@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/adapters/http/ui/theme/index.mjs

@@ -1,13 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH } from "./contract/constants.mjs";
-import { buildThemeHead, escapeHtml } from "./contract/head.mjs";
-import { themeAssetExtension } from "./contract/utils.mjs";
-import { ThemeManifestValidator, parseThemeManifest } from "./contract/manifest.mjs";
-import "./contract/index.mjs";
-import { applyTheme } from "./apply.mjs";
-import { THEME_ASSET_CSP, THEME_MANIFEST_REVALIDATE_INTERVAL } from "./constants.mjs";
-import { createThemeAssetsHandler } from "./assets.mjs";
-import { ThemeProvider } from "./module.mjs";
-export { THEME_ASSETS_DIRECTORY_NAME, THEME_ASSET_CONTENT_TYPES, THEME_ASSET_CSP, THEME_ASSET_EXTENSIONS, THEME_ASSET_MOUNT_PATH, THEME_CSS_LAYER_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_IMAGE_EXTENSIONS, THEME_LOGO_TOKENS, THEME_MANIFEST_FILE_NAME, THEME_MANIFEST_REVALIDATE_INTERVAL, THEME_MANIFEST_VERSION, THEME_TOKEN_NAME_PATTERN, THEME_TOKEN_VALUE_FORBIDDEN_PATTERN, THEME_TOKEN_VALUE_MAX_LENGTH, ThemeManifestValidator, ThemeProvider, applyTheme, buildThemeHead, createThemeAssetsHandler, escapeHtml, parseThemeManifest, themeAssetExtension };

package/dist/adapters/http/ui/theme/module.d.ts

@@ -1,79 +0,0 @@
-import type { Logger } from '@authup/server-kit';
-import type { ThemeManifest } from './contract/index.ts';
-import type { IThemeProvider, ThemeProviderContext } from './types.ts';
-/**
- * Owns the operator theme directory: manifest loading + validation, the
- * realpathed servable asset root, and the memoized head markup.
- *
- * Failure posture is deliberately asymmetric, and inverts the
- * FileProvisioningSource precedent for the request path:
- * - at BOOT an invalid manifest throws, so a typo is reported once, loudly,
- *   with the file path and every issue.
- * - AFTER boot a manifest that becomes invalid keeps the last good value and
- *   logs. Provisioning seeds authorization data; a theme is decoration, and
- *   a broken logo must never take down the login page of an identity
- *   provider.
- */
-export declare class ThemeProvider implements IThemeProvider {
-    protected readonly directoryPath: string;
-    protected readonly manifestPath: string;
-    protected readonly fragmentPath: string;
-    protected readonly fragmentsEnabled: boolean;
-    protected readonly logger: Logger | undefined;
-    protected manifest: ThemeManifest | undefined;
-    protected headFragment: string | undefined;
-    protected assetsPath: string | undefined;
-    protected manifestSignature: string | undefined;
-    protected fragmentSignature: string | undefined;
-    protected revalidatedAt: number;
-    protected headCache: Map<string, string>;
-    constructor(ctx: ThemeProviderContext);
-    load(): Promise<void>;
-    getManifest(): Promise<ThemeManifest | undefined>;
-    getAssetsPath(): Promise<string | undefined>;
-    getHead(basePath: string): Promise<string>;
-    /**
-     * The mount root is `<root>/assets`, never the theme root, so the
-     * manifest is unreachable over HTTP by construction.
-     *
-     * Returns the LOGICAL path, deliberately not a realpath. A Kubernetes
-     * ConfigMap volume is a symlink farm whose update swaps `..data` to a
-     * NEW timestamped directory and deletes the old one, so a realpath
-     * captured here would dangle after the first update and every asset
-     * would 404 until the pod restarts. The asset handler resolves and
-     * re-asserts containment per request instead.
-     */
-    protected resolveAssetsPath(): Promise<string | undefined>;
-    /**
-     * Read + decode the manifest through locter, the same loader
-     * FileProvisioningSource uses for its operator files. Its JSON reader
-     * is a plain read-and-parse with no content cache, so the live reload
-     * below still sees an edited file.
-     */
-    protected readManifest(): Promise<unknown>;
-    protected readSignature(filePath: string): string | undefined;
-    /**
-     * Read `fragments/head.html`. Never called when the operator has not
-     * opted in, so dropping the file into the directory does nothing on
-     * its own.
-     */
-    protected readFragment(): string | undefined;
-    /**
-     * Re-read the manifest when it changed on disk, at most once per
-     * interval. One stat per console render is negligible next to the SSR
-     * pass it precedes, and it is what makes an edit visible without a
-     * restart (the property every operator asks about first).
-     */
-    protected revalidate(): Promise<void>;
-    protected revalidateManifest(): Promise<void>;
-    protected revalidateFragment(): void;
-    /**
-     * Always logged. The dominant failure mode of this feature is silence:
-     * mount the wrong path and the page looks exactly like an un-themed
-     * page. An enumerable boot summary is both the cheapest debugging
-     * affordance and the cheapest way to notice a file that should not be
-     * in the volume.
-     */
-    protected logInventory(): void;
-}
-//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/ui/theme/module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAejD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,YAAW,cAAc;IAChD,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAG,MAAM,CAAC;IAE1C,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAG,MAAM,CAAC;IAEzC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAG,MAAM,CAAC;IAEzC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAG,OAAO,CAAC;IAE9C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAG,MAAM,GAAG,SAAS,CAAC;IAE/C,SAAS,CAAC,QAAQ,EAAG,aAAa,GAAG,SAAS,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAG,MAAM,GAAG,SAAS,CAAC;IAE5C,SAAS,CAAC,UAAU,EAAG,MAAM,GAAG,SAAS,CAAC;IAE1C,SAAS,CAAC,iBAAiB,EAAG,MAAM,GAAG,SAAS,CAAC;IAEjD,SAAS,CAAC,iBAAiB,EAAG,MAAM,GAAG,SAAS,CAAC;IAEjD,SAAS,CAAC,aAAa,SAAK;IAE5B,SAAS,CAAC,SAAS,sBAA6B;gBAEpC,GAAG,EAAE,oBAAoB;IAY/B,IAAI,IAAK,OAAO,CAAC,IAAI,CAAC;IAsBtB,WAAW,IAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAMlD,aAAa,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAM7C,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC;IAqBjD;;;;;;;;;;OAUG;cACa,iBAAiB,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAajE;;;;;OAKG;cACa,YAAY,IAAK,OAAO,CAAC,OAAO,CAAC;IAYjD,SAAS,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAI,MAAM,GAAG,SAAS;IAU9D;;;;OAIG;IACH,SAAS,CAAC,YAAY,IAAK,MAAM,GAAG,SAAS;IAqB7C;;;;;OAKG;cACa,UAAU,IAAK,OAAO,CAAC,IAAI,CAAC;cAkB5B,kBAAkB,IAAK,OAAO,CAAC,IAAI,CAAC;IA2BpD,SAAS,CAAC,kBAAkB,IAAK,IAAI;IAiBrC;;;;;;OAMG;IACH,SAAS,CAAC,YAAY,IAAK,IAAI;CAoDlC"}

