@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/utils/error.d.ts

@@ -15,6 +15,12 @@ import { AuthupError } from '@authup/errors';
  * the adapter — this function only assigns a semantic `code`.
  */
 export declare function sanitizeError(input: unknown): AuthupError;
+/**
+ * The `cause` chain of an error, rendered innermost-last. Exported because a
+ * CLI reports the reason without the stack `describeError` carries: a parse
+ * failure names the file, and only its cause says what is wrong inside it.
+ */
+export declare function describeCauseChain(input: unknown): string | undefined;
 /**
  * Render an error for the LOG. It is the counterpart of `@authup/errors`'
  * `serializeError`, which renders one for the response.

package/dist/utils/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,WAAW,EAKd,MAAM,gBAAgB,CAAC;AAQxB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CA8FzD;AA0ED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BvE"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,WAAW,EAKd,MAAM,gBAAgB,CAAC;AAQxB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CA8FzD;AAuDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAiBrE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BvE"}

package/dist/utils/error.mjs

@@ -122,7 +122,11 @@ function describeCauseLink(input) {
 	if (details.length > 0) parts.push(`(${details.join(" ")})`);
 	return parts.join(" ");
 }
-function describeCauseChain(input) {
+/**
+* The `cause` chain of an error, rendered innermost-last. Exported because a
+* CLI reports the reason without the stack `describeError` carries: a parse
+* failure names the file, and only its cause says what is wrong inside it.
+*/ function describeCauseChain(input) {
 	const links = [];
 	const seen = /* @__PURE__ */ new Set();
 	let current = isObject(input) ? input.cause : void 0;
@@ -163,6 +167,6 @@ function describeCauseChain(input) {
 	return lines.join("\n");
 }
 //#endregion
-export { describeError, sanitizeError };
+export { describeCauseChain, describeError, sanitizeError };
 
