","response","headers","set","href"],"sources":["../../../../../src/adapters/http/controllers/workflows/auth-console.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { IAppEvent } from 'routup';\nimport { sendRedirect } from 'routup';\n\n/**\n * Hand a hosted page over to the auth console service (plan 101 D2).\n *\n * server-core keeps the protocol: the endpoints, the issuer, every POST\n * that mints or ends something. What moves is where the page RENDERS, so\n * these GETs become a stateless hop, with the request's own parameters\n * re-carried, and nothing decided here.\n *\n * Stateless is the point. There is no server-side handle for the pending\n * request: the request is the application's own public URL, a cookie\n * handle would clobber across tabs, and a TTL would break the mail-borne\n * `redirect=` chain that arrives days later.\n */\nexport function redirectToAuthConsole(\n    event: IAppEvent,\n    authConsoleUrl: string,\n    page: string,\n    params?: Record<string, any>,\n) : Response {\n    const target = new URL(`${authConsoleUrl.replace(/\\/+$/, '')}${page}`);\n\n    const source = params ?? useRequestQuery(event);\n    for (const [key, value] of Object.entries(source)) {\n        const values = Array.isArray(value) ? value : [value];\n        for (const item of values) {\n            if (typeof item !== 'undefined' && item !== null) {\n                target.searchParams.append(key, `${item}`);\n            }\n        }\n    }\n\n    // The hop reflects the request's own parameters, which routinely carry\n    // an id_token_hint, a token or a redirect. Never let one be cached.\n    event.response.headers.set('cache-control', 'no-store');\n\n    return sendRedirect(event, target.href);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;GAwBA,SAAgBE,sBACZC,OACAC,gBACAC,MACAC,QAA4B;CAE5B,MAAMC,SAAS,IAAIC,IAAI,GAAGJ,eAAeK,QAAQ,QAAQ,EAAA,IAAMJ,MAAM;CAErE,MAAMK,SAASJ,UAAUN,gBAAgBG,KAAAA;CACzC,KAAK,MAAM,CAACQ,KAAKC,UAAUC,OAAOC,QAAQJ,MAAAA,GAAS;EAC/C,MAAMK,SAASC,MAAMC,QAAQL,KAAAA,IAASA,QAAQ,CAACA,KAAM;EACrD,KAAK,MAAMM,QAAQH,QACf,IAAI,OAAOG,SAAS,eAAeA,SAAS,MACxCX,OAAOY,aAAaC,OAAOT,KAAK,GAAGO,MAAM;CAGrD;CAIAf,MAAMkB,SAASC,QAAQC,IAAI,iBAAiB,UAAA;CAE5C,OAAOtB,aAAaE,OAAOI,OAAOiB,IAAI;AAC1C"}

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts

@@ -1,3 +1,4 @@
+import type { Session } from '@authup/core-kit';
 import type { IAppEvent } from 'routup';
 import type { UserAuthenticatorChallengeResponse, UserAuthenticatorChallengeSendPayload, UserAuthenticatorChallengeVerifyPayload, UserAuthenticatorChallengeVerifyResponse } from '@authup/core-http-kit';
 import type { IOAuth2MfaLoginService, ISessionManager, IUserAuthenticatorService } from '../../../../../core/index.ts';
@@ -37,6 +38,7 @@ export declare class AuthenticatorChallengeController {
      */
     protected resolveActor(event: IAppEvent): ChallengeActor;
     status(event: IAppEvent): Promise<UserAuthenticatorChallengeResponse>;
+    protected resolveSession(event: IAppEvent): Promise<Session | null>;
     send(data: UserAuthenticatorChallengeSendPayload, event: IAppEvent): Promise<{
         success: true;
     }>;

package/dist/adapters/http/controllers/workflows/authenticator-challenge/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;IAcxC,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAuEvD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/authenticator-challenge/module.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAKhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EACR,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAQxF,MAAM,MAAM,uCAAuC,GAAG;IAClD,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,eAAe,CAAC;IAChC,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC5C,CAAC;AAEF,KAAK,cAAc,GAAG;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAEa,gCAAgC;IACzC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,cAAc,EAAE,eAAe,CAAC;IAE1C,SAAS,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;gBAEvC,GAAG,EAAE,uCAAuC;IAMxD;;;;;OAKG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc;IAenD,MAAM,CACI,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,kCAAkC,CAAC;cA6C9B,cAAc,CAAC,KAAK,EAAE,SAAS,GAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUpE,IAAI,CACG,IAAI,EAAE,qCAAqC,EACxC,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqBvB,MAAM,CACC,IAAI,EAAE,uCAAuC,EAC1C,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,wCAAwC,CAAC;CAuEvD"}