package/dist/adapters/http/ui/theme/module.mjs

@@ -1,206 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { THEME_ASSETS_DIRECTORY_NAME, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME, THEME_HEAD_FRAGMENT_MAX_LENGTH, THEME_MANIFEST_FILE_NAME } from "./contract/constants.mjs";
-import { buildThemeHead } from "./contract/head.mjs";
-import { parseThemeManifest } from "./contract/manifest.mjs";
-import "./contract/index.mjs";
-import "./constants.mjs";
-import { AuthupError, normalizeError } from "@authup/errors";
-import path from "node:path";
-import { read } from "locter";
-import fs from "node:fs";
-//#region src/adapters/http/ui/theme/module.ts
-/**
-* Owns the operator theme directory: manifest loading + validation, the
-* realpathed servable asset root, and the memoized head markup.
-*
-* Failure posture is deliberately asymmetric, and inverts the
-* FileProvisioningSource precedent for the request path:
-* - at BOOT an invalid manifest throws, so a typo is reported once, loudly,
-*   with the file path and every issue.
-* - AFTER boot a manifest that becomes invalid keeps the last good value and
-*   logs. Provisioning seeds authorization data; a theme is decoration, and
-*   a broken logo must never take down the login page of an identity
-*   provider.
-*/ var ThemeProvider = class {
-	directoryPath;
-	manifestPath;
-	fragmentPath;
-	fragmentsEnabled;
-	logger;
-	manifest;
-	headFragment;
-	assetsPath;
-	manifestSignature;
-	fragmentSignature;
-	revalidatedAt = 0;
-	headCache = /* @__PURE__ */ new Map();
-	constructor(ctx) {
-		this.directoryPath = ctx.directoryPath;
-		this.fragmentsEnabled = ctx.fragmentsEnabled ?? false;
-		this.logger = ctx.logger;
-		this.manifestPath = path.join(ctx.directoryPath, THEME_MANIFEST_FILE_NAME);
-		this.fragmentPath = path.join(ctx.directoryPath, THEME_FRAGMENTS_DIRECTORY_NAME, THEME_HEAD_FRAGMENT_FILE_NAME);
-	}
-	async load() {
-		this.assetsPath = await this.resolveAssetsPath();
-		this.manifestSignature = this.readSignature(this.manifestPath);
-		if (this.manifestSignature) this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);
-		if (this.fragmentsEnabled) {
-			this.headFragment = this.readFragment();
-			this.fragmentSignature = this.readSignature(this.fragmentPath);
-		}
-		this.revalidatedAt = Date.now();
-		this.headCache.clear();
-		this.logInventory();
-	}
-	async getManifest() {
-		await this.revalidate();
-		return this.manifest;
-	}
-	async getAssetsPath() {
-		await this.revalidate();
-		return this.assetsPath;
-	}
-	async getHead(basePath) {
-		const manifest = await this.getManifest();
-		const cached = this.headCache.get(basePath);
-		if (typeof cached === "string") return cached;
-		const head = buildThemeHead(manifest ?? { version: 1 }, basePath, this.headFragment);
-		this.headCache.set(basePath, head);
-		return head;
-	}
-	/**
-	* The mount root is `<root>/assets`, never the theme root, so the
-	* manifest is unreachable over HTTP by construction.
-	*
-	* Returns the LOGICAL path, deliberately not a realpath. A Kubernetes
-	* ConfigMap volume is a symlink farm whose update swaps `..data` to a
-	* NEW timestamped directory and deletes the old one, so a realpath
-	* captured here would dangle after the first update and every asset
-	* would 404 until the pod restarts. The asset handler resolves and
-	* re-asserts containment per request instead.
-	*/ async resolveAssetsPath() {
-		const assetsPath = path.join(this.directoryPath, THEME_ASSETS_DIRECTORY_NAME);
-		try {
-			return (await fs.promises.stat(assetsPath)).isDirectory() ? assetsPath : void 0;
-		} catch {
-			return;
-		}
-	}
-	/**
-	* Read + decode the manifest through locter, the same loader
-	* FileProvisioningSource uses for its operator files. Its JSON reader
-	* is a plain read-and-parse with no content cache, so the live reload
-	* below still sees an edited file.
-	*/ async readManifest() {
-		try {
-			return await read(this.manifestPath);
-		} catch (e) {
-			const reason = normalizeError(e).message;
-			throw new AuthupError(`The theme manifest "${this.manifestPath}" could not be read.\n  ${reason}`);
-		}
-	}
-	readSignature(filePath) {
-		try {
-			const stats = fs.statSync(filePath);
-			return `${stats.size}-${stats.mtimeMs}`;
-		} catch {
-			return;
-		}
-	}
-	/**
-	* Read `fragments/head.html`. Never called when the operator has not
-	* opted in, so dropping the file into the directory does nothing on
-	* its own.
-	*/ readFragment() {
-		let raw;
-		try {
-			raw = fs.readFileSync(this.fragmentPath, "utf-8");
-		} catch {
-			return;
-		}
-		if (raw.length > 65536) {
-			this.logger?.warn(`The head fragment "${this.fragmentPath}" exceeds ${THEME_HEAD_FRAGMENT_MAX_LENGTH} bytes and is ignored.`);
-			return;
-		}
-		const trimmed = raw.trim();
-		return trimmed.length > 0 ? trimmed : void 0;
-	}
-	/**
-	* Re-read the manifest when it changed on disk, at most once per
-	* interval. One stat per console render is negligible next to the SSR
-	* pass it precedes, and it is what makes an edit visible without a
-	* restart (the property every operator asks about first).
-	*/ async revalidate() {
-		const now = Date.now();
-		if (now - this.revalidatedAt < 1e3) return;
-		this.revalidatedAt = now;
-		this.assetsPath = await this.resolveAssetsPath();
-		await this.revalidateManifest();
-		this.revalidateFragment();
-	}
-	async revalidateManifest() {
-		const signature = this.readSignature(this.manifestPath);
-		if (signature === this.manifestSignature) return;
-		if (typeof signature === "undefined") {
-			this.manifestSignature = void 0;
-			this.manifest = void 0;
-			this.headCache.clear();
-			return;
-		}
-		this.manifestSignature = signature;
-		try {
-			this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);
-			this.headCache.clear();
-		} catch (e) {
-			const reason = normalizeError(e).message;
-			this.logger?.warn(`The theme manifest changed but is invalid, keeping the previous one.\n${reason}`);
-		}
-	}
-	revalidateFragment() {
-		if (!this.fragmentsEnabled) return;
-		const signature = this.readSignature(this.fragmentPath);
-		if (signature === this.fragmentSignature) return;
-		this.fragmentSignature = signature;
-		this.headFragment = typeof signature === "undefined" ? void 0 : this.readFragment();
-		this.headCache.clear();
-	}
-	/**
-	* Always logged. The dominant failure mode of this feature is silence:
-	* mount the wrong path and the page looks exactly like an un-themed
-	* page. An enumerable boot summary is both the cheapest debugging
-	* affordance and the cheapest way to notice a file that should not be
-	* in the volume.
-	*/ logInventory() {
-		if (!this.logger) return;
-		this.logger.info(`Theme directory: ${this.directoryPath} (theming is EXPERIMENTAL and may change in a minor release)`);
-		if (this.manifest) {
-			const tokens = Object.keys(this.manifest.tokens ?? {}).length;
-			const tokensDark = Object.keys(this.manifest.tokensDark ?? {}).length;
-			this.logger.info(`Theme manifest: loaded (${tokens} token(s), ${tokensDark} dark token(s))`);
-		} else this.logger.info(`Theme manifest: none (no ${THEME_MANIFEST_FILE_NAME})`);
-		if (!this.fragmentsEnabled) this.logger.info("Theme head fragment: disabled (themeFragmentsEnabled is off)");
-		else if (this.headFragment) this.logger.info(`Theme head fragment: loaded (${this.headFragment.length} bytes from ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`);
-		else this.logger.info(`Theme head fragment: none (no ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`);
-		if (!this.assetsPath) {
-			this.logger.info(`Theme assets: none (no ${THEME_ASSETS_DIRECTORY_NAME}/ directory)`);
-			return;
-		}
-		let files;
-		try {
-			files = fs.readdirSync(this.assetsPath, {
-				recursive: true,
-				withFileTypes: true
-			}).filter((entry) => entry.isFile()).map((entry) => path.relative(this.assetsPath, path.join(entry.parentPath, entry.name)).split(path.sep).join("/")).sort();
-		} catch {
-			files = [];
-		}
-		this.logger.info(`Theme assets (${files.length}): ${files.join(", ") || "-"}`);
-	}
-};
-//#endregion
-export { ThemeProvider };
-
-//# sourceMappingURL=module.mjs.map