 //# sourceMappingURL=error.mjs.map

package/dist/utils/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":["AuthupError","ErrorCode","codeFromHttpStatus","isAuthupError","normalizeError","isHTTPError","isClientError","CodecError","ParseError","EntityRelationLookupError","buildErrorMessageForAttributes","isValidupError","stringifyPath","hasOwnProperty","isObject","sanitizeError","input","code","ENTITY_RELATION_INVALID","message","stack","paths","issues","map","issue","path","BAD_REQUEST","UPSTREAM_ERROR","status","undefined","ENTITY_CONFLICT","STORAGE_INSUFFICIENT","INTERNAL_ERROR","DESCRIBE_BODY_MAX_LENGTH","DESCRIBE_CAUSE_MAX_DEPTH","DESCRIBE_CAUSE_KEYS","describeBody","value","JSON","stringify","String","Object","prototype","toString","call","length","substring","describeCauseLink","error","name","parts","details","key","push","join","describeCauseChain","links","seen","Set","current","cause","has","add","describeError","headline","lines","response","body","data","causes"],"sources":["../../src/utils/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AuthupError,\n    ErrorCode,\n    codeFromHttpStatus,\n    isAuthupError,\n    normalizeError,\n} from '@authup/errors';\nimport { isHTTPError } from '@ebec/http';\nimport { isClientError } from 'hapic';\nimport { CodecError, ParseError } from '@rapiq/core';\nimport { EntityRelationLookupError } from 'typeorm-extension';\nimport { buildErrorMessageForAttributes, isValidupError, stringifyPath } from 'validup';\nimport { hasOwnProperty, isObject } from '@authup/kit';\n\n/**\n * Normalize an unknown error to an AuthupError. Recognised shapes:\n *\n * 1. AuthupError instance              → returned as-is\n * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError\n * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues\n * 4. rapiq ParseError / CodecError     → BAD_REQUEST AuthupError (client wire query)\n * 5. hapic ClientError                 → UPSTREAM_ERROR AuthupError (outbound call)\n * 6. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code\n * 7. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT\n * 8. anything else                     → INTERNAL_ERROR AuthupError\n *\n * The HTTP-status concern is handled separately by `httpStatusFromCode` in\n * the adapter — this function only assigns a semantic `code`.\n */\nexport function sanitizeError(input: unknown): AuthupError {\n    if (isAuthupError(input)) {\n        return input;\n    }\n\n    if (input instanceof EntityRelationLookupError) {\n        return new AuthupError({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isValidupError(input)) {\n        const paths = input.issues.map((issue) => stringifyPath(issue.path));\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            stack: input.stack,\n            message: input.message || buildErrorMessageForAttributes(paths),\n            issues: input.issues,\n        });\n    }\n\n    if (input instanceof ParseError || input instanceof CodecError) {\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    /**\n     * An outbound call failed. This branch MUST precede the `isHTTPError`\n     * one below: a hapic `HttpResponseError` extends `BaseError` and carries\n     * the upstream `status`, so the duck guard matches it and would mirror\n     * that status onto our own response. An upstream 400 would then read as\n     * \"your request was malformed\" when the caller's request was fine.\n     *\n     * The message is deliberately dropped rather than forwarded: hapic\n     * embeds the outbound method and URL in it (`400 Bad Request (POST\n     * https://idp.example.com/token)`), which must not reach the caller.\n     * `describeError` is what carries the detail, into the log only.\n     */\n    if (isClientError(input)) {\n        return new AuthupError({\n            code: ErrorCode.UPSTREAM_ERROR,\n            message: 'A request to an upstream service failed.',\n            stack: input.stack,\n        });\n    }\n\n    if (isHTTPError(input)) {\n        return new AuthupError({\n            code: codeFromHttpStatus(input.status),\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isObject(input)) {\n        const code = hasOwnProperty(input, 'code') &&\n        typeof input.code === 'string' ?\n            input.code :\n            undefined;\n\n        /**\n         * @see https://dev.mysql.com/doc/mysql-errors/8.0/en/server-error-reference.html\n         */\n        switch (code) {\n            case '23505':\n            case 'ER_DUP_ENTRY':\n            case 'SQLITE_CONSTRAINT_UNIQUE': {\n                return new AuthupError({\n                    code: ErrorCode.ENTITY_CONFLICT,\n                    message: 'An entry with some unique attributes already exists.',\n                    stack: input.stack as string | undefined,\n                });\n            }\n            case 'ER_DISK_FULL':\n                return new AuthupError({\n                    code: ErrorCode.STORAGE_INSUFFICIENT,\n                    message: 'No database operation possible, due to the lack of free disk space.',\n                    stack: input.stack as string | undefined,\n                });\n        }\n\n        return new AuthupError({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: input.message as string | undefined,\n            stack: input.stack as string | undefined,\n        });\n    }\n\n    return new AuthupError({ code: ErrorCode.INTERNAL_ERROR });\n}\n\nconst DESCRIBE_BODY_MAX_LENGTH = 1024;\nconst DESCRIBE_CAUSE_MAX_DEPTH = 5;\n\n// Fields node attaches to a syscall error. Without them a transport failure\n// reads as a bare \"connect ECONNREFUSED\" with no way back to the reason.\nconst DESCRIBE_CAUSE_KEYS = ['code', 'errno', 'syscall', 'address', 'port'] as const;\n\nfunction describeBody(input: unknown): string | undefined {\n    let value: string;\n\n    if (typeof input === 'string') {\n        value = input;\n    } else {\n        try {\n            value = JSON.stringify(input) ?? String(input);\n        } catch {\n            // A body that cannot be serialized (circular, a stream) is\n            // still worth naming by shape.\n            value = Object.prototype.toString.call(input);\n        }\n    }\n\n    if (value.length === 0) {\n        return undefined;\n    }\n\n    if (value.length > DESCRIBE_BODY_MAX_LENGTH) {\n        return `${value.substring(0, DESCRIBE_BODY_MAX_LENGTH)}… (truncated)`;\n    }\n\n    return value;\n}\n\nfunction describeCauseLink(input: object): string {\n    const error = input as Error;\n    const name = typeof error.name === 'string' ? error.name : 'Error';\n    const parts: string[] = [`${name}: ${error.message}`];\n\n    const details: string[] = [];\n    for (const key of DESCRIBE_CAUSE_KEYS) {\n        const value = (input as Record<string, unknown>)[key];\n        if (typeof value === 'string' || typeof value === 'number') {\n            details.push(`${key}=${value}`);\n        }\n    }\n\n    if (details.length > 0) {\n        parts.push(`(${details.join(' ')})`);\n    }\n\n    return parts.join(' ');\n}\n\nfunction describeCauseChain(input: unknown): string | undefined {\n    const links: string[] = [];\n    const seen = new Set<unknown>();\n\n    let current: unknown = isObject(input) ? (input as { cause?: unknown }).cause : undefined;\n\n    while (isObject(current) && !seen.has(current) && links.length < DESCRIBE_CAUSE_MAX_DEPTH) {\n        seen.add(current);\n        links.push(describeCauseLink(current));\n        current = (current as { cause?: unknown }).cause;\n    }\n\n    if (links.length === 0) {\n        return undefined;\n    }\n\n    return links.join(' <- ');\n}\n\n/**\n * Render an error for the LOG. It is the counterpart of `@authup/errors`'\n * `serializeError`, which renders one for the response.\n *\n * The detail an outbound failure carries never survives `sanitizeError`\n * (by design: upstream internals must not reach the caller), and\n * `Error.cause` is non-enumerable, so a plain serialization drops it too.\n * Both were therefore already gone by the time anything was written,\n * which left a refused connection and an upstream `invalid_request`\n * indistinguishable in the log.\n *\n * Everything not present is omitted, so an ordinary error still renders\n * as its bare message.