@authup/server-core 1.0.0-beta.62 → 1.0.0-beta.64

package/dist/adapters/http/cookie/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildSessionCookiePath, setSessionCookie, unsetSessionCookie } from "./session.mjs";
+export { buildSessionCookiePath, setSessionCookie, unsetSessionCookie };

package/dist/adapters/http/cookie/session.d.ts

@@ -0,0 +1,35 @@
+import type { IAppEvent } from 'routup';
+/**
+ * The console session cookie's flags live here, in ONE place, because every
+ * one of them is load-bearing and two copies would drift:
+ *
+ * - `httpOnly` is the whole point of plan 088 (a token in JavaScript is what
+ *   this replaces);
+ * - `sameSite: 'strict'` is the first of the three conditions the gate rests
+ *   on, so the credential never rides a cross-site request;
+ * - `path` is the deployment's base path, never a hard-coded `/`, which under
+ *   a sub-path deployment would hand the cookie to every app co-hosted on the
+ *   host.
+ *
+ * Both writers go through here: the callback that mints the credential, and
+ * the authorization middleware, which re-arms the expiry (see below).
+ */
+export declare function buildSessionCookiePath(baseURL: string): string;
+/**
+ * Write the console session cookie.
+ *
+ * `ttl` is the session's REMAINING lifetime in milliseconds; `Max-Age` is
+ * seconds, so it is divided. Taken literally the millisecond value would emit
+ * a cookie outliving its session by three orders of magnitude.
+ *
+ * This is called on every slide, not only at login. The session's `expiresAt`
+ * moves forward as the user works, but a cookie's `Max-Age` is fixed by the
+ * response that set it: without re-arming, the browser would discard the
+ * credential at login + one lifetime and sign an ACTIVE user out mid-task,
+ * which is precisely the hard cap the sliding-expiry decision rejected. The
+ * server-side slide would still be happening and would simply never be
+ * observable.
+ */
+export declare function setSessionCookie(event: IAppEvent, baseURL: string, value: string, ttl: number): void;
+export declare function unsetSessionCookie(event: IAppEvent, baseURL: string): void;
+//# sourceMappingURL=session.d.ts.map

package/dist/adapters/http/cookie/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/cookie/session.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAI,MAAM,CAE/D;AAUD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC5B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACX,IAAI,CAQP;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAI,IAAI,CAE3E"}

package/dist/adapters/http/cookie/session.mjs

@@ -0,0 +1,62 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { SESSION_COOKIE } from "../../../core/oauth2/session-credential/constants.mjs";
+import "../../../core/index.mjs";
+import { getURLBasePath } from "@authup/kit";
+import { setResponseCookie, unsetResponseCookie } from "@routup/basic/cookie";
+//#region src/adapters/http/cookie/session.ts
+/**
+* The console session cookie's flags live here, in ONE place, because every
+* one of them is load-bearing and two copies would drift:
+*
+* - `httpOnly` is the whole point of plan 088 (a token in JavaScript is what
+*   this replaces);
+* - `sameSite: 'strict'` is the first of the three conditions the gate rests
+*   on, so the credential never rides a cross-site request;
+* - `path` is the deployment's base path, never a hard-coded `/`, which under
+*   a sub-path deployment would hand the cookie to every app co-hosted on the
+*   host.
+*
+* Both writers go through here: the callback that mints the credential, and
+* the authorization middleware, which re-arms the expiry (see below).
+*/ function buildSessionCookiePath(baseURL) {
+	return getURLBasePath(baseURL) || "/";
+}
+function isSecureBaseURL(baseURL) {
+	try {
+		return new URL(baseURL).protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Write the console session cookie.
+*
+* `ttl` is the session's REMAINING lifetime in milliseconds; `Max-Age` is
+* seconds, so it is divided. Taken literally the millisecond value would emit
+* a cookie outliving its session by three orders of magnitude.
+*
+* This is called on every slide, not only at login. The session's `expiresAt`
+* moves forward as the user works, but a cookie's `Max-Age` is fixed by the
+* response that set it: without re-arming, the browser would discard the
+* credential at login + one lifetime and sign an ACTIVE user out mid-task,
+* which is precisely the hard cap the sliding-expiry decision rejected. The
+* server-side slide would still be happening and would simply never be
+* observable.
+*/ function setSessionCookie(event, baseURL, value, ttl) {
+	setResponseCookie(event, SESSION_COOKIE, value, {
+		httpOnly: true,
+		sameSite: "strict",
+		secure: isSecureBaseURL(baseURL),
+		path: buildSessionCookiePath(baseURL),
+		maxAge: Math.floor(ttl / 1e3)
+	});
+}
+function unsetSessionCookie(event, baseURL) {
+	unsetResponseCookie(event, SESSION_COOKIE, { path: buildSessionCookiePath(baseURL) });
+}
+//#endregion
+export { buildSessionCookiePath, setSessionCookie, unsetSessionCookie };
+
+//# sourceMappingURL=session.mjs.map