package/dist/adapters/http/ui/theme/module.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"module.mjs","names":["AuthupError","normalizeError","read","fs","path","THEME_MANIFEST_REVALIDATE_INTERVAL","THEME_ASSETS_DIRECTORY_NAME","THEME_FRAGMENTS_DIRECTORY_NAME","THEME_HEAD_FRAGMENT_FILE_NAME","THEME_HEAD_FRAGMENT_MAX_LENGTH","THEME_MANIFEST_FILE_NAME","THEME_MANIFEST_VERSION","buildThemeHead","parseThemeManifest","ThemeProvider","directoryPath","manifestPath","fragmentPath","fragmentsEnabled","logger","manifest","headFragment","assetsPath","manifestSignature","fragmentSignature","revalidatedAt","headCache","Map","ctx","join","load","resolveAssetsPath","readSignature","readManifest","readFragment","Date","now","clear","logInventory","getManifest","revalidate","getAssetsPath","getHead","basePath","cached","get","head","version","set","stats","promises","stat","isDirectory","undefined","e","reason","message","filePath","statSync","size","mtimeMs","raw","readFileSync","length","warn","trimmed","trim","revalidateManifest","revalidateFragment","signature","info","tokens","Object","keys","tokensDark","files","readdirSync","recursive","withFileTypes","filter","entry","isFile","map","relative","parentPath","name","split","sep","sort"],"sources":["../../../../../src/adapters/http/ui/theme/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { AuthupError, normalizeError } from '@authup/errors';\nimport type { Logger } from '@authup/server-kit';\nimport { read } from 'locter';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { THEME_MANIFEST_REVALIDATE_INTERVAL } from './constants.ts';\nimport {\n    THEME_ASSETS_DIRECTORY_NAME,\n    THEME_FRAGMENTS_DIRECTORY_NAME,\n    THEME_HEAD_FRAGMENT_FILE_NAME,\n    THEME_HEAD_FRAGMENT_MAX_LENGTH,\n    THEME_MANIFEST_FILE_NAME,\n    THEME_MANIFEST_VERSION,\n    buildThemeHead,\n    parseThemeManifest,\n} from './contract/index.ts';\nimport type { ThemeManifest } from './contract/index.ts';\nimport type { IThemeProvider, ThemeProviderContext } from './types.ts';\n\n/**\n * Owns the operator theme directory: manifest loading + validation, the\n * realpathed servable asset root, and the memoized head markup.\n *\n * Failure posture is deliberately asymmetric, and inverts the\n * FileProvisioningSource precedent for the request path:\n * - at BOOT an invalid manifest throws, so a typo is reported once, loudly,\n *   with the file path and every issue.\n * - AFTER boot a manifest that becomes invalid keeps the last good value and\n *   logs. Provisioning seeds authorization data; a theme is decoration, and\n *   a broken logo must never take down the login page of an identity\n *   provider.\n */\nexport class ThemeProvider implements IThemeProvider {\n    protected readonly directoryPath : string;\n\n    protected readonly manifestPath : string;\n\n    protected readonly fragmentPath : string;\n\n    protected readonly fragmentsEnabled : boolean;\n\n    protected readonly logger : Logger | undefined;\n\n    protected manifest : ThemeManifest | undefined;\n\n    protected headFragment : string | undefined;\n\n    protected assetsPath : string | undefined;\n\n    protected manifestSignature : string | undefined;\n\n    protected fragmentSignature : string | undefined;\n\n    protected revalidatedAt = 0;\n\n    protected headCache = new Map<string, string>();\n\n    constructor(ctx: ThemeProviderContext) {\n        this.directoryPath = ctx.directoryPath;\n        this.fragmentsEnabled = ctx.fragmentsEnabled ?? false;\n        this.logger = ctx.logger;\n        this.manifestPath = path.join(ctx.directoryPath, THEME_MANIFEST_FILE_NAME);\n        this.fragmentPath = path.join(\n            ctx.directoryPath,\n            THEME_FRAGMENTS_DIRECTORY_NAME,\n            THEME_HEAD_FRAGMENT_FILE_NAME,\n        );\n    }\n\n    async load() : Promise<void> {\n        this.assetsPath = await this.resolveAssetsPath();\n\n        // Stat first: it doubles as the existence probe (no manifest is a\n        // valid theme — the operator may ship only a stylesheet) and as the\n        // revalidation signature.