\n */\nexport function describeError(input: unknown, headline?: string): string {\n    const error = normalizeError(input);\n\n    const lines: string[] = [];\n    if (headline) {\n        lines.push(headline);\n    }\n    lines.push(error.message);\n\n    // hapic attaches the decoded body to the response through a getter, so\n    // it is non-enumerable and only reachable by an explicit read.\n    if (isClientError(error) && error.response) {\n        lines.push(`  upstream status: ${error.response.status}`);\n\n        const body = describeBody(error.response.data);\n        if (body) {\n            lines.push(`  upstream body:   ${body}`);\n        }\n    }\n\n    const causes = describeCauseChain(error);\n    if (causes) {\n        lines.push(`  cause:           ${causes}`);\n    }\n\n    if (error.stack) {\n        lines.push(`  stack:           ${error.stack}`);\n    }\n\n    return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAoCA,SAAgBe,cAAcC,OAAc;CACxC,IAAIb,cAAca,KAAAA,GACd,OAAOA;CAGX,IAAIA,iBAAiBP,2BACjB,OAAO,IAAIT,YAAY;EACnBiB,MAAMhB,UAAUiB;EAChBC,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIT,eAAeK,KAAAA,GAAQ;EACvB,MAAMK,QAAQL,MAAMM,OAAOC,KAAKC,UAAUZ,cAAcY,MAAMC,IAAI,CAAA;EAClE,OAAO,IAAIzB,YAAY;GACnBiB,MAAMhB,UAAUyB;GAChBN,OAAOJ,MAAMI;GACbD,SAASH,MAAMG,WAAWT,+BAA+BW,KAAAA;GACzDC,QAAQN,MAAMM;EAClB,CAAA;CACJ;CAEA,IAAIN,iBAAiBR,cAAcQ,iBAAiBT,YAChD,OAAO,IAAIP,YAAY;EACnBiB,MAAMhB,UAAUyB;EAChBP,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;;;;;;;;;;;;IAeJ,IAAId,cAAcU,KAAAA,GACd,OAAO,IAAIhB,YAAY;EACnBiB,MAAMhB,UAAU0B;EAChBR,SAAS;EACTC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIf,YAAYW,KAAAA,GACZ,OAAO,IAAIhB,YAAY;EACnBiB,MAAMf,mBAAmBc,MAAMY,MAAM;EACrCT,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIN,SAASE,KAAAA,GAAQ;;;KASjB,QARaH,eAAeG,OAAO,MAAA,KACnC,OAAOA,MAAMC,SAAS,WAClBD,MAAMC,OACNY,KAAAA,GAKJ;GACI,KAAK;GACL,KAAK;GACL,KAAK,4BACD,OAAO,IAAI7B,YAAY;IACnBiB,MAAMhB,UAAU6B;IAChBX,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;GAEJ,KAAK,gBACD,OAAO,IAAIpB,YAAY;IACnBiB,MAAMhB,UAAU8B;IAChBZ,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;EACR;EAEA,OAAO,IAAIpB,YAAY;GACnBiB,MAAMhB,UAAU+B;GAChBb,SAASH,MAAMG;GACfC,OAAOJ,MAAMI;EACjB,CAAA;CACJ;CAEA,OAAO,IAAIpB,YAAY,EAAEiB,MAAMhB,UAAU+B,eAAe,CAAA;AAC5D;AAEA,MAAMC,2BAA2B;AACjC,MAAMC,2BAA2B;AAIjC,MAAMC,sBAAsB;CAAC;CAAQ;CAAS;CAAW;CAAW;AAAO;AAE3E,SAASC,aAAapB,OAAc;CAChC,IAAIqB;CAEJ,IAAI,OAAOrB,UAAU,UACjBqB,QAAQrB;MAER,IAAI;EACAqB,QAAQC,KAAKC,UAAUvB,KAAAA,KAAUwB,OAAOxB,KAAAA;CAC5C,QAAQ;EAGJqB,QAAQI,OAAOC,UAAUC,SAASC,KAAK5B,KAAAA;CAC3C;CAGJ,IAAIqB,MAAMQ,WAAW,GACjB;CAGJ,IAAIR,MAAMQ,SAASZ,0BACf,OAAO,GAAGI,MAAMS,UAAU,GAAGb,wBAAAA,EAA0B;CAG3D,OAAOI;AACX;AAEA,SAASU,kBAAkB/B,OAAa;CACpC,MAAMgC,QAAQhC;CAEd,MAAMkC,QAAkB,CAAC,GADZ,OAAOF,MAAMC,SAAS,WAAWD,MAAMC,OAAO,QAC1B,IAAID,MAAM7B,SAAU;CAErD,MAAMgC,UAAoB,CAAA;CAC1B,KAAK,MAAMC,OAAOjB,qBAAqB;EACnC,MAAME,QAAQ,MAAmCe;EACjD,IAAI,OAAOf,UAAU,YAAY,OAAOA,UAAU,UAC9Cc,QAAQE,KAAK,GAAGD,IAAI,GAAGf,OAAO;CAEtC;CAEA,IAAIc,QAAQN,SAAS,GACjBK,MAAMG,KAAK,IAAIF,QAAQG,KAAK,GAAA,EAAK,EAAE;CAGvC,OAAOJ,MAAMI,KAAK,GAAA;AACtB;AAEA,SAASC,mBAAmBvC,OAAc;CACtC,MAAMwC,QAAkB,CAAA;CACxB,MAAMC,uBAAO,IAAIC,IAAAA;CAEjB,IAAIC,UAAmB7C,SAASE,KAAAA,IAAS,MAA+B4C,QAAQ/B,KAAAA;CAEhF,OAAOf,SAAS6C,OAAAA,KAAY,CAACF,KAAKI,IAAIF,OAAAA,KAAYH,MAAMX,SAASX,0BAA0B;EACvFuB,KAAKK,IAAIH,OAAAA;EACTH,MAAMH,KAAKN,kBAAkBY,OAAAA,CAAAA;EAC7BA,UAAU,QAAiCC;CAC/C;CAEA,IAAIJ,MAAMX,WAAW,GACjB;CAGJ,OAAOW,MAAMF,KAAK,MAAA;AACtB;;;;;;;;;;;;;;GAgBA,SAAgBS,cAAc/C,OAAgBgD,UAAiB;CAC3D,MAAMhB,QAAQ5C,eAAeY,KAAAA;CAE7B,MAAMiD,QAAkB,CAAA;CACxB,IAAID,UACAC,MAAMZ,KAAKW,QAAAA;CAEfC,MAAMZ,KAAKL,MAAM7B,OAAO;CAIxB,IAAIb,cAAc0C,KAAAA,KAAUA,MAAMkB,UAAU;EACxCD,MAAMZ,KAAK,sBAAsBL,MAAMkB,SAAStC,QAAQ;EAExD,MAAMuC,OAAO/B,aAAaY,MAAMkB,SAASE,IAAI;EAC7C,IAAID,MACAF,MAAMZ,KAAK,sBAAsBc,MAAM;CAE/C;CAEA,MAAME,SAASd,mBAAmBP,KAAAA;CAClC,IAAIqB,QACAJ,MAAMZ,KAAK,sBAAsBgB,QAAQ;CAG7C,IAAIrB,MAAM5B,OACN6C,MAAMZ,KAAK,sBAAsBL,MAAM5B,OAAO;CAGlD,OAAO6C,MAAMX,KAAK,IAAA;AACtB"}
+{"version":3,"file":"error.mjs","names":["AuthupError","ErrorCode","codeFromHttpStatus","isAuthupError","normalizeError","isHTTPError","isClientError","CodecError","ParseError","EntityRelationLookupError","buildErrorMessageForAttributes","isValidupError","stringifyPath","hasOwnProperty","isObject","sanitizeError","input","code","ENTITY_RELATION_INVALID","message","stack","paths","issues","map","issue","path","BAD_REQUEST","UPSTREAM_ERROR","status","undefined","ENTITY_CONFLICT","STORAGE_INSUFFICIENT","INTERNAL_ERROR","DESCRIBE_BODY_MAX_LENGTH","DESCRIBE_CAUSE_MAX_DEPTH","DESCRIBE_CAUSE_KEYS","describeBody","value","JSON","stringify","String","Object","prototype","toString","call","length","substring","describeCauseLink","error","name","parts","details","key","push","join","describeCauseChain","links","seen","Set","current","cause","has","add","describeError","headline","lines","response","body","data","causes"],"sources":["../../src/utils/error.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    AuthupError,\n    ErrorCode,\n    codeFromHttpStatus,\n    isAuthupError,\n    normalizeError,\n} from '@authup/errors';\nimport { isHTTPError } from '@ebec/http';\nimport { isClientError } from 'hapic';\nimport { CodecError, ParseError } from '@rapiq/core';\nimport { EntityRelationLookupError } from 'typeorm-extension';\nimport { buildErrorMessageForAttributes, isValidupError, stringifyPath } from 'validup';\nimport { hasOwnProperty, isObject } from '@authup/kit';\n\n/**\n * Normalize an unknown error to an AuthupError. Recognised shapes:\n *\n * 1. AuthupError instance              → returned as-is\n * 2. EntityRelationLookupError         → BAD_REQUEST AuthupError\n * 3. validup Issue error               → BAD_REQUEST AuthupError carrying issues\n * 4. rapiq ParseError / CodecError     → BAD_REQUEST AuthupError (client wire query)\n * 5. hapic ClientError                 → UPSTREAM_ERROR AuthupError (outbound call)\n * 6. foreign @ebec/http HTTPError      → AuthupError with the closest semantic code\n * 7. driver error w/ a recognised code → ENTITY_CONFLICT or STORAGE_INSUFFICIENT\n * 8. anything else                     → INTERNAL_ERROR AuthupError\n *\n * The HTTP-status concern is handled separately by `httpStatusFromCode` in\n * the adapter — this function only assigns a semantic `code`.\n */\nexport function sanitizeError(input: unknown): AuthupError {\n    if (isAuthupError(input)) {\n        return input;\n    }\n\n    if (input instanceof EntityRelationLookupError) {\n        return new AuthupError({\n            code: ErrorCode.ENTITY_RELATION_INVALID,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isValidupError(input)) {\n        const paths = input.issues.map((issue) => stringifyPath(issue.path));\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            stack: input.stack,\n            message: input.message || buildErrorMessageForAttributes(paths),\n            issues: input.issues,\n        });\n    }\n\n    if (input instanceof ParseError || input instanceof CodecError) {\n        return new AuthupError({\n            code: ErrorCode.BAD_REQUEST,\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    /**\n     * An outbound call failed. This branch MUST precede the `isHTTPError`\n     * one below: a hapic `HttpResponseError` extends `BaseError` and carries\n     * the upstream `status`, so the duck guard matches it and would mirror\n     * that status onto our own response. An upstream 400 would then read as\n     * \"your request was malformed\" when the caller's request was fine.\n     *\n     * The message is deliberately dropped rather than forwarded: hapic\n     * embeds the outbound method and URL in it (`400 Bad Request (POST\n     * https://idp.example.com/token)`), which must not reach the caller.\n     * `describeError` is what carries the detail, into the log only.\n     */\n    if (isClientError(input)) {\n        return new AuthupError({\n            code: ErrorCode.UPSTREAM_ERROR,\n            message: 'A request to an upstream service failed.',\n            stack: input.stack,\n        });\n    }\n\n    if (isHTTPError(input)) {\n        return new AuthupError({\n            code: codeFromHttpStatus(input.status),\n            message: input.message,\n            stack: input.stack,\n        });\n    }\n\n    if (isObject(input)) {\n        const code = hasOwnProperty(input, 'code') &&\n        typeof input.code === 'string' ?