package/dist/adapters/http/cookie/session.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.mjs","names":["getURLBasePath","setResponseCookie","unsetResponseCookie","SESSION_COOKIE","buildSessionCookiePath","baseURL","isSecureBaseURL","URL","protocol","setSessionCookie","event","value","ttl","httpOnly","sameSite","secure","path","maxAge","Math","floor","unsetSessionCookie"],"sources":["../../../../src/adapters/http/cookie/session.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { getURLBasePath } from '@authup/kit';\nimport { setResponseCookie, unsetResponseCookie } from '@routup/basic/cookie';\nimport type { IAppEvent } from 'routup';\nimport { SESSION_COOKIE } from '../../../core/index.ts';\n\n/**\n * The console session cookie's flags live here, in ONE place, because every\n * one of them is load-bearing and two copies would drift:\n *\n * - `httpOnly` is the whole point of plan 088 (a token in JavaScript is what\n *   this replaces);\n * - `sameSite: 'strict'` is the first of the three conditions the gate rests\n *   on, so the credential never rides a cross-site request;\n * - `path` is the deployment's base path, never a hard-coded `/`, which under\n *   a sub-path deployment would hand the cookie to every app co-hosted on the\n *   host.\n *\n * Both writers go through here: the callback that mints the credential, and\n * the authorization middleware, which re-arms the expiry (see below).\n */\nexport function buildSessionCookiePath(baseURL: string) : string {\n    return getURLBasePath(baseURL) || '/';\n}\n\nfunction isSecureBaseURL(baseURL: string) : boolean {\n    try {\n        return new URL(baseURL).protocol === 'https:';\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Write the console session cookie.\n *\n * `ttl` is the session's REMAINING lifetime in milliseconds; `Max-Age` is\n * seconds, so it is divided. Taken literally the millisecond value would emit\n * a cookie outliving its session by three orders of magnitude.\n *\n * This is called on every slide, not only at login. The session's `expiresAt`\n * moves forward as the user works, but a cookie's `Max-Age` is fixed by the\n * response that set it: without re-arming, the browser would discard the\n * credential at login + one lifetime and sign an ACTIVE user out mid-task,\n * which is precisely the hard cap the sliding-expiry decision rejected. The\n * server-side slide would still be happening and would simply never be\n * observable.\n */\nexport function setSessionCookie(\n    event: IAppEvent,\n    baseURL: string,\n    value: string,\n    ttl: number,\n) : void {\n    setResponseCookie(event, SESSION_COOKIE, value, {\n        httpOnly: true,\n        sameSite: 'strict',\n        secure: isSecureBaseURL(baseURL),\n        path: buildSessionCookiePath(baseURL),\n        maxAge: Math.floor(ttl / 1000),\n    });\n}\n\nexport function unsetSessionCookie(event: IAppEvent, baseURL: string) : void {\n    unsetResponseCookie(event, SESSION_COOKIE, { path: buildSessionCookiePath(baseURL) });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,SAAgBI,uBAAuBC,SAAe;CAClD,OAAOL,eAAeK,OAAAA,KAAY;AACtC;AAEA,SAASC,gBAAgBD,SAAe;CACpC,IAAI;EACA,OAAO,IAAIE,IAAIF,OAAAA,CAAAA,CAASG,aAAa;CACzC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;;;;;GAiBA,SAAgBC,iBACZC,OACAL,SACAM,OACAC,KAAW;CAEXX,kBAAkBS,OAAOP,gBAAgBQ,OAAO;EAC5CE,UAAU;EACVC,UAAU;EACVC,QAAQT,gBAAgBD,OAAAA;EACxBW,MAAMZ,uBAAuBC,OAAAA;EAC7BY,QAAQC,KAAKC,MAAMP,MAAM,GAAA;CAC7B,CAAA;AACJ;AAEA,SAAgBQ,mBAAmBV,OAAkBL,SAAe;CAChEH,oBAAoBQ,OAAOP,gBAAgB,EAAEa,MAAMZ,uBAAuBC,OAAAA,EAAS,CAAA;AACvF"}

package/dist/adapters/http/index.d.ts

@@ -1,5 +1,7 @@
 export * from './adapters/index.ts';
+export * from './constants.ts';
 export * from './controllers/index.ts';
+export * from './internal-client/index.ts';
 export * from './middleware/index.ts';
 export * from './request/index.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/http/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/http/index.ts"],"names":[],"mappings":"AAOA,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC"}