\n        this.manifestSignature = this.readSignature(this.manifestPath);\n        if (this.manifestSignature) {\n            this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);\n        }\n\n        if (this.fragmentsEnabled) {\n            this.headFragment = this.readFragment();\n            this.fragmentSignature = this.readSignature(this.fragmentPath);\n        }\n\n        this.revalidatedAt = Date.now();\n        this.headCache.clear();\n\n        this.logInventory();\n    }\n\n    async getManifest() : Promise<ThemeManifest | undefined> {\n        await this.revalidate();\n\n        return this.manifest;\n    }\n\n    async getAssetsPath() : Promise<string | undefined> {\n        await this.revalidate();\n\n        return this.assetsPath;\n    }\n\n    async getHead(basePath: string) : Promise<string> {\n        // Drives the revalidation for both files.\n        const manifest = await this.getManifest();\n\n        const cached = this.headCache.get(basePath);\n        if (typeof cached === 'string') {\n            return cached;\n        }\n\n        const head = buildThemeHead(\n            manifest ?? { version: THEME_MANIFEST_VERSION },\n            basePath,\n            this.headFragment,\n        );\n        this.headCache.set(basePath, head);\n\n        return head;\n    }\n\n    // ----------------------------------------------------\n\n    /**\n     * The mount root is `<root>/assets`, never the theme root, so the\n     * manifest is unreachable over HTTP by construction.\n     *\n     * Returns the LOGICAL path, deliberately not a realpath. A Kubernetes\n     * ConfigMap volume is a symlink farm whose update swaps `..data` to a\n     * NEW timestamped directory and deletes the old one, so a realpath\n     * captured here would dangle after the first update and every asset\n     * would 404 until the pod restarts. The asset handler resolves and\n     * re-asserts containment per request instead.\n     */\n    protected async resolveAssetsPath() : Promise<string | undefined> {\n        const assetsPath = path.join(this.directoryPath, THEME_ASSETS_DIRECTORY_NAME);\n\n        try {\n            // stat follows the symlink, so this still rejects a non-directory.\n            const stats = await fs.promises.stat(assetsPath);\n\n            return stats.isDirectory() ? assetsPath : undefined;\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Read + decode the manifest through locter, the same loader\n     * FileProvisioningSource uses for its operator files. Its JSON reader\n     * is a plain read-and-parse with no content cache, so the live reload\n     * below still sees an edited file.\n     */\n    protected async readManifest() : Promise<unknown> {\n        try {\n            return await read(this.manifestPath);\n        } catch (e) {\n            const reason = normalizeError(e).message;\n\n            throw new AuthupError(\n                `The theme manifest \"${this.manifestPath}\" could not be read.\\n  ${reason}`,\n            );\n        }\n    }\n\n    protected readSignature(filePath: string) : string | undefined {\n        try {\n            const stats = fs.statSync(filePath);\n\n            return `${stats.size}-${stats.mtimeMs}`;\n        } catch {\n            return undefined;\n        }\n    }\n\n    /**\n     * Read `fragments/head.html`. Never called when the operator has not\n     * opted in, so dropping the file into the directory does nothing on\n     * its own.\n     */\n    protected readFragment() : string | undefined {\n        let raw : string;\n        try {\n            raw = fs.readFileSync(this.fragmentPath, 'utf-8');\n        } catch {\n            return undefined;\n        }\n\n        if (raw.length > THEME_HEAD_FRAGMENT_MAX_LENGTH) {\n            this.logger?.warn(\n                `The head fragment \"${this.fragmentPath}\" exceeds ${THEME_HEAD_FRAGMENT_MAX_LENGTH} bytes and is ignored.`,\n            );\n\n            return undefined;\n        }\n\n        const trimmed = raw.trim();\n\n        return trimmed.length > 0 ? trimmed : undefined;\n    }\n\n    /**\n     * Re-read the manifest when it changed on disk, at most once per\n     * interval. One stat per console render is negligible next to the SSR\n     * pass it precedes, and it is what makes an edit visible without a\n     * restart (the property every operator asks about first).