\n            input.code :\n            undefined;\n\n        /**\n         * @see https://dev.mysql.com/doc/mysql-errors/8.0/en/server-error-reference.html\n         */\n        switch (code) {\n            case '23505':\n            case 'ER_DUP_ENTRY':\n            case 'SQLITE_CONSTRAINT_UNIQUE': {\n                return new AuthupError({\n                    code: ErrorCode.ENTITY_CONFLICT,\n                    message: 'An entry with some unique attributes already exists.',\n                    stack: input.stack as string | undefined,\n                });\n            }\n            case 'ER_DISK_FULL':\n                return new AuthupError({\n                    code: ErrorCode.STORAGE_INSUFFICIENT,\n                    message: 'No database operation possible, due to the lack of free disk space.',\n                    stack: input.stack as string | undefined,\n                });\n        }\n\n        return new AuthupError({\n            code: ErrorCode.INTERNAL_ERROR,\n            message: input.message as string | undefined,\n            stack: input.stack as string | undefined,\n        });\n    }\n\n    return new AuthupError({ code: ErrorCode.INTERNAL_ERROR });\n}\n\nconst DESCRIBE_BODY_MAX_LENGTH = 1024;\nconst DESCRIBE_CAUSE_MAX_DEPTH = 5;\n\n// Fields node attaches to a syscall error. Without them a transport failure\n// reads as a bare \"connect ECONNREFUSED\" with no way back to the reason.\nconst DESCRIBE_CAUSE_KEYS = ['code', 'errno', 'syscall', 'address', 'port'] as const;\n\nfunction describeBody(input: unknown): string | undefined {\n    let value: string;\n\n    if (typeof input === 'string') {\n        value = input;\n    } else {\n        try {\n            value = JSON.stringify(input) ?? String(input);\n        } catch {\n            // A body that cannot be serialized (circular, a stream) is\n            // still worth naming by shape.\n            value = Object.prototype.toString.call(input);\n        }\n    }\n\n    if (value.length === 0) {\n        return undefined;\n    }\n\n    if (value.length > DESCRIBE_BODY_MAX_LENGTH) {\n        return `${value.substring(0, DESCRIBE_BODY_MAX_LENGTH)}… (truncated)`;\n    }\n\n    return value;\n}\n\nfunction describeCauseLink(input: object): string {\n    const error = input as Error;\n    const name = typeof error.name === 'string' ? error.name : 'Error';\n    const parts: string[] = [`${name}: ${error.message}`];\n\n    const details: string[] = [];\n    for (const key of DESCRIBE_CAUSE_KEYS) {\n        const value = (input as Record<string, unknown>)[key];\n        if (typeof value === 'string' || typeof value === 'number') {\n            details.push(`${key}=${value}`);\n        }\n    }\n\n    if (details.length > 0) {\n        parts.push(`(${details.join(' ')})`);\n    }\n\n    return parts.join(' ');\n}\n\n/**\n * The `cause` chain of an error, rendered innermost-last. Exported because a\n * CLI reports the reason without the stack `describeError` carries: a parse\n * failure names the file, and only its cause says what is wrong inside it.\n */\nexport function describeCauseChain(input: unknown): string | undefined {\n    const links: string[] = [];\n    const seen = new Set<unknown>();\n\n    let current: unknown = isObject(input) ? (input as { cause?: unknown }).cause : undefined;\n\n    while (isObject(current) && !seen.has(current) && links.length < DESCRIBE_CAUSE_MAX_DEPTH) {\n        seen.add(current);\n        links.push(describeCauseLink(current));\n        current = (current as { cause?: unknown }).cause;\n    }\n\n    if (links.length === 0) {\n        return undefined;\n    }\n\n    return links.join(' <- ');\n}\n\n/**\n * Render an error for the LOG. It is the counterpart of `@authup/errors`'\n * `serializeError`, which renders one for the response.\n *\n * The detail an outbound failure carries never survives `sanitizeError`\n * (by design: upstream internals must not reach the caller), and\n * `Error.cause` is non-enumerable, so a plain serialization drops it too.\n * Both were therefore already gone by the time anything was written,\n * which left a refused connection and an upstream `invalid_request`\n * indistinguishable in the log.\n *\n * Everything not present is omitted, so an ordinary error still renders\n * as its bare message.\n */\nexport function describeError(input: unknown, headline?: string): string {\n    const error = normalizeError(input);\n\n    const lines: string[] = [];\n    if (headline) {\n        lines.push(headline);\n    }\n    lines.push(error.message);\n\n    // hapic attaches the decoded body to the response through a getter, so\n    // it is non-enumerable and only reachable by an explicit read.\n    if (isClientError(error) && error.response) {\n        lines.push(`  upstream status: ${error.response.status}`);\n\n        const body = describeBody(error.response.data);\n        if (body) {\n            lines.push(`  upstream body:   ${body}`);\n        }\n    }\n\n    const causes = describeCauseChain(error);\n    if (causes) {\n        lines.push(`  cause:           ${causes}`);\n    }\n\n    if (error.stack) {\n        lines.push(`  stack:           ${error.stack}`);\n    }\n\n    return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAoCA,SAAgBe,cAAcC,OAAc;CACxC,IAAIb,cAAca,KAAAA,GACd,OAAOA;CAGX,IAAIA,iBAAiBP,2BACjB,OAAO,IAAIT,YAAY;EACnBiB,MAAMhB,UAAUiB;EAChBC,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIT,eAAeK,KAAAA,GAAQ;EACvB,MAAMK,QAAQL,MAAMM,OAAOC,KAAKC,UAAUZ,cAAcY,MAAMC,IAAI,CAAA;EAClE,OAAO,IAAIzB,YAAY;GACnBiB,MAAMhB,UAAUyB;GAChBN,OAAOJ,MAAMI;GACbD,SAASH,MAAMG,WAAWT,+BAA+BW,KAAAA;GACzDC,QAAQN,MAAMM;EAClB,CAAA;CACJ;CAEA,IAAIN,iBAAiBR,cAAcQ,iBAAiBT,YAChD,OAAO,IAAIP,YAAY;EACnBiB,MAAMhB,UAAUyB;EAChBP,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;;;;;;;;;;;;IAeJ,IAAId,cAAcU,KAAAA,GACd,OAAO,IAAIhB,YAAY;EACnBiB,MAAMhB,UAAU0B;EAChBR,SAAS;EACTC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIf,YAAYW,KAAAA,GACZ,OAAO,IAAIhB,YAAY;EACnBiB,MAAMf,mBAAmBc,MAAMY,MAAM;EACrCT,SAASH,MAAMG;EACfC,OAAOJ,MAAMI;CACjB,CAAA;CAGJ,IAAIN,SAASE,KAAAA,GAAQ;;;KASjB,QARaH,eAAeG,OAAO,MAAA,KACnC,OAAOA,MAAMC,SAAS,WAClBD,MAAMC,OACNY,KAAAA,GAKJ;GACI,KAAK;GACL,KAAK;GACL,KAAK,4BACD,OAAO,IAAI7B,YAAY;IACnBiB,MAAMhB,UAAU6B;IAChBX,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;GAEJ,KAAK,gBACD,OAAO,IAAIpB,YAAY;IACnBiB,MAAMhB,UAAU8B;IAChBZ,SAAS;IACTC,OAAOJ,MAAMI;GACjB,CAAA;EACR;EAEA,OAAO,IAAIpB,YAAY;GACnBiB,MAAMhB,UAAU+B;GAChBb,SAASH,MAAMG;GACfC,OAAOJ,MAAMI;EACjB,CAAA;CACJ;CAEA,OAAO,IAAIpB,YAAY,EAAEiB,MAAMhB,UAAU+B,eAAe,CAAA;AAC5D;AAEA,MAAMC,2BAA2B;AACjC,MAAMC,2BAA2B;AAIjC,MAAMC,sBAAsB;CAAC;CAAQ;CAAS;CAAW;CAAW;AAAO;AAE3E,SAASC,aAAapB,OAAc;CAChC,IAAIqB;CAEJ,IAAI,OAAOrB,UAAU,UACjBqB,QAAQrB;MAER,IAAI;EACAqB,QAAQC,KAAKC,UAAUvB,KAAAA,KAAUwB,OAAOxB,KAAAA;CAC5C,QAAQ;EAGJqB,QAAQI,OAAOC,UAAUC,SAASC,KAAK5B,KAAAA;CAC3C;CAGJ,IAAIqB,MAAMQ,WAAW,GACjB;CAGJ,IAAIR,MAAMQ,SAASZ,0BACf,OAAO,GAAGI,MAAMS,UAAU,GAAGb,wBAAAA,EAA0B;CAG3D,OAAOI;AACX;AAEA,SAASU,kBAAkB/B,OAAa;CACpC,MAAMgC,QAAQhC;CAEd,MAAMkC,QAAkB,CAAC,GADZ,OAAOF,MAAMC,SAAS,WAAWD,MAAMC,OAAO,QAC1B,IAAID,MAAM7B,SAAU;CAErD,MAAMgC,UAAoB,CAAA;CAC1B,KAAK,MAAMC,OAAOjB,qBAAqB;EACnC,MAAME,QAAQ,MAAmCe;EACjD,IAAI,OAAOf,UAAU,YAAY,OAAOA,UAAU,UAC9Cc,QAAQE,KAAK,GAAGD,IAAI,GAAGf,OAAO;CAEtC;CAEA,IAAIc,QAAQN,SAAS,GACjBK,MAAMG,KAAK,IAAIF,QAAQG,KAAK,GAAA,EAAK,EAAE;CAGvC,OAAOJ,MAAMI,KAAK,GAAA;AACtB;;;;;GAOA,SAAgBC,mBAAmBvC,OAAc;CAC7C,MAAMwC,QAAkB,CAAA;CACxB,MAAMC,uBAAO,IAAIC,IAAAA;CAEjB,IAAIC,UAAmB7C,SAASE,KAAAA,IAAS,MAA+B4C,QAAQ/B,KAAAA;CAEhF,OAAOf,SAAS6C,OAAAA,KAAY,CAACF,KAAKI,IAAIF,OAAAA,KAAYH,MAAMX,SAASX,0BAA0B;EACvFuB,KAAKK,IAAIH,OAAAA;EACTH,MAAMH,KAAKN,kBAAkBY,OAAAA,CAAAA;EAC7BA,UAAU,QAAiCC;CAC/C;CAEA,IAAIJ,MAAMX,WAAW,GACjB;CAGJ,OAAOW,MAAMF,KAAK,MAAA;AACtB;;;;;;;;;;;;;;GAgBA,SAAgBS,cAAc/C,OAAgBgD,UAAiB;CAC3D,MAAMhB,QAAQ5C,eAAeY,KAAAA;CAE7B,MAAMiD,QAAkB,CAAA;CACxB,IAAID,UACAC,MAAMZ,KAAKW,QAAAA;CAEfC,MAAMZ,KAAKL,MAAM7B,OAAO;CAIxB,IAAIb,cAAc0C,KAAAA,KAAUA,MAAMkB,UAAU;EACxCD,MAAMZ,KAAK,sBAAsBL,MAAMkB,SAAStC,QAAQ;EAExD,MAAMuC,OAAO/B,aAAaY,MAAMkB,SAASE,IAAI;EAC7C,IAAID,MACAF,MAAMZ,KAAK,sBAAsBc,MAAM;CAE/C;CAEA,MAAME,SAASd,mBAAmBP,KAAAA;CAClC,IAAIqB,QACAJ,MAAMZ,KAAK,sBAAsBgB,QAAQ;CAG7C,IAAIrB,MAAM5B,OACN6C,MAAMZ,KAAK,sBAAsBL,MAAM5B,OAAO;CAGlD,OAAO6C,MAAMX,KAAK,IAAA;AACtB"}