package/dist/adapters/http/index.mjs

@@ -12,21 +12,34 @@ import { readFromLocations } from "./request/helpers/locations.mjs";
 import { setRequestMfaLoginTicket, useRequestMfaLoginTicket } from "./request/helpers/mfa-login-ticket.mjs";
 import { getRequestParamID, getRequestStringParam, getRequestStringParamOrFail, useRequestParamID } from "./request/helpers/param-id.mjs";
 import { applyRouteRealmIDToBody, getRequestRealmID, setRequestRealmID } from "./request/helpers/realm-id.mjs";
-import { sanitizeRelativeRedirect } from "./request/helpers/redirect.mjs";
+import { isSameOriginRequest } from "./request/helpers/same-origin.mjs";
 import { setRequestScopes, useRequestScopes } from "./request/helpers/scopes.mjs";
 import { setRequestSessionId, useRequestSessionId } from "./request/helpers/session-id.mjs";
 import { setRequestToken, useRequestToken } from "./request/helpers/token.mjs";
 import { createRequestEventContextMiddleware, runWithRequestEventContext, useRequestEventContext } from "./request/event-context.mjs";
 import { RequestPermissionEvaluator } from "./request/permission/module.mjs";
 import "./request/index.mjs";
+import { createInternalHttpClient, createPublicToInternalURLRewriter } from "./internal-client/module.mjs";
+import "./internal-client/index.mjs";
+import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
+import { extractOAuth2ClientCertificateEvidence } from "./adapters/oauth2/grant-types/utils/certificate.mjs";
+import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
+import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
+import { readRealmHint } from "./adapters/oauth2/grant-types/utils/realm.mjs";
+import { HTTPOAuth2AuthorizeGrant } from "./adapters/oauth2/grant-types/authorize.mjs";
+import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client-credentials.mjs";
+import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
+import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
+import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
+import "./adapters/index.mjs";
+import { ACCOUNT_CONSOLE_SEGMENT, ADMIN_CONSOLE_SEGMENT, AUTH_CONSOLE_SEGMENT } from "./constants.mjs";
+import { OAUTH2_ISSUANCE_PATHS, isOAuth2IssuancePath, normalizeRequestPath } from "./middleware/built-in/authorization/issuance.mjs";
 import { AuthorizationMiddleware } from "./middleware/built-in/authorization/module.mjs";
 import { createAuthorizationMiddleware } from "./middleware/built-in/authorization/factory.mjs";
 import { ForceLoggedInMiddleware } from "./middleware/built-in/loggedin/module.mjs";
 import { ForceUserLoggedInMiddleware } from "./middleware/built-in/loggedin/user.mjs";
 import { RealmResolverMiddleware } from "./middleware/built-in/realm-resolver/module.mjs";
 import { createRealmResolverMiddleware } from "./middleware/built-in/realm-resolver/factory.mjs";
-import { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme } from "./middleware/built-in/theme.mjs";
-import { VITE_SERVER_STORE_KEY, registerAssetsMiddleware } from "./middleware/built-in/assets.mjs";
 import { registerBasicMiddleware } from "./middleware/built-in/basic.mjs";
 import { registerCorsMiddleware } from "./middleware/built-in/cors.mjs";
 import { registerErrorMiddleware } from "./middleware/built-in/error.mjs";
@@ -34,19 +47,8 @@ import { createLoggerMiddleware, redactSensitiveURLParams } from "./middleware/b
 import { createRouteTemplateNormalizePath, registerPrometheusMiddleware } from "./middleware/built-in/prometheus.mjs";
 import { registerRateLimitMiddleware } from "./middleware/built-in/rate-limit.mjs";
 import { createSwaggerMiddleware } from "./middleware/built-in/swagger.mjs";
-import { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware } from "./middleware/built-in/ui-http-client.mjs";
+import { INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY, registerInternalHttpClientMiddleware } from "./middleware/built-in/internal-http-client.mjs";
 import "./middleware/index.mjs";
-import { HTTPOAuth2Authorizer } from "./adapters/oauth2/authorization/module.mjs";
-import { extractOAuth2ClientCertificateEvidence } from "./adapters/oauth2/grant-types/utils/certificate.mjs";
-import { extractClientCredentialsFromRequest, readStringField } from "./adapters/oauth2/grant-types/utils/credentials.mjs";
-import { guessOauth2GrantTypeByRequest } from "./adapters/oauth2/grant-types/utils/guess.mjs";
-import { readRealmHint } from "./adapters/oauth2/grant-types/utils/realm.mjs";
-import { HTTPOAuth2AuthorizeGrant } from "./adapters/oauth2/grant-types/authorize.mjs";
-import { HTTPClientCredentialsGrant } from "./adapters/oauth2/grant-types/client-credentials.mjs";
-import { HTTPOAuth2IdentityGrantType } from "./adapters/oauth2/grant-types/identity.mjs";
-import { HTTPPasswordGrant } from "./adapters/oauth2/grant-types/password.mjs";
-import { HTTPOAuth2RefreshTokenGrant } from "./adapters/oauth2/grant-types/refresh_token.mjs";
-import "./adapters/index.mjs";
 import { ClientController } from "./controllers/entities/client/module.mjs";
 import { ClientPermissionController } from "./controllers/entities/client-permission/module.mjs";
 import { ClientPermissionRequestValidator } from "./controllers/entities/client-permission/utils/validation.mjs";
@@ -62,8 +64,10 @@ import { IdentityProviderRoleMappingController } from "./controllers/entities/id
 import { KeyController } from "./controllers/entities/key/module.mjs";
 import { PermissionController } from "./controllers/entities/permission/module.mjs";
 import { PermissionPolicyController } from "./controllers/entities/permission-policy/module.mjs";
+import { ConsoleLogin } from "./controllers/workflows/console-login/module.mjs";
 import { AccountController } from "./controllers/workflows/account/module.mjs";
 import { ActivateController } from "./controllers/workflows/activate/module.mjs";
+import { AdminController } from "./controllers/workflows/admin/module.mjs";
 import { AuthenticatorChallengeController } from "./controllers/workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./controllers/workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./controllers/workflows/jwks/handlers/read.mjs";
@@ -98,4 +102,4 @@ import { UserPermissionRequestValidator } from "./controllers/entities/user-perm
 import { UserRoleController } from "./controllers/entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./controllers/entities/user-role/utils/validation.mjs";
 import "./controllers/index.mjs";
-export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, THEME_STORE_KEY, TokenController, TrustAnchorController, UI_HTTP_CLIENT_FACTORY_STORE_KEY, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, VITE_SERVER_STORE_KEY, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createLoggerMiddleware, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerAssetsMiddleware, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, registerThemeMiddleware, registerUIHttpClientMiddleware, runWithRequestEventContext, sanitizeRelativeRedirect, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestTheme, useRequestToken };
+export { ACCOUNT_CONSOLE_SEGMENT, ADMIN_CONSOLE_SEGMENT, AUTH_CONSOLE_SEGMENT, AccountController, ActivateController, AdminController, AuthenticatorChallengeController, AuthorizationMiddleware, AuthorizeController, CERTIFICATE_SOURCES, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, ConsoleLogin, EventController, ForceLoggedInMiddleware, ForceUserLoggedInMiddleware, HTTPClientCredentialsGrant, HTTPOAuth2AuthorizeGrant, HTTPOAuth2Authorizer, HTTPOAuth2IdentityGrantType, HTTPOAuth2RefreshTokenGrant, HTTPPasswordGrant, INTERNAL_HTTP_CLIENT_FACTORY_STORE_KEY, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LOCALE_COOKIE, LogoutController, OAUTH2_ISSUANCE_PATHS, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RealmResolverMiddleware, RegisterController, RequestHandlerOperation, RequestIdentity, RequestPermissionEvaluator, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, applyRouteRealmIDToBody, buildActorContext, createAuthorizationMiddleware, createInternalHttpClient, createLoggerMiddleware, createPublicToInternalURLRewriter, createRealmResolverMiddleware, createRequestEventContextMiddleware, createRouteTemplateNormalizePath, createSwaggerMiddleware, extractClientCertificateEvidence, extractClientCredentialsFromRequest, extractOAuth2ClientCertificateEvidence, getBodyRealmID, getJwkRouteHandler, getJwksRouteHandler, getRequestParamID, getRequestRealmID, getRequestStringParam, getRequestStringParamOrFail, guessOauth2GrantTypeByRequest, isOAuth2IssuancePath, isSameOriginRequest, normalizeRequestPath, readFromLocations, readRealmHint, readStringField, redactSensitiveURLParams, registerBasicMiddleware, registerCorsMiddleware, registerErrorMiddleware, registerInternalHttpClientMiddleware, registerPrometheusMiddleware, registerRateLimitMiddleware, runWithRequestEventContext, setRequestIdentity, setRequestMfaLoginTicket, setRequestPermissionEvaluator, setRequestRealmID, setRequestScopes, setRequestSessionId, setRequestToken, useRequestEventContext, useRequestIdentity, useRequestIdentityOrFail, useRequestLocale, useRequestMfaLoginTicket, useRequestParamID, useRequestPermissionEvaluator, useRequestScopes, useRequestSessionId, useRequestToken };