\n     */\n    protected async revalidate() : Promise<void> {\n        const now = Date.now();\n        if (now - this.revalidatedAt < THEME_MANIFEST_REVALIDATE_INTERVAL) {\n            return;\n        }\n        this.revalidatedAt = now;\n\n        // Re-resolved with the manifest, not captured at boot: a directory\n        // that carried no `assets/` when the process started would otherwise\n        // 404 every asset forever, even though the manifest hot-reloads and\n        // can start referencing them. One stat, on the interval that already\n        // pays for two.\n        this.assetsPath = await this.resolveAssetsPath();\n\n        await this.revalidateManifest();\n        this.revalidateFragment();\n    }\n\n    protected async revalidateManifest() : Promise<void> {\n        const signature = this.readSignature(this.manifestPath);\n        if (signature === this.manifestSignature) {\n            return;\n        }\n\n        if (typeof signature === 'undefined') {\n            this.manifestSignature = undefined;\n            this.manifest = undefined;\n            this.headCache.clear();\n\n            return;\n        }\n\n        // Stamped before the parse attempt so a persistently broken file is\n        // re-parsed once per edit, not once per render.\n        this.manifestSignature = signature;\n\n        try {\n            this.manifest = await parseThemeManifest(await this.readManifest(), this.manifestPath);\n            this.headCache.clear();\n        } catch (e) {\n            const reason = normalizeError(e).message;\n            this.logger?.warn(`The theme manifest changed but is invalid, keeping the previous one.\\n${reason}`);\n        }\n    }\n\n    protected revalidateFragment() : void {\n        if (!this.fragmentsEnabled) {\n            return;\n        }\n\n        const signature = this.readSignature(this.fragmentPath);\n        if (signature === this.fragmentSignature) {\n            return;\n        }\n\n        this.fragmentSignature = signature;\n        this.headFragment = typeof signature === 'undefined' ?\n            undefined :\n            this.readFragment();\n        this.headCache.clear();\n    }\n\n    /**\n     * Always logged. The dominant failure mode of this feature is silence:\n     * mount the wrong path and the page looks exactly like an un-themed\n     * page. An enumerable boot summary is both the cheapest debugging\n     * affordance and the cheapest way to notice a file that should not be\n     * in the volume.\n     */\n    protected logInventory() : void {\n        if (!this.logger) {\n            return;\n        }\n\n        this.logger.info(\n            `Theme directory: ${this.directoryPath} (theming is EXPERIMENTAL and may change in a minor release)`,\n        );\n\n        if (this.manifest) {\n            const tokens = Object.keys(this.manifest.tokens ?? {}).length;\n            const tokensDark = Object.keys(this.manifest.tokensDark ?? {}).length;\n            this.logger.info(\n                `Theme manifest: loaded (${tokens} token(s), ${tokensDark} dark token(s))`,\n            );\n        } else {\n            this.logger.info(`Theme manifest: none (no ${THEME_MANIFEST_FILE_NAME})`);\n        }\n\n        if (!this.fragmentsEnabled) {\n            this.logger.info('Theme head fragment: disabled (themeFragmentsEnabled is off)');\n        } else if (this.headFragment) {\n            this.logger.info(\n                `Theme head fragment: loaded (${this.headFragment.length} bytes from ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`,\n            );\n        } else {\n            this.logger.info(\n                `Theme head fragment: none (no ${THEME_FRAGMENTS_DIRECTORY_NAME}/${THEME_HEAD_FRAGMENT_FILE_NAME})`,\n            );\n        }\n\n        if (!this.assetsPath) {\n            this.logger.info(`Theme assets: none (no ${THEME_ASSETS_DIRECTORY_NAME}/ directory)`);\n\n            return;\n        }\n\n        let files : string[];\n        try {\n            files = fs.readdirSync(this.assetsPath, { recursive: true, withFileTypes: true })\n                .filter((entry) => entry.isFile())\n                .map((entry) => path\n                    .relative(this.assetsPath as string, path.join(entry.parentPath, entry.name))\n                    .split(path.sep)\n                    .join('/'))\n                .sort();\n        } catch {\n            files = [];\n        }\n\n        this.logger.info(`Theme assets (${files.length}): ${files.join(', ') || '-'}`);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GAuCA,IAAac,gBAAb,MAAaA;CACUC;CAEAC;CAEAC;CAEAC;CAEAC;CAETC;CAEAC;CAEAC;CAEAC;CAEAC;CAEAC,gBAAgB;CAEhBC,4BAAY,IAAIC,IAAAA;CAE1B,YAAYC,KAA2B;EACnC,KAAKb,gBAAgBa,IAAIb;EACzB,KAAKG,mBAAmBU,IAAIV,oBAAoB;EAChD,KAAKC,SAASS,IAAIT;EAClB,KAAKH,eAAeZ,KAAKyB,KAAKD,IAAIb,eAAeL,wBAAAA;EACjD,KAAKO,eAAeb,KAAKyB,KACrBD,IAAIb,eACJR,gCACAC,6BAAAA;CAER;CAEA,MAAMsB,OAAuB;EACzB,KAAKR,aAAa,MAAM,KAAKS,kBAAiB;EAK9C,KAAKR,oBAAoB,KAAKS,cAAc,KAAKhB,YAAY;EAC7D,IAAI,KAAKO,mBACL,KAAKH,WAAW,MAAMP,mBAAmB,MAAM,KAAKoB,aAAY,GAAI,KAAKjB,YAAY;EAGzF,IAAI,KAAKE,kBAAkB;GACvB,KAAKG,eAAe,KAAKa,aAAY;GACrC,KAAKV,oBAAoB,KAAKQ,cAAc,KAAKf,YAAY;EACjE;EAEA,KAAKQ,gBAAgBU,KAAKC,IAAG;EAC7B,KAAKV,UAAUW,MAAK;EAEpB,KAAKC,aAAY;CACrB;CAEA,MAAMC,cAAmD;EACrD,MAAM,KAAKC,WAAU;EAErB,OAAO,KAAKpB;CAChB;CAEA,MAAMqB,gBAA8C;EAChD,MAAM,KAAKD,WAAU;EAErB,OAAO,KAAKlB;CAChB;CAEA,MAAMoB,QAAQC,UAAoC;EAE9C,MAAMvB,WAAW,MAAM,KAAKmB,YAAW;EAEvC,MAAMK,SAAS,KAAKlB,UAAUmB,IAAIF,QAAAA;EAClC,IAAI,OAAOC,WAAW,UAClB,OAAOA;EAGX,MAAME,OAAOlC,eACTQ,YAAY,EAAE2B,SAAAA,EAAgC,GAC9CJ,UACA,KAAKtB,YAAY;EAErB,KAAKK,UAAUsB,IAAIL,UAAUG,IAAAA;EAE7B,OAAOA;CACX;;;;;;;;;;;IAeA,MAAgBf,oBAAkD;EAC9D,MAAMT,aAAalB,KAAKyB,KAAK,KAAKd,eAAeT,2BAAAA;EAEjD,IAAI;GAIA,QAAO2C,MAFa9C,GAAG+C,SAASC,KAAK7B,UAAAA,EAAAA,CAExB8B,YAAW,IAAK9B,aAAa+B,KAAAA;EAC9C,QAAQ;GACJ;EACJ;CACJ;;;;;;IAQA,MAAgBpB,eAAkC;EAC9C,IAAI;GACA,OAAO,MAAM/B,KAAK,KAAKc,YAAY;EACvC,SAASsC,GAAG;GACR,MAAMC,SAAStD,eAAeqD,CAAAA,CAAAA,CAAGE;GAEjC,MAAM,IAAIxD,YACN,uBAAuB,KAAKgB,aAAa,0BAA0BuC,QAAQ;EAEnF;CACJ;CAEUvB,cAAcyB,UAAuC;EAC3D,IAAI;GACA,MAAMR,QAAQ9C,GAAGuD,SAASD,QAAAA;GAE1B,OAAO,GAAGR,MAAMU,KAAK,GAAGV,MAAMW;EAClC,QAAQ;GACJ;EACJ;CACJ;;;;;IAOA,eAA8C;EAC1C,IAAIC;EACJ,IAAI;GACAA,MAAM1D,GAAG2D,aAAa,KAAK7C,cAAc,OAAA;EAC7C,QAAQ;GACJ;EACJ;EAEA,IAAI4C,IAAIE,SAAAA,OAAyC;GAC7C,KAAK5C,QAAQ6C,KACT,sBAAsB,KAAK/C,aAAa,YAAYR,+BAA+B,uBAAuB;GAG9G;EACJ;EAEA,MAAMwD,UAAUJ,IAAIK,KAAI;EAExB,OAAOD,QAAQF,SAAS,IAAIE,UAAUZ,KAAAA;CAC1C;;;;;;IAQA,MAAgBb,aAA6B;EACzC,MAAMJ,MAAMD,KAAKC,IAAG;EACpB,IAAIA,MAAM,KAAKX,gBAAAA,KACX;EAEJ,KAAKA,gBAAgBW;EAOrB,KAAKd,aAAa,MAAM,KAAKS,kBAAiB;EAE9C,MAAM,KAAKoC,mBAAkB;EAC7B,KAAKC,mBAAkB;CAC3B;CAEA,MAAgBD,qBAAqC;EACjD,MAAME,YAAY,KAAKrC,cAAc,KAAKhB,YAAY;EACtD,IAAIqD,cAAc,KAAK9C,mBACnB;EAGJ,IAAI,OAAO8C,cAAc,aAAa;GAClC,KAAK9C,oBAAoB8B,KAAAA;GACzB,KAAKjC,WAAWiC,KAAAA;GAChB,KAAK3B,UAAUW,MAAK;GAEpB;EACJ;EAIA,KAAKd,oBAAoB8C;EAEzB,IAAI;GACA,KAAKjD,WAAW,MAAMP,mBAAmB,MAAM,KAAKoB,aAAY,GAAI,KAAKjB,YAAY;GACrF,KAAKU,UAAUW,MAAK;EACxB,SAASiB,GAAG;GACR,MAAMC,SAAStD,eAAeqD,CAAAA,CAAAA,CAAGE;GACjC,KAAKrC,QAAQ6C,KAAK,yEAAyET,QAAQ;EACvG;CACJ;CAEUa,qBAA4B;EAClC,IAAI,CAAC,KAAKlD,kBACN;EAGJ,MAAMmD,YAAY,KAAKrC,cAAc,KAAKf,YAAY;EACtD,IAAIoD,cAAc,KAAK7C,mBACnB;EAGJ,KAAKA,oBAAoB6C;EACzB,KAAKhD,eAAe,OAAOgD,cAAc,cACrChB,KAAAA,IACA,KAAKnB,aAAY;EACrB,KAAKR,UAAUW,MAAK;CACxB;;;;;;;IASA,eAAgC;EAC5B,IAAI,CAAC,KAAKlB,QACN;EAGJ,KAAKA,OAAOmD,KACR,oBAAoB,KAAKvD,cAAc,6DAA6D;EAGxG,IAAI,KAAKK,UAAU;GACf,MAAMmD,SAASC,OAAOC,KAAK,KAAKrD,SAASmD,UAAU,CAAC,CAAA,CAAA,CAAGR;GACvD,MAAMW,aAAaF,OAAOC,KAAK,KAAKrD,SAASsD,cAAc,CAAC,CAAA,CAAA,CAAGX;GAC/D,KAAK5C,OAAOmD,KACR,2BAA2BC,OAAO,aAAaG,WAAW,gBAAgB;EAElF,OACI,KAAKvD,OAAOmD,KAAK,4BAA4B5D,yBAAyB,EAAE;EAG5E,IAAI,CAAC,KAAKQ,kBACN,KAAKC,OAAOmD,KAAK,8DAAA;OACd,IAAI,KAAKjD,cACZ,KAAKF,OAAOmD,KACR,gCAAgC,KAAKjD,aAAa0C,OAAO,cAAcxD,+BAA+B,GAAGC,8BAA8B,EAAE;OAG7I,KAAKW,OAAOmD,KACR,iCAAiC/D,+BAA+B,GAAGC,8BAA8B,EAAE;EAI3G,IAAI,CAAC,KAAKc,YAAY;GAClB,KAAKH,OAAOmD,KAAK,0BAA0BhE,4BAA4B,aAAa;GAEpF;EACJ;EAEA,IAAIqE;EACJ,IAAI;GACAA,QAAQxE,GAAGyE,YAAY,KAAKtD,YAAY;IAAEuD,WAAW;IAAMC,eAAe;GAAK,CAAA,CAAA,CAC1EC,QAAQC,UAAUA,MAAMC,OAAM,CAAA,CAAA,CAC9BC,KAAKF,UAAU5E,KACX+E,SAAS,KAAK7D,YAAsBlB,KAAKyB,KAAKmD,MAAMI,YAAYJ,MAAMK,IAAI,CAAA,CAAA,CAC1EC,MAAMlF,KAAKmF,GAAG,CAAA,CACd1D,KAAK,GAAA,CAAA,CAAA,CACT2D,KAAI;EACb,QAAQ;GACJb,QAAQ,CAAA;EACZ;EAEA,KAAKxD,OAAOmD,KAAK,iBAAiBK,MAAMZ,OAAO,KAAKY,MAAM9C,KAAK,IAAA,KAAS,KAAK;CACjF;AACJ"}