package/dist/utils/index.mjs

@@ -1,7 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { describeError, sanitizeError } from "./error.mjs";
+import { describeCauseChain, describeError, sanitizeError } from "./error.mjs";
 import { isSelfToken } from "./self-id.mjs";
 import { resolveURL } from "./url.mjs";
-export { describeError, isSelfToken, resolveURL, sanitizeError };
+export { describeCauseChain, describeError, isSelfToken, resolveURL, sanitizeError };

package/package.json

@@ -1,18 +1,28 @@
 {
     "name": "@authup/server-core",
     "type": "module",
-    "version": "1.0.0-beta.63",
+    "version": "1.0.0-beta.64",
     "description": "This is a standalone application.",
     "license": "AGPL-3.0-only",
     "main": "dist/index.mjs",
     "module": "dist/index.mjs",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        "./package.json": "./package.json",
+        ".": {
+            "authup-source": "./src/index.ts",
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.mjs",
+            "default": "./dist/index.mjs"
+        }
+    },
     "files": [
         "dist"
     ],
     "scripts": {
         "debug": "node --inspect dist/cli/index.mjs start",
         "cli": "node dist/cli/index.mjs",
-        "cli-dev": "npm run build:server && npm run cli",
+        "cli-dev": "node --loader ts-node/esm src/cli/index.ts",
         "cli-dev-src": "nodemon --watch src --exec \"npm run build:server && node dist/cli/index.mjs\"",
         "cli-dev-dist": "nodemon --watch dist --exec \"node dist/cli/index.mjs\"",
         "build:server:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
@@ -31,9 +41,6 @@
     "engines": {
         "node": "^22.13.0 || ^23.5.0 || >=24.0.0"
     },
-    "bin": {
-        "authup-server": "dist/cli/index.mjs"
-    },
     "keywords": [
         "auth",
         "authentication",
@@ -67,17 +74,18 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/access": "^1.0.0-beta.63",
-        "@authup/client-account-console": "^1.0.0-beta.63",
-        "@authup/client-auth-console": "^1.0.0-beta.63",
-        "@authup/core-http-kit": "^1.0.0-beta.63",
-        "@authup/core-kit": "^1.0.0-beta.63",
-        "@authup/errors": "^1.0.0-beta.63",
-        "@authup/i18n": "^1.0.0-beta.63",
-        "@authup/kit": "^1.0.0-beta.63",
-        "@authup/server-kit": "^1.0.0-beta.63",
-        "@authup/specs": "^1.0.0-beta.63",
-        "@ebec/http": "^4.2.0",
+        "@authup/access": "^1.0.0-beta.64",
+        "@authup/core-http-kit": "^1.0.0-beta.64",
+        "@authup/core-kit": "^1.0.0-beta.64",
+        "@authup/errors": "^1.0.0-beta.64",
+        "@authup/i18n": "^1.0.0-beta.64",
+        "@authup/kit": "^1.0.0-beta.64",
+        "@authup/server-config-kit": "^1.0.0-beta.64",
+        "@authup/server-config": "^1.0.0-beta.64",
+        "@authup/server-console-kit": "^1.0.0-beta.64",
+        "@authup/server-kit": "^1.0.0-beta.64",
+        "@authup/specs": "^1.0.0-beta.64",
+        "@ebec/http": "^4.3.2",
         "@hapic/oauth2": "^4.0.2",
         "@peculiar/x509": "^2.0.0",
         "@rapiq/adapter-memory": "^2.2.0",
@@ -85,7 +93,6 @@
         "@rapiq/adapter-typeorm": "^2.2.0",
         "@rapiq/codec-url": "^2.2.0",
         "@rapiq/core": "^2.2.0",
-        "@routup/assets": "^5.0.0",
         "@routup/basic": "^3.0.0",
         "@routup/cors": "^2.0.0",
         "@routup/decorators": "^5.0.0",
@@ -93,7 +100,7 @@
         "@routup/prometheus": "^4.0.0",
         "@routup/rate-limit": "^4.0.0",
         "@routup/swagger-ui": "^4.0.0",
-        "@simplewebauthn/server": "^13.3.2",
+        "@simplewebauthn/server": "^13.3.3",
         "@validup/zod": "^2.0.1",
         "better-sqlite3": "^13.0.3",
         "change-case": "^5.4.4",
@@ -106,10 +113,10 @@
         "hapic": "^3.0.2",
         "ilingo": "^6.1.0",
         "ldapjs": "^3.0.7",
-        "locter": "^4.0.0",
-        "mysql2": "^3.23.3",
+        "locter": "^4.1.1",
+        "mysql2": "^3.24.2",
         "node-cron": "^4.6.0",
-        "nodemailer": "^9.0.5",
+        "nodemailer": "^9.1.0",
         "orkos": "^1.1.1",
         "otpauth": "^9.5.1",
         "pg": "^8.23.0",
@@ -123,10 +130,10 @@
         "typeorm-extension": "^4.1.0",
         "uncrypto": "^0.1.3",
         "validup": "^2.0.1",
-        "zod": "^4.4.3"
+        "zod": "^4.5.4"
     },
     "devDependencies": {
-        "@authup/server-test-kit": "^1.0.0-beta.63",
+        "@authup/server-test-kit": "^1.0.0-beta.64",
         "@faker-js/faker": "^10.6.0",
         "@trapi/cli": "^2.0.5",
         "@types/ldapjs": "^3.0.6",
@@ -138,8 +145,7 @@
         "supertest": "^7.2.2",
         "testcontainers": "^12.1.0",
         "ts-node": "^10.8.2",
-        "unplugin-swc": "^1.5.10",
-        "vite": "^8.2.1",
+        "unplugin-swc": "^1.5.11",
         "vitest": "^4.0.14"
     },
     "publishConfig": {

package/dist/adapters/http/middleware/built-in/assets.d.ts

@@ -1,11 +0,0 @@
-import type { App } from 'routup';
-import type { ViteDevServer } from 'vite';
-import type { AssetsMiddlewareOptions } from './types.ts';
-export declare const VITE_SERVER_STORE_KEY: unique symbol;
-/**
- * Returns the vite dev server it created (JIT mode only), so the caller can
- * close it on teardown. It owns a file watcher and an HMR websocket, which
- * outlive the http listener otherwise.
- */
-export declare function registerAssetsMiddleware(router: App, options?: AssetsMiddlewareOptions): Promise<ViteDevServer | undefined>;
-//# sourceMappingURL=assets.d.ts.map

package/dist/adapters/http/middleware/built-in/assets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAIlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAM1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,qBAAqB,eAAuB,CAAC;AAE1D;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC1C,MAAM,EAAE,GAAG,EACX,OAAO,GAAE,uBAA4B,GACrC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAgFrC"}

package/dist/adapters/http/middleware/built-in/assets.mjs

@@ -1,91 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { PACKAGE_PATH } from "../../../../path.mjs";
-import { THEME_ASSET_MOUNT_PATH } from "../../ui/theme/contract/constants.mjs";
-import { createThemeAssetsHandler } from "../../ui/theme/assets.mjs";
-import { ThemeProvider } from "../../ui/theme/module.mjs";
-import "../../ui/theme/index.mjs";
-import { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from "../../ui/auth-console/resolve.mjs";
-import "../../ui/auth-console/index.mjs";
-import { registerThemeMiddleware } from "./theme.mjs";
-import { resolveAccountConsoleDistPath } from "../../ui/account-console/module.mjs";
-import "../../ui/account-console/index.mjs";
-import { InternalError } from "@authup/errors";
-import { CodeTransformation, isCodeTransformation } from "typeorm-extension";
-import path from "node:path";
-import { defineCoreHandler } from "routup";
-import { fromNodeMiddleware } from "routup/node";
-import { read } from "locter";
-import fs from "node:fs";
-import { createHandler } from "@routup/assets";
-//#region src/adapters/http/middleware/built-in/assets.ts
-const VITE_SERVER_STORE_KEY = Symbol("ViteServer");
-/**
-* Returns the vite dev server it created (JIT mode only), so the caller can
-* close it on teardown. It owns a file watcher and an HMR websocket, which
-* outlive the http listener otherwise.
-*/ async function registerAssetsMiddleware(router, options = {}) {
-	await registerThemeAssets(router, options);
-	const accountDistPath = resolveAccountConsoleDistPath();
-	if (accountDistPath) router.use("account/assets", createHandler(path.posix.join(accountDistPath, "assets"), {
-		fallthrough: false,
-		scan: false
-	}));
-	if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {
-		router.use("public", createHandler(path.posix.join(PACKAGE_PATH, "public"), {
-			fallthrough: true,
-			scan: false
-		}));
-		const authConsoleDistPath = resolveAuthConsoleDistPath();
-		if (authConsoleDistPath) router.use("public", createHandler(path.posix.join(authConsoleDistPath, "client"), {
-			fallthrough: false,
-			scan: false
-		}));
-		return;
-	}
-	const authConsolePackagePath = resolveAuthConsolePackagePath();
-	if (!authConsolePackagePath) throw new InternalError("The auth console package (@authup/client-auth-console) is not installed.");
-	const server = await (await read("vite")).createServer({
-		root: authConsolePackagePath,
-		base: "/public/",
-		logLevel: "error",
-		server: {
-			middlewareMode: true,
-			watch: {
-				usePolling: true,
-				interval: 100
-			}
-		},
-		appType: "custom"
-	});
-	router.use("public", fromNodeMiddleware(server.middlewares));
-	router.use(defineCoreHandler((event) => {
-		event.store[VITE_SERVER_STORE_KEY] = server;
-		return event.next();
-	}));
-	return server;
-}
-/**
-* Load the operator theme and mount its `assets/` directory at /theme.
-*
-* A missing directory disables the feature entirely: no provider is
-* created, no middleware is registered, and both console serve paths keep
-* returning byte-identical un-themed pages. So the default configuration
-* pays nothing, not even a per-request core handler.
-*/ async function registerThemeAssets(router, options) {
-	const { themeDirectoryPath } = options;
-	if (!themeDirectoryPath || !fs.existsSync(themeDirectoryPath)) return;
-	const provider = new ThemeProvider({
-		directoryPath: themeDirectoryPath,
-		fragmentsEnabled: options.themeFragmentsEnabled,
-		logger: options.logger
-	});
-	await provider.load();
-	registerThemeMiddleware(router, provider);
-	router.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(provider));
-}
-//#endregion
-export { VITE_SERVER_STORE_KEY, registerAssetsMiddleware };
-
-//# sourceMappingURL=assets.mjs.map