package/dist/adapters/http/internal-client/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/internal-client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/internal-client/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/internal-client/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { createInternalHttpClient, createPublicToInternalURLRewriter } from "./module.mjs";
+export { createInternalHttpClient, createPublicToInternalURLRewriter };

package/dist/adapters/http/internal-client/module.d.ts

@@ -0,0 +1,21 @@
+import type { IClient } from '@authup/core-http-kit';
+import type { InternalHttpClientContext } from './types.ts';
+/**
+ * Build a rewriter that maps URLs under the public base URL
+ * (scheme://host[/prefix]) onto the server's own listen address. URLs
+ * outside the public origin/prefix pass through untouched.
+ */
+export declare function createPublicToInternalURLRewriter(publicURL: string, internalURL: string): (url: string) => string;
+/**
+ * HTTP client for this server's calls to its own API: they are dispatched
+ * against its own listen address, so there is no reverse-proxy round-trip,
+ * no TLS (a self-signed publicUrl certificate would otherwise fail Node's
+ * fetch) and no dependency on the public hostname resolving from inside the
+ * deployment. Its one consumer is the console login's token exchange.
+ *
+ * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the
+ * public URL because the values derived from it are user-facing, and a
+ * `redirect_uri` in particular is compared byte for byte at redemption.
+ */
+export declare function createInternalHttpClient(ctx: InternalHttpClientContext): IClient;
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/internal-client/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/internal-client/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC7C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GACnB,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAmC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,yBAAyB,GAAI,OAAO,CAOjF"}

package/dist/adapters/http/{ui/auth-console/http-client.mjs → internal-client/module.mjs}