package/dist/adapters/http/ui/theme/types.d.ts

@@ -1,42 +0,0 @@
-import type { Logger } from '@authup/server-kit';
-import type { ThemeManifest } from './contract/index.ts';
-export type ThemeProviderContext = {
-    /**
-     * Absolute path of the theme root (normalizeConfig resolves a relative
-     * value against the rootPath).
-     */
-    directoryPath: string;
-    /**
-     * Opt in to reading `fragments/head.html`. Default off: the fragment
-     * is unsanitized markup served on the IdP origin.
-     */
-    fragmentsEnabled?: boolean;
-    logger?: Logger;
-};
-export interface IThemeProvider {
-    /**
-     * Read + validate the manifest and resolve the servable asset root.
-     * Throws on an invalid manifest, so a typo fails the boot rather than
-     * silently rendering an un-themed page.
-     */
-    load(): Promise<void>;
-    /**
-     * The current manifest, re-read when the file changed on disk. Returns
-     * undefined when the directory carries no manifest (Layer 2 only).
-     *
-     * Async because validation runs through validup. The re-read is
-     * debounced and the head is memoized, so a steady-state render awaits
-     * an already-resolved value.
-     */
-    getManifest(): Promise<ThemeManifest | undefined>;
-    /**
-     * The realpathed `<root>/assets` directory, or undefined when absent.
-     * Every served path is re-checked against this value.
-     */
-    getAssetsPath(): Promise<string | undefined>;
-    /**
-     * The markup injected before `</head>`, memoized per base path.
-     */
-    getHead(basePath: string): Promise<string>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/ui/theme/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/http/ui/theme/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,cAAc;IAC3B;;;;OAIG;IACH,IAAI,IAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;;;;;OAOG;IACH,WAAW,IAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAEnD;;;OAGG;IACH,aAAa,IAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE9C;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C"}

package/dist/app/modules/config/helpers.d.ts

@@ -1,9 +0,0 @@
-import type { ConfigRawReadOptions } from './read/index.ts';
-import type { Config } from './types.ts';
-/**
- * Read config from env (and optionally fs) and normalize it.
- *
- * @param options
- */
-export declare function readConfig(options?: ConfigRawReadOptions): Promise<Config>;
-//# sourceMappingURL=helpers.d.ts.map

package/dist/app/modules/config/helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/helpers.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE,oBAAyB,GAAI,OAAO,CAAC,MAAM,CAAC,CAOrF"}

package/dist/app/modules/config/helpers.mjs

@@ -1,22 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import { normalizeConfig } from "./normalize.mjs";
-import { readConfigRaw } from "./read/module.mjs";
-import "./read/index.mjs";
-//#region src/app/modules/config/helpers.ts
-/**
-* Read config from env (and optionally fs) and normalize it.
-*
-* @param options
-*/ async function readConfig(options = {}) {
-	const raw = await readConfigRaw({
-		env: true,
-		...options
-	});
-	return normalizeConfig(raw);
-}
-//#endregion
-export { readConfig };
-
-//# sourceMappingURL=helpers.mjs.map