package/dist/adapters/http/middleware/built-in/assets.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.mjs","names":["InternalError","read","CodeTransformation","isCodeTransformation","createHandler","fs","path","defineCoreHandler","fromNodeMiddleware","PACKAGE_PATH","resolveAccountConsoleDistPath","resolveAuthConsoleDistPath","resolveAuthConsolePackagePath","THEME_ASSET_MOUNT_PATH","ThemeProvider","createThemeAssetsHandler","registerThemeMiddleware","VITE_SERVER_STORE_KEY","Symbol","registerAssetsMiddleware","router","options","registerThemeAssets","accountDistPath","use","posix","join","fallthrough","scan","JUST_IN_TIME","authConsoleDistPath","undefined","authConsolePackagePath","vite","server","createServer","root","base","logLevel","middlewareMode","watch","usePolling","interval","appType","middlewares","event","store","next","themeDirectoryPath","existsSync","provider","directoryPath","fragmentsEnabled","themeFragmentsEnabled","logger","load"],"sources":["../../../../../src/adapters/http/middleware/built-in/assets.ts"],"sourcesContent":["/*\n * Copyright (c) 2023.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { InternalError } from '@authup/errors';\nimport { read } from 'locter';\nimport { CodeTransformation, isCodeTransformation } from 'typeorm-extension';\nimport { createHandler } from '@routup/assets';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport { fromNodeMiddleware } from 'routup/node';\nimport type * as Vite from 'vite';\nimport type { ViteDevServer } from 'vite';\nimport { PACKAGE_PATH } from '../../../../path.ts';\nimport { resolveAccountConsoleDistPath } from '../../ui/account-console/index.ts';\nimport { resolveAuthConsoleDistPath, resolveAuthConsolePackagePath } from '../../ui/auth-console/index.ts';\nimport { THEME_ASSET_MOUNT_PATH, ThemeProvider, createThemeAssetsHandler } from '../../ui/theme/index.ts';\nimport { registerThemeMiddleware } from './theme.ts';\nimport type { AssetsMiddlewareOptions } from './types.ts';\n\nexport const VITE_SERVER_STORE_KEY = Symbol('ViteServer');\n\n/**\n * Returns the vite dev server it created (JIT mode only), so the caller can\n * close it on teardown. It owns a file watcher and an HMR websocket, which\n * outlive the http listener otherwise.\n */\nexport async function registerAssetsMiddleware(\n    router: App,\n    options: AssetsMiddlewareOptions = {},\n) : Promise<ViteDevServer | undefined> {\n    // Mounted FIRST, and outside the JIT early-return below, so an\n    // operator theme applies in dev mode too. An invalid manifest throws\n    // here and fails the boot.\n    await registerThemeAssets(router, options);\n\n    // Static assets of the account console SPA (its fixed vite base is\n    // /account/). Served in dev mode too — the bundle is prebuilt, not\n    // vite-transformed. A missing bundle only disables the mount; the page\n    // route reports the actionable error.\n    const accountDistPath = resolveAccountConsoleDistPath();\n    if (accountDistPath) {\n        router.use('account/assets', createHandler(\n            path.posix.join(accountDistPath, 'assets'),\n            {\n                fallthrough: false,\n                scan: false,\n            },\n        ));\n    }\n\n    if (!isCodeTransformation(CodeTransformation.JUST_IN_TIME)) {\n        router.use('public', createHandler(\n            path.posix.join(PACKAGE_PATH, 'public'),\n            {\n                fallthrough: true,\n                scan: false,\n            },\n        ));\n\n        // Static assets of the auth console SSR bundle (its fixed vite base\n        // is /public/). A missing bundle only disables the mount; the page\n        // routes report the actionable error.\n        const authConsoleDistPath = resolveAuthConsoleDistPath();\n        if (authConsoleDistPath) {\n            router.use('public', createHandler(\n                path.posix.join(authConsoleDistPath, 'client'),\n                {\n                    fallthrough: false,\n                    scan: false,\n                },\n            ));\n        }\n        return undefined;\n    }\n\n    // JIT (dev) mode serves the auth console straight from the package\n    // SOURCE directory (the workspace symlink carries index.html + src/ +\n    // vite.config.ts; a published install has no JIT). Vite auto-loads the\n    // package's own vite.config.ts from the root.\n    const authConsolePackagePath = resolveAuthConsolePackagePath();\n    if (!authConsolePackagePath) {\n        throw new InternalError(\n            'The auth console package (@authup/client-auth-console) is not installed.',\n        );\n    }\n\n    const vite = await read('vite') as typeof Vite;\n\n    const server: ViteDevServer = await vite.createServer({\n        root: authConsolePackagePath,\n        base: '/public/',\n        logLevel: 'error',\n        server: {\n            middlewareMode: true,\n            watch: {\n                usePolling: true,\n                interval: 100,\n            },\n        },\n        appType: 'custom',\n    });\n\n    router.use('public', fromNodeMiddleware(server.middlewares));\n    router.use(defineCoreHandler((event) => {\n        event.store[VITE_SERVER_STORE_KEY] = server;\n        return event.next();\n    }));\n\n    return server;\n}\n\n/**\n * Load the operator theme and mount its `assets/` directory at /theme.\n *\n * A missing directory disables the feature entirely: no provider is\n * created, no middleware is registered, and both console serve paths keep\n * returning byte-identical un-themed pages. So the default configuration\n * pays nothing, not even a per-request core handler.\n */\nasync function registerThemeAssets(router: App, options: AssetsMiddlewareOptions) : Promise<void> {\n    const { themeDirectoryPath } = options;\n    if (!themeDirectoryPath || !fs.existsSync(themeDirectoryPath)) {\n        return;\n    }\n\n    const provider = new ThemeProvider({\n        directoryPath: themeDirectoryPath,\n        fragmentsEnabled: options.themeFragmentsEnabled,\n        logger: options.logger,\n    });\n\n    await provider.load();\n\n    registerThemeMiddleware(router, provider);\n\n    router.use(THEME_ASSET_MOUNT_PATH, createThemeAssetsHandler(provider));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAaiB,wBAAwBC,OAAO,YAAA;;;;;GAO5C,eAAsBC,yBAClBC,QACAC,UAAmC,CAAC,GAAC;CAKrC,MAAMC,oBAAoBF,QAAQC,OAAAA;CAMlC,MAAME,kBAAkBb,8BAAAA;CACxB,IAAIa,iBACAH,OAAOI,IAAI,kBAAkBpB,cACzBE,KAAKmB,MAAMC,KAAKH,iBAAiB,QAAA,GACjC;EACII,aAAa;EACbC,MAAM;CACV,CAAA,CAAA;CAIR,IAAI,CAACzB,qBAAqBD,mBAAmB2B,YAAY,GAAG;EACxDT,OAAOI,IAAI,UAAUpB,cACjBE,KAAKmB,MAAMC,KAAKjB,cAAc,QAAA,GAC9B;GACIkB,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAMJ,MAAME,sBAAsBnB,2BAAAA;EAC5B,IAAImB,qBACAV,OAAOI,IAAI,UAAUpB,cACjBE,KAAKmB,MAAMC,KAAKI,qBAAqB,QAAA,GACrC;GACIH,aAAa;GACbC,MAAM;EACV,CAAA,CAAA;EAGR;CACJ;CAMA,MAAMI,yBAAyBpB,8BAAAA;CAC/B,IAAI,CAACoB,wBACD,MAAM,IAAIhC,cACN,0EAAA;CAMR,MAAMkC,SAAwB,OAAMD,MAFjBhC,KAAK,MAAA,EAAA,CAEiBkC,aAAa;EAClDC,MAAMJ;EACNK,MAAM;EACNC,UAAU;EACVJ,QAAQ;GACJK,gBAAgB;GAChBC,OAAO;IACHC,YAAY;IACZC,UAAU;GACd;EACJ;EACAC,SAAS;CACb,CAAA;CAEAvB,OAAOI,IAAI,UAAUhB,mBAAmB0B,OAAOU,WAAW,CAAA;CAC1DxB,OAAOI,IAAIjB,mBAAmBsC,UAAAA;EAC1BA,MAAMC,MAAM7B,yBAAyBiB;EACrC,OAAOW,MAAME,KAAI;CACrB,CAAA,CAAA;CAEA,OAAOb;AACX;;;;;;;;GAUA,eAAeZ,oBAAoBF,QAAaC,SAAgC;CAC5E,MAAM,EAAE2B,uBAAuB3B;CAC/B,IAAI,CAAC2B,sBAAsB,CAAC3C,GAAG4C,WAAWD,kBAAAA,GACtC;CAGJ,MAAME,WAAW,IAAIpC,cAAc;EAC/BqC,eAAeH;EACfI,kBAAkB/B,QAAQgC;EAC1BC,QAAQjC,QAAQiC;CACpB,CAAA;CAEA,MAAMJ,SAASK,KAAI;CAEnBvC,wBAAwBI,QAAQ8B,QAAAA;CAEhC9B,OAAOI,IAAIX,wBAAwBE,yBAAyBmC,QAAAA,CAAAA;AAChE"}