@@ -3,7 +3,7 @@ import "node:url";
 import.meta.url;
 import { FetchTransport, fetch } from "hapic";
 import { Client } from "@authup/core-http-kit";
-//#region src/adapters/http/ui/auth-console/http-client.ts
+//#region src/adapters/http/internal-client/module.ts
 /**
 * Build a rewriter that maps URLs under the public base URL
 * (scheme://host[/prefix]) onto the server's own listen address. URLs
@@ -22,24 +22,25 @@ import { Client } from "@authup/core-http-kit";
 		}
 		if (parsed.origin !== publicParsed.origin) return url;
 		let { pathname } = parsed;
-		if (basePath) if (pathname === basePath) pathname = "/";
-		else if (pathname.startsWith(`${basePath}/`)) pathname = pathname.substring(basePath.length);
-		else return url;
+		if (basePath) {
+			if (pathname === basePath) pathname = "/";
+			else if (pathname.startsWith(`${basePath}/`)) pathname = pathname.substring(basePath.length);
+			else return url;
+		}
 		return new URL(pathname + parsed.search, internalParsed.origin).href;
 	};
 }
 /**
-* HTTP client for the SSR'd UI pages: the render's API calls target the
-* server itself, so they are dispatched against its own listen address —
-* no reverse-proxy round-trip, no TLS (a self-signed publicUrl certificate
-* would otherwise fail Node's fetch), no dependency on the public hostname
-* resolving from inside the deployment.
+* HTTP client for this server's calls to its own API: they are dispatched
+* against its own listen address, so there is no reverse-proxy round-trip,
+* no TLS (a self-signed publicUrl certificate would otherwise fail Node's
+* fetch) and no dependency on the public hostname resolving from inside the
+* deployment. Its one consumer is the console login's token exchange.
 *
 * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the
-* public URL because the rendered HTML derives user-facing URLs from it
-* (e.g. the identity-provider authorize hrefs via `getAuthorizeUri`), and
-* hydration does not patch attribute mismatches.
-*/ function createInternalUIHttpClient(ctx) {
+* public URL because the values derived from it are user-facing, and a
+* `redirect_uri` in particular is compared byte for byte at redemption.
+*/ function createInternalHttpClient(ctx) {
 	const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);
 	return new Client({
 		baseURL: ctx.publicURL,
@@ -47,6 +48,6 @@ import { Client } from "@authup/core-http-kit";
 	});
 }
 //#endregion
-export { createInternalUIHttpClient, createPublicToInternalURLRewriter };
+export { createInternalHttpClient, createPublicToInternalURLRewriter };
 
-//# sourceMappingURL=http-client.mjs.map
+//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/internal-client/module.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.mjs","names":["Client","FetchTransport","fetch","createPublicToInternalURLRewriter","publicURL","internalURL","publicParsed","URL","internalParsed","hostname","basePath","pathname","replace","url","parsed","origin","startsWith","substring","length","search","href","createInternalHttpClient","ctx","rewriteURL","baseURL","transport","input","init"],"sources":["../../../../src/adapters/http/internal-client/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { Client } from '@authup/core-http-kit';\nimport type { IClient } from '@authup/core-http-kit';\nimport { FetchTransport, fetch } from 'hapic';\nimport type { InternalHttpClientContext } from './types.ts';\n\n/**\n * Build a rewriter that maps URLs under the public base URL\n * (scheme://host[/prefix]) onto the server's own listen address. URLs\n * outside the public origin/prefix pass through untouched.\n */\nexport function createPublicToInternalURLRewriter(\n    publicURL: string,\n    internalURL: string,\n) : (url: string) => string {\n    const publicParsed = new URL(publicURL);\n    const internalParsed = new URL(internalURL);\n    // a wildcard listen address (0.0.0.0 / [::]) is not reliably dialable —\n    // loop back explicitly\n    if (internalParsed.hostname === '0.0.0.0' || internalParsed.hostname === '[::]') {\n        internalParsed.hostname = '127.0.0.1';\n    }\n    const basePath = publicParsed.pathname.replace(/\\/+$/, '');\n\n    return (url: string) => {\n        let parsed : URL;\n        try {\n            parsed = new URL(url);\n        } catch {\n            return url;\n        }\n\n        if (parsed.origin !== publicParsed.origin) {\n            return url;\n        }\n\n        let { pathname } = parsed;\n        if (basePath) {\n            if (pathname === basePath) {\n                pathname = '/';\n            } else if (pathname.startsWith(`${basePath}/`)) {\n                pathname = pathname.substring(basePath.length);\n            } else {\n                return url;\n            }\n        }\n\n        return new URL(pathname + parsed.search, internalParsed.origin).href;\n    };\n}\n\n/**\n * HTTP client for this server's calls to its own API: they are dispatched\n * against its own listen address, so there is no reverse-proxy round-trip,\n * no TLS (a self-signed publicUrl certificate would otherwise fail Node's\n * fetch) and no dependency on the public hostname resolving from inside the\n * deployment. Its one consumer is the console login's token exchange.\n *\n * The rewrite happens at the TRANSPORT layer only: `baseURL` must stay the\n * public URL because the values derived from it are user-facing, and a\n * `redirect_uri` in particular is compared byte for byte at redemption.\n */\nexport function createInternalHttpClient(ctx: InternalHttpClientContext) : IClient {\n    const rewriteURL = createPublicToInternalURLRewriter(ctx.publicURL, ctx.internalURL);\n\n    return new Client({\n        baseURL: ctx.publicURL,\n        transport: new FetchTransport({ fetch: (input, init) => fetch(rewriteURL(input), init) }),\n    });\n}\n"],"mappings":";;;;;;;;;;GAiBA,SAAgBG,kCACZC,WACAC,aAAmB;CAEnB,MAAMC,eAAe,IAAIC,IAAIH,SAAAA;CAC7B,MAAMI,iBAAiB,IAAID,IAAIF,WAAAA;CAG/B,IAAIG,eAAeC,aAAa,aAAaD,eAAeC,aAAa,QACrED,eAAeC,WAAW;CAE9B,MAAMC,WAAWJ,aAAaK,SAASC,QAAQ,QAAQ,EAAA;CAEvD,QAAQC,QAAAA;EACJ,IAAIC;EACJ,IAAI;GACAA,SAAS,IAAIP,IAAIM,GAAAA;EACrB,QAAQ;GACJ,OAAOA;EACX;EAEA,IAAIC,OAAOC,WAAWT,aAAaS,QAC/B,OAAOF;EAGX,IAAI,EAAEF,aAAaG;EACnB,IAAIJ,UAAU;GACV,IAAIC,aAAaD,UACbC,WAAW;QACR,IAAIA,SAASK,WAAW,GAAGN,SAAS,EAAE,GACzCC,WAAWA,SAASM,UAAUP,SAASQ,MAAM;QAE7C,OAAOL;EAEf;EAEA,OAAO,IAAIN,IAAII,WAAWG,OAAOK,QAAQX,eAAeO,MAAM,CAAA,CAAEK;CACpE;AACJ;;;;;;;;;;;GAaA,SAAgBC,yBAAyBC,KAA8B;CACnE,MAAMC,aAAapB,kCAAkCmB,IAAIlB,WAAWkB,IAAIjB,WAAW;CAEnF,OAAO,IAAIL,OAAO;EACdwB,SAASF,IAAIlB;EACbqB,WAAW,IAAIxB,eAAe,EAAEC,QAAQwB,OAAOC,SAASzB,MAAMqB,WAAWG,KAAAA,GAAQC,IAAAA,EAAM,CAAA;CAC3F,CAAA;AACJ"}