package/dist/app/modules/config/helpers.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers.mjs","names":["normalizeConfig","readConfigRaw","readConfig","options","raw","env"],"sources":["../../../../src/app/modules/config/helpers.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { normalizeConfig } from './normalize.ts';\nimport type { ConfigRawReadOptions } from './read/index.ts';\nimport { readConfigRaw } from './read/index.ts';\nimport type { Config } from './types.ts';\n\n/**\n * Read config from env (and optionally fs) and normalize it.\n *\n * @param options\n */\nexport async function readConfig(options: ConfigRawReadOptions = {}) : Promise<Config> {\n    const raw = await readConfigRaw({\n        env: true,\n        ...options,\n    });\n\n    return normalizeConfig(raw);\n}\n"],"mappings":";;;;;;;;;;;GAiBA,eAAsBE,WAAWC,UAAgC,CAAC,GAAC;CAC/D,MAAMC,MAAM,MAAMH,cAAc;EAC5BI,KAAK;EACL,GAAGF;CACP,CAAA;CAEA,OAAOH,gBAAgBI,GAAAA;AAC3B"}

package/dist/app/modules/config/normalize.d.ts

@@ -1,3 +0,0 @@
-import type { Config, ConfigInput } from './types.ts';
-export declare function normalizeConfig(input?: ConfigInput): Promise<Config>;
-//# sourceMappingURL=normalize.d.ts.map

package/dist/app/modules/config/normalize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/normalize.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAsB,eAAe,CAAC,KAAK,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4L9E"}

package/dist/app/modules/config/normalize.mjs

@@ -1,117 +0,0 @@
-import "node:path";
-import "node:url";
-import.meta.url;
-import "../../../core/entities/event/constants.mjs";
-import "../../../core/index.mjs";
-import { toPublicHost } from "../../../utils/host.mjs";
-import { expandToOrigins } from "./origins.mjs";
-import { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from "./trust-proxy.mjs";
-import { parseConfig } from "./parse.mjs";
-import { EnvironmentName, base64ToArrayBuffer } from "@authup/kit";
-import { USER_PASSWORD_MIN_LENGTH } from "@authup/core-kit";
-import { AuthupError } from "@authup/errors";
-import { read } from "envix";
-import path from "node:path";
-import process from "node:process";
-//#region src/app/modules/config/normalize.ts
-async function normalizeConfig(input = {}) {
-	const parsed = await parseConfig(input);
-	const port = parsed.port ?? 3001;
-	let host = parsed.host || "0.0.0.0";
-	let publicUrl;
-	if (parsed.publicUrl) publicUrl = parsed.publicUrl;
-	else {
-		const match = host.match(/^([^:]+)(?::(\d+))?$/);
-		if (match) {
-			[, host] = match;
-			publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;
-		} else publicUrl = `http://${toPublicHost(host)}:${port}`;
-	}
-	const env = parsed.env || read("NODE_ENV", EnvironmentName.DEVELOPMENT);
-	const trustedOrigins = [];
-	for (const value of parsed.trustedOrigins ?? []) for (const origin of expandToOrigins(value)) if (!trustedOrigins.includes(origin)) trustedOrigins.push(origin);
-	if (env !== EnvironmentName.PRODUCTION) {
-		const devOrigin = "http://localhost:3000";
-		if (!trustedOrigins.includes(devOrigin)) trustedOrigins.push(devOrigin);
-	}
-	const config = {
-		env,
-		rootPath: process.cwd(),
-		writableDirectoryPath: "writable",
-		themeDirectoryPath: "",
-		themeFragmentsEnabled: false,
-		authConsolePath: "",
-		accountConsolePath: "",
-		logger: true,
-		redis: false,
-		smtp: false,
-		port,
-		host,
-		publicUrl,
-		mtlsPublicUrl: null,
-		certificateSource: "disabled",
-		trustProxy: true,
-		middlewareBody: true,
-		middlewareCookie: true,
-		middlewareCors: true,
-		middlewarePrometheus: true,
-		middlewareQuery: true,
-		middlewareRateLimit: true,
-		middlewareSwagger: true,
-		tokenRefreshMaxAge: 259200,
-		tokenAccessMaxAge: 900,
-		tokenRefreshGracePeriod: 0,
-		promptLoginMaxAge: 60,
-		endSessionHintGracePeriod: 0,
-		registrationEnabled: false,
-		emailVerificationEnabled: false,
-		passwordRecoveryEnabled: false,
-		passwordMinLength: USER_PASSWORD_MIN_LENGTH,
-		accountConsoleEnabled: true,
-		eventLogEnabled: true,
-		eventLogRetentionDays: 90,
-		eventLogEntityEnabled: true,
-		eventLogEntityRetentionDays: 7,
-		loginAttemptThrottleEnabled: false,
-		loginAttemptThreshold: 5,
-		loginAttemptWindow: 900,
-		secretsEncryptionKey: "",
-		mfaEnabled: false,
-		mfaRequired: false,
-		mfaFreshnessMaxAge: 60,
-		mfaTicketMaxAge: 600,
-		clientAuthBasic: false,
-		clientSystemEnabled: false,
-		clientSystemSecret: "start123",
-		clientSystemSecretReset: false,
-		userAuthBasic: false,
-		userAdminEnabled: true,
-		userAdminPassword: "start123",
-		userAdminPasswordReset: false,
-		permissions: [],
-		permissionsDefaultPolicyAssignment: true,
-		...parsed,
-		trustedOrigins
-	};
-	config.writableDirectoryPath = path.resolve(config.rootPath, config.writableDirectoryPath || "writable");
-	if (config.themeDirectoryPath) config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);
-	if (config.authConsolePath) config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);
-	