package/dist/adapters/http/middleware/built-in/theme.d.ts

@@ -1,15 +0,0 @@
-import type { App, IAppEvent } from 'routup';
-import type { IThemeProvider } from '../../ui/theme/index.ts';
-/**
- * Per-request handoff of the operator theme into the two console serve
- * paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.
- *
- * A store handoff rather than module-scope state, so two applications in
- * one process (the test suite) never share a theme, and rather than
- * threading the provider through seven workflow controllers, which is a
- * lot of plumbing for decoration.
- */
-export declare const THEME_STORE_KEY: unique symbol;
-export declare function registerThemeMiddleware(router: App, provider: IThemeProvider): void;
-export declare function useRequestTheme(event: IAppEvent): IThemeProvider | undefined;
-//# sourceMappingURL=theme.d.ts.map

package/dist/adapters/http/middleware/built-in/theme.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/theme.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,eAAkB,CAAC;AAE/C,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,QAM5E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAI,cAAc,GAAG,SAAS,CAE7E"}

package/dist/adapters/http/middleware/built-in/theme.mjs

@@ -1,27 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { defineCoreHandler } from "routup";
-//#region src/adapters/http/middleware/built-in/theme.ts
-/**
-* Per-request handoff of the operator theme into the two console serve
-* paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.
-*
-* A store handoff rather than module-scope state, so two applications in
-* one process (the test suite) never share a theme, and rather than
-* threading the provider through seven workflow controllers, which is a
-* lot of plumbing for decoration.
-*/ const THEME_STORE_KEY = Symbol("Theme");
-function registerThemeMiddleware(router, provider) {
-	router.use(defineCoreHandler((event) => {
-		event.store[THEME_STORE_KEY] = provider;
-		return event.next();
-	}));
-}
-function useRequestTheme(event) {
-	return event.store[THEME_STORE_KEY];
-}
-//#endregion
-export { THEME_STORE_KEY, registerThemeMiddleware, useRequestTheme };
-
-//# sourceMappingURL=theme.mjs.map

package/dist/adapters/http/middleware/built-in/theme.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"theme.mjs","names":["defineCoreHandler","THEME_STORE_KEY","Symbol","registerThemeMiddleware","router","provider","use","event","store","next","useRequestTheme"],"sources":["../../../../../src/adapters/http/middleware/built-in/theme.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { App, IAppEvent } from 'routup';\nimport { defineCoreHandler } from 'routup';\nimport type { IThemeProvider } from '../../ui/theme/index.ts';\n\n/**\n * Per-request handoff of the operator theme into the two console serve\n * paths, the same mechanism as UI_HTTP_CLIENT_FACTORY_STORE_KEY.\n *\n * A store handoff rather than module-scope state, so two applications in\n * one process (the test suite) never share a theme, and rather than\n * threading the provider through seven workflow controllers, which is a\n * lot of plumbing for decoration.\n */\nexport const THEME_STORE_KEY = Symbol('Theme');\n\nexport function registerThemeMiddleware(router: App, provider: IThemeProvider) {\n    router.use(defineCoreHandler((event) => {\n        event.store[THEME_STORE_KEY] = provider;\n\n        return event.next();\n    }));\n}\n\nexport function useRequestTheme(event: IAppEvent) : IThemeProvider | undefined {\n    return event.store[THEME_STORE_KEY] as IThemeProvider | undefined;\n}\n"],"mappings":";;;;;;;;;;;;;GAoBA,MAAaC,kBAAkBC,OAAO,OAAA;AAEtC,SAAgBC,wBAAwBC,QAAaC,UAAwB;CACzED,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,mBAAmBI;EAE/B,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ;AAEA,SAAgBC,gBAAgBH,OAAgB;CAC5C,OAAOA,MAAMC,MAAMP;AACvB"}

package/dist/adapters/http/middleware/built-in/types.d.ts

@@ -1,14 +0,0 @@
-import type { Logger } from '@authup/server-kit';
-export type AssetsMiddlewareOptions = {
-    /**
-     * Absolute path of the operator theme directory. Empty or missing
-     * disables theming entirely.
-     */
-    themeDirectoryPath?: string;
-    /**
-     * Opt in to reading the theme's `fragments/head.html`. Default off.
-     */
-    themeFragmentsEnabled?: boolean;
-    logger?: Logger;
-};
-//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/middleware/built-in/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,MAAM,uBAAuB,GAAG;IAClC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/middleware/built-in/ui-http-client.d.ts

@@ -1,15 +0,0 @@
-import type { IClient } from '@authup/core-http-kit';
-import type { App } from 'routup';
-/**
- * Per-request handoff of an HTTP-client factory into renderAuthConsolePage —
- * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk
- * over the DI container (`() => container.resolve(UIHttpClient)`)
- * whose registration carries `lifetime: 'transient'`, so every SSR
- * render resolves a fresh client — never share one client instance
- * across renders (the authentication hook writes per-user state onto
- * it). Production binds the internal loopback client by default
- * (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.
- */
-export declare const UI_HTTP_CLIENT_FACTORY_STORE_KEY: unique symbol;
-export declare function registerUIHttpClientMiddleware(router: App, httpClientFactory: () => IClient): void;
-//# sourceMappingURL=ui-http-client.d.ts.map

package/dist/adapters/http/middleware/built-in/ui-http-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ui-http-client.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/middleware/built-in/ui-http-client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAGlC;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,eAAgC,CAAC;AAE9E,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,OAAO,QAK3F"}

package/dist/adapters/http/middleware/built-in/ui-http-client.mjs

@@ -1,25 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { defineCoreHandler } from "routup";
-//#region src/adapters/http/middleware/built-in/ui-http-client.ts
-/**
-* Per-request handoff of an HTTP-client factory into renderAuthConsolePage —
-* same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk
-* over the DI container (`() => container.resolve(UIHttpClient)`)
-* whose registration carries `lifetime: 'transient'`, so every SSR
-* render resolves a fresh client — never share one client instance
-* across renders (the authentication hook writes per-user state onto
-* it). Production binds the internal loopback client by default
-* (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.
-*/ const UI_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol("UIHttpClientFactory");
-function registerUIHttpClientMiddleware(router, httpClientFactory) {
-	router.use(defineCoreHandler((event) => {
-		event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;
-		return event.next();
-	}));
-}
-//#endregion
-export { UI_HTTP_CLIENT_FACTORY_STORE_KEY, registerUIHttpClientMiddleware };
-
-//# sourceMappingURL=ui-http-client.mjs.map

package/dist/adapters/http/middleware/built-in/ui-http-client.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ui-http-client.mjs","names":["defineCoreHandler","UI_HTTP_CLIENT_FACTORY_STORE_KEY","Symbol","registerUIHttpClientMiddleware","router","httpClientFactory","use","event","store","next"],"sources":["../../../../../src/adapters/http/middleware/built-in/ui-http-client.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { IClient } from '@authup/core-http-kit';\nimport type { App } from 'routup';\nimport { defineCoreHandler } from 'routup';\n\n/**\n * Per-request handoff of an HTTP-client factory into renderAuthConsolePage —\n * same mechanism as VITE_SERVER_STORE_KEY. The wiring passes a thunk\n * over the DI container (`() => container.resolve(UIHttpClient)`)\n * whose registration carries `lifetime: 'transient'`, so every SSR\n * render resolves a fresh client — never share one client instance\n * across renders (the authentication hook writes per-user state onto\n * it). Production binds the internal loopback client by default\n * (`HTTPModule.registerUIHttpClient`); tests may pre-register a fake.\n */\nexport const UI_HTTP_CLIENT_FACTORY_STORE_KEY = Symbol('UIHttpClientFactory');\n\nexport function registerUIHttpClientMiddleware(router: App, httpClientFactory: () => IClient) {\n    router.use(defineCoreHandler((event) => {\n        event.store[UI_HTTP_CLIENT_FACTORY_STORE_KEY] = httpClientFactory;\n        return event.next();\n    }));\n}\n"],"mappings":";;;;;;;;;;;;;;GAqBA,MAAaC,mCAAmCC,OAAO,qBAAA;AAEvD,SAAgBC,+BAA+BC,QAAaC,mBAAgC;CACxFD,OAAOE,IAAIN,mBAAmBO,UAAAA;EAC1BA,MAAMC,MAAMP,oCAAoCI;EAChD,OAAOE,MAAME,KAAI;CACrB,CAAA,CAAA;AACJ"}