package/dist/adapters/http/internal-client/types.d.ts

@@ -0,0 +1,13 @@
+export type InternalHttpClientContext = {
+    /**
+     * The public base URL (config `publicUrl`) — stays the client's
+     * `baseURL` so URLs derived from it remain user-facing.
+     */
+    publicURL: string;
+    /**
+     * The server's own listen address (e.g. http://localhost:3010/) —
+     * where the transport actually dispatches requests.
+     */
+    internalURL: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/internal-client/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/http/internal-client/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/adapters/http/middleware/built-in/authorization/index.d.ts

@@ -1,3 +1,4 @@
+export * from './issuance.ts';
 export * from './module.ts';
 export * from './factory.ts';
 export * from './types.ts';

package/dist/adapters/http/middleware/built-in/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/index.ts"],"names":[],"mappings":"AAOA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/middleware/built-in/authorization/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { OAUTH2_ISSUANCE_PATHS, isOAuth2IssuancePath, normalizeRequestPath } from "./issuance.mjs";
 import { AuthorizationMiddleware } from "./module.mjs";
 import { createAuthorizationMiddleware } from "./factory.mjs";
-export { AuthorizationMiddleware, createAuthorizationMiddleware };
+export { AuthorizationMiddleware, OAUTH2_ISSUANCE_PATHS, createAuthorizationMiddleware, isOAuth2IssuancePath, normalizeRequestPath };

package/dist/adapters/http/middleware/built-in/authorization/issuance.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The OAuth2 issuance surface a cookie credential must NEVER reach (plan 088).
+ *
+ * An ambient origin-wide cookie fills the identity slot every one of these
+ * routes reads, so without this list one script execution anywhere on the IdP
+ * origin could POST `/authorize` with its own PKCE challenge against the
+ * `account-console` client (public, `builtIn` and therefore auto-consenting),
+ * carry the code to `/token` and walk away with a full token pair. The cookie
+ * would have converted itself back into a portable bearer, and `HttpOnly`
+ * would have bought exactly one hop.
+ *
+ * Nothing legitimate is excluded: the hosted auth console posts its consent
+ * with its own bearer, and the account-link routes are deliberately absent
+ * (completing one requires an interactive login at an external provider inside
+ * the victim's browser, which same-origin script cannot drive).
+ *
+ * `HTTPOAuth2IdentityGrantType` is unregistered today but mints a grant
+ * straight from the request identity, so it would become live the day it is
+ * wired. Do not narrow this list without re-reading plan 088, finding 2.
+ */
+export declare const OAUTH2_ISSUANCE_PATHS: string[];
+/**
+ * Normalize a request path the way routup's matcher sees it.
+ *
+ * The check runs in the middleware, on `event.path`, BEFORE routing, so an
+ * equality test against the raw pathname would miss a request that still
+ * reaches the handler. Two properties of the matcher matter (path-to-regexp
+ * v8, as routup configures it):
+ *
+ * - it is **case insensitive** (no `sensitive` option is passed), so `/TOKEN`
+ *   routes to the token controller;
+ * - it tolerates ONE trailing slash (`/token/`).
+ *
+ * Repeated slashes are collapsed as well. Those do not route (`//token`
+ * matches nothing), so collapsing can only widen the refusal, which is the
+ * safe direction: a denied path merely stays anonymous.
+ */
+export declare function normalizeRequestPath(input: string): string;
+/**
+ * Whether the path addresses the OAuth2 issuance surface (the route itself or
+ * anything below it: `/token/introspect`, `/token/revoke`, and whatever a
+ * later mount adds under these prefixes).
+ */
+export declare function isOAuth2IssuancePath(input: string): boolean;
+//# sourceMappingURL=issuance.d.ts.map

package/dist/adapters/http/middleware/built-in/authorization/issuance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuance.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/issuance.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,EAAG,MAAM,EAI1C,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,MAAM,CAO3D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAI,OAAO,CAU5D"}