package/dist/adapters/http/request/helpers/redirect.d.ts

@@ -1,14 +0,0 @@
-/**
- * Open-redirect guard for the `redirect` query parameter carried by the
- * auth workflow pages: only same-origin relative paths pass through, so the
- * value can be safely reflected into an anchor href / forwarded as a
- * post-login destination.
- *
- * Rejects: non-strings, control/whitespace chars (browsers strip some,
- * shifting where the URL authority begins), protocol-relative (`//host`),
- * backslash variants (browsers normalise `\` → `/`), and any scheme
- * (`javascript:`, `http:`) — both on the raw and once-decoded form so a
- * percent-encoded separator (`%2f`, `%5c`) can't slip past.
- */
-export declare function sanitizeRelativeRedirect(input: unknown): string | undefined;
-//# sourceMappingURL=redirect.d.ts.map

package/dist/adapters/http/request/helpers/redirect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAwC3E"}

package/dist/adapters/http/request/helpers/redirect.mjs

@@ -1,36 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-//#region src/adapters/http/request/helpers/redirect.ts
-/**
-* Open-redirect guard for the `redirect` query parameter carried by the
-* auth workflow pages: only same-origin relative paths pass through, so the
-* value can be safely reflected into an anchor href / forwarded as a
-* post-login destination.
-*
-* Rejects: non-strings, control/whitespace chars (browsers strip some,
-* shifting where the URL authority begins), protocol-relative (`//host`),
-* backslash variants (browsers normalise `\` → `/`), and any scheme
-* (`javascript:`, `http:`) — both on the raw and once-decoded form so a
-* percent-encoded separator (`%2f`, `%5c`) can't slip past.
-*/ function sanitizeRelativeRedirect(input) {
-	if (typeof input !== "string" || input.length === 0) return;
-	if (/[\u0000-\u0020\u007f]/.test(input)) return;
-	let decoded;
-	try {
-		decoded = decodeURIComponent(input);
-	} catch {
-		return;
-	}
-	if (/[\u0000-\u001f\u007f]/.test(decoded)) return;
-	for (const candidate of [input, decoded]) {
-		if (!candidate.startsWith("/")) return;
-		if (candidate.length > 1 && (candidate[1] === "/" || candidate[1] === "\\")) return;
-		if (candidate.includes("\\")) return;
-	}
-	return input;
-}
-//#endregion
-export { sanitizeRelativeRedirect };
-
-//# sourceMappingURL=redirect.mjs.map

package/dist/adapters/http/request/helpers/redirect.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirect.mjs","names":["sanitizeRelativeRedirect","input","length","undefined","test","decoded","decodeURIComponent","candidate","startsWith","includes"],"sources":["../../../../../src/adapters/http/request/helpers/redirect.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Open-redirect guard for the `redirect` query parameter carried by the\n * auth workflow pages: only same-origin relative paths pass through, so the\n * value can be safely reflected into an anchor href / forwarded as a\n * post-login destination.\n *\n * Rejects: non-strings, control/whitespace chars (browsers strip some,\n * shifting where the URL authority begins), protocol-relative (`//host`),\n * backslash variants (browsers normalise `\\` → `/`), and any scheme\n * (`javascript:`, `http:`) — both on the raw and once-decoded form so a\n * percent-encoded separator (`%2f`, `%5c`) can't slip past.\n */\nexport function sanitizeRelativeRedirect(input: unknown): string | undefined {\n    if (typeof input !== 'string' || input.length === 0) {\n        return undefined;\n    }\n\n    // Raw input: reject control chars AND whitespace (space/tab/newline) — a\n    // raw space can shift where the URL authority begins.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u0020\\u007f]/.test(input)) {\n        return undefined;\n    }\n\n    let decoded: string;\n    try {\n        decoded = decodeURIComponent(input);\n    } catch {\n        return undefined;\n    }\n\n    // Decoded form: reject C0 controls + DEL (CR/LF/NUL — the header-injection\n    // vectors a `%0a`/`%0d` would smuggle past the raw check) but NOT space\n    // (0x20), so a legitimate `%20` in the path still passes.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\u0000-\\u001f\\u007f]/.test(decoded)) {\n        return undefined;\n    }\n\n    for (const candidate of [input, decoded]) {\n        if (!candidate.startsWith('/')) {\n            return undefined;\n        }\n        if (candidate.length > 1 && (candidate[1] === '/' || candidate[1] === '\\\\')) {\n            return undefined;\n        }\n        if (candidate.includes('\\\\')) {\n            return undefined;\n        }\n    }\n\n    return input;\n}\n"],"mappings":";;;;;;;;;;;;;;;GAmBA,SAAgBA,yBAAyBC,OAAc;CACnD,IAAI,OAAOA,UAAU,YAAYA,MAAMC,WAAW,GAC9C;CAMJ,IAAI,wBAAwBE,KAAKH,KAAAA,GAC7B;CAGJ,IAAII;CACJ,IAAI;EACAA,UAAUC,mBAAmBL,KAAAA;CACjC,QAAQ;EACJ;CACJ;CAMA,IAAI,wBAAwBG,KAAKC,OAAAA,GAC7B;CAGJ,KAAK,MAAME,aAAa,CAACN,OAAOI,OAAQ,GAAE;EACtC,IAAI,CAACE,UAAUC,WAAW,GAAA,GACtB;EAEJ,IAAID,UAAUL,SAAS,MAAMK,UAAU,OAAO,OAAOA,UAAU,OAAO,OAClE;EAEJ,IAAIA,UAAUE,SAAS,IAAA,GACnB;CAER;CAEA,OAAOR;AACX"}

package/dist/adapters/http/ui/account-console/index.d.ts

@@ -1,4 +0,0 @@
-export * from './module.ts';
-export * from './ref.ts';
-export * from './types.ts';
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/ui/account-console/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/account-console/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC"}

package/dist/adapters/http/ui/account-console/index.mjs

@@ -1,6 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { ACCOUNT_CONSOLE_REF_MAX_LENGTH, resolveAccountConsoleRef } from "./ref.mjs";
-import { resolveAccountConsoleDistPath, serveAccountConsolePage, setAccountConsolePackagePath } from "./module.mjs";
-export { ACCOUNT_CONSOLE_REF_MAX_LENGTH, resolveAccountConsoleDistPath, resolveAccountConsoleRef, serveAccountConsolePage, setAccountConsolePackagePath };

package/dist/adapters/http/ui/account-console/module.d.ts

@@ -1,28 +0,0 @@
-import type { IAppEvent } from 'routup';
-import type { AccountConsoleServeOptions } from './types.ts';
-/**
- * Point the resolution at a substituted package (config
- * `accountConsolePath`) instead of the node_modules walk. Called once at
- * boot.
- */
-export declare function setAccountConsolePackagePath(value: string | undefined): void;
-/**
- * Locate the built account console bundle. The SPA ships as the
- * `@authup/client-account-console` package (a server-core dependency), so
- * the node_modules ancestor walk from server-core's own package root
- * (locter's `locateUp`) finds it for the workspace (symlink onto
- * apps/client-account-console) and for a published install alike. Only a
- * positive result is cached — a dev building the app after boot is picked
- * up on the next request.
- */
-export declare function resolveAccountConsoleDistPath(): string | undefined;
-/**
- * Serve the account console SPA shell: the package's built index.html with
- * the runtime configuration injected (replacing the `<!--account-config-->`
- * marker), the color-mode/lang attributes stamped from the shared cookies
- * (no flash), and asset hrefs rebased when publicUrl carries a sub-path.
- * Client-side routing owns everything below /account — the shell is the
- * same for every sub-path.
- */
-export declare function serveAccountConsolePage(event: IAppEvent, options: AccountConsoleServeOptions): Promise<string>;
-//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/ui/account-console/module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/account-console/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAcxC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAQ7D;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAI,IAAI,CAI7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,IAAK,MAAM,GAAG,SAAS,CAmBnE;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CACzC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,0BAA0B,GACnC,OAAO,CAAC,MAAM,CAAC,CAsDlB"}