package/dist/adapters/http/middleware/built-in/authorization/issuance.mjs

@@ -0,0 +1,61 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/http/middleware/built-in/authorization/issuance.ts
+/**
+* The OAuth2 issuance surface a cookie credential must NEVER reach (plan 088).
+*
+* An ambient origin-wide cookie fills the identity slot every one of these
+* routes reads, so without this list one script execution anywhere on the IdP
+* origin could POST `/authorize` with its own PKCE challenge against the
+* `account-console` client (public, `builtIn` and therefore auto-consenting),
+* carry the code to `/token` and walk away with a full token pair. The cookie
+* would have converted itself back into a portable bearer, and `HttpOnly`
+* would have bought exactly one hop.
+*
+* Nothing legitimate is excluded: the hosted auth console posts its consent
+* with its own bearer, and the account-link routes are deliberately absent
+* (completing one requires an interactive login at an external provider inside
+* the victim's browser, which same-origin script cannot drive).
+*
+* `HTTPOAuth2IdentityGrantType` is unregistered today but mints a grant
+* straight from the request identity, so it would become live the day it is
+* wired. Do not narrow this list without re-reading plan 088, finding 2.
+*/ const OAUTH2_ISSUANCE_PATHS = [
+	"/authorize",
+	"/token",
+	"/logout"
+];
+/**
+* Normalize a request path the way routup's matcher sees it.
+*
+* The check runs in the middleware, on `event.path`, BEFORE routing, so an
+* equality test against the raw pathname would miss a request that still
+* reaches the handler. Two properties of the matcher matter (path-to-regexp
+* v8, as routup configures it):
+*
+* - it is **case insensitive** (no `sensitive` option is passed), so `/TOKEN`
+*   routes to the token controller;
+* - it tolerates ONE trailing slash (`/token/`).
+*
+* Repeated slashes are collapsed as well. Those do not route (`//token`
+* matches nothing), so collapsing can only widen the refusal, which is the
+* safe direction: a denied path merely stays anonymous.
+*/ function normalizeRequestPath(input) {
+	const value = input.toLowerCase().replace(/\/+/g, "/");
+	if (value.length > 1 && value.endsWith("/")) return value.replace(/\/+$/, "") || "/";
+	return value;
+}
+/**
+* Whether the path addresses the OAuth2 issuance surface (the route itself or
+* anything below it: `/token/introspect`, `/token/revoke`, and whatever a
+* later mount adds under these prefixes).
+*/ function isOAuth2IssuancePath(input) {
+	const path = normalizeRequestPath(input);
+	for (const entry of OAUTH2_ISSUANCE_PATHS) if (path === entry || path.startsWith(`${entry}/`)) return true;
+	return false;
+}
+//#endregion
+export { OAUTH2_ISSUANCE_PATHS, isOAuth2IssuancePath, normalizeRequestPath };
+
+//# sourceMappingURL=issuance.mjs.map

package/dist/adapters/http/middleware/built-in/authorization/issuance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuance.mjs","names":["OAUTH2_ISSUANCE_PATHS","normalizeRequestPath","input","value","toLowerCase","replace","length","endsWith","isOAuth2IssuancePath","path","entry","startsWith"],"sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/issuance.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * The OAuth2 issuance surface a cookie credential must NEVER reach (plan 088).\n *\n * An ambient origin-wide cookie fills the identity slot every one of these\n * routes reads, so without this list one script execution anywhere on the IdP\n * origin could POST `/authorize` with its own PKCE challenge against the\n * `account-console` client (public, `builtIn` and therefore auto-consenting),\n * carry the code to `/token` and walk away with a full token pair. The cookie\n * would have converted itself back into a portable bearer, and `HttpOnly`\n * would have bought exactly one hop.\n *\n * Nothing legitimate is excluded: the hosted auth console posts its consent\n * with its own bearer, and the account-link routes are deliberately absent\n * (completing one requires an interactive login at an external provider inside\n * the victim's browser, which same-origin script cannot drive).\n *\n * `HTTPOAuth2IdentityGrantType` is unregistered today but mints a grant\n * straight from the request identity, so it would become live the day it is\n * wired. Do not narrow this list without re-reading plan 088, finding 2.\n */\nexport const OAUTH2_ISSUANCE_PATHS : string[] = [\n    '/authorize',\n    '/token',\n    '/logout',\n];\n\n/**\n * Normalize a request path the way routup's matcher sees it.\n *\n * The check runs in the middleware, on `event.path`, BEFORE routing, so an\n * equality test against the raw pathname would miss a request that still\n * reaches the handler. Two properties of the matcher matter (path-to-regexp\n * v8, as routup configures it):\n *\n * - it is **case insensitive** (no `sensitive` option is passed), so `/TOKEN`\n *   routes to the token controller;\n * - it tolerates ONE trailing slash (`/token/`).\n *\n * Repeated slashes are collapsed as well. Those do not route (`//token`\n * matches nothing), so collapsing can only widen the refusal, which is the\n * safe direction: a denied path merely stays anonymous.\n */\nexport function normalizeRequestPath(input: string) : string {\n    const value = input.toLowerCase().replace(/\\/+/g, '/');\n    if (value.length > 1 && value.endsWith('/')) {\n        return value.replace(/\\/+$/, '') || '/';\n    }\n\n    return value;\n}\n\n/**\n * Whether the path addresses the OAuth2 issuance surface (the route itself or\n * anything below it: `/token/introspect`, `/token/revoke`, and whatever a\n * later mount adds under these prefixes).\n */\nexport function isOAuth2IssuancePath(input: string) : boolean {\n    const path = normalizeRequestPath(input);\n\n    for (const entry of OAUTH2_ISSUANCE_PATHS) {\n        if (path === entry || path.startsWith(`${entry}/`)) {\n            return true;\n        }\n    }\n\n    return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAaA,wBAAmC;CAC5C;CACA;CACA;AACH;;;;;;;;;;;;;;;;GAkBD,SAAgBC,qBAAqBC,OAAa;CAC9C,MAAMC,QAAQD,MAAME,YAAW,CAAA,CAAGC,QAAQ,QAAQ,GAAA;CAClD,IAAIF,MAAMG,SAAS,KAAKH,MAAMI,SAAS,GAAA,GACnC,OAAOJ,MAAME,QAAQ,QAAQ,EAAA,KAAO;CAGxC,OAAOF;AACX;;;;;GAOA,SAAgBK,qBAAqBN,OAAa;CAC9C,MAAMO,OAAOR,qBAAqBC,KAAAA;CAElC,KAAK,MAAMQ,SAASV,uBAChB,IAAIS,SAASC,SAASD,KAAKE,WAAW,GAAGD,MAAM,EAAE,GAC7C,OAAO;CAIf,OAAO;AACX"}

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts

@@ -1,9 +1,10 @@
 import type { IPermissionEvaluator } from '@authup/access';
-import type { Client, User } from '@authup/core-kit';
+import type { Client, Session, User } from '@authup/core-kit';
+import type { Logger } from '@authup/server-kit';
 import type { OAuth2TokenPayload } from '@authup/specs';
 import type { IAppEvent } from 'routup';
 import { type BasicAuthorizationHeader, type BearerAuthorizationHeader } from 'hapic';
-import type { ICredentialsAuthenticator, IIdentityResolver, IOAuth2TokenVerifier, ISessionManager } from '../../../../../core/index.ts';
+import type { ICredentialsAuthenticator, IIdentityResolver, IOAuth2TokenVerifier, ISessionManager, ISessionRepository } from '../../../../../core/index.ts';
 import type { HTTPAuthorizationMiddlewareContext, HTTPAuthorizationMiddlewareOptions } from './types.ts';
 export declare class AuthorizationMiddleware {
     protected options: HTTPAuthorizationMiddlewareOptions;
@@ -11,11 +12,34 @@ export declare class AuthorizationMiddleware {
     protected permissionEvaluator: IPermissionEvaluator;
     protected identityResolver: IIdentityResolver;
     protected sessionManager: ISessionManager;
+    protected sessionRepository: ISessionRepository;
+    protected logger?: Logger;
     protected clientAuthenticator: ICredentialsAuthenticator<Client>;
     protected userAuthenticator: ICredentialsAuthenticator<User>;
     constructor(ctx: HTTPAuthorizationMiddlewareContext);
     run(event: IAppEvent): Promise<void>;
     protected runInner(event: IAppEvent): Promise<void>;
+    /**
+     * The console session cookie (plan 088): an opaque credential naming an
+     * `auth_sessions` row, presented instead of a bearer token by a console
+     * served from the API's own origin.
+     *
+     * It NEVER throws and never rejects a request. Anything missing, stale or
+     * refused simply leaves the request anonymous, which the route's own
+     * `ForceLoggedIn` guard then answers — the same outcome as sending no
+     * credential at all. A cookie is ambient, so a request that merely carries
+     * a bad one is not necessarily a request that meant to use it.
+     */
+    protected runCookieSession(event: IAppEvent): Promise<void>;
+    /**
+     * Slide the session's expiry, throttled.
+     *
+     * Cookie mode has no refresh grant, so without this an active console user
+     * would be signed out once the session reached its lifetime, mid-task
+     * (plan 088: a credential change must not become a session-policy change
+     * by omission).
+     */
+    protected refreshCookieSession(event: IAppEvent, session: Session, secret: string): Promise<void>;
     /**
      * @throws JWTError
      */

package/dist/adapters/http/middleware/built-in/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAMrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAOf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAClB,MAAM,8BAA8B,CAAC;AAYtC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAIzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAI3C,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAqB7C,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;cAmB1B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BzD;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+BvC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/middleware/built-in/authorization/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAM9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAEH,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAEjC,MAAM,OAAO,CAAC;AAWf,OAAO,KAAK,EACR,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AActC,OAAO,KAAK,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC;AAIzG,qBAAa,uBAAuB;IAChC,SAAS,CAAC,OAAO,EAAE,kCAAkC,CAAC;IAItD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAIpD,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAE9C,SAAS,CAAC,cAAc,EAAG,eAAe,CAAC;IAE3C,SAAS,CAAC,iBAAiB,EAAG,kBAAkB,CAAC;IAEjD,SAAS,CAAC,MAAM,CAAC,EAAG,MAAM,CAAC;IAI3B,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,SAAS,CAAC,iBAAiB,EAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIlD,GAAG,EAAE,kCAAkC;IAuB7C,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;cAmB1B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BzD;;;;;;;;;;OAUG;cACa,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAuEjE;;;;;;;OAOG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAiChB;;OAEG;cACa,+BAA+B,CAC3C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,yBAAyB;cAgErB,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtG;;;;;;;;;OASG;cACa,oBAAoB,CAChC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,kBAAkB;cAsDf,8BAA8B,CAC1C,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,wBAAwB;CA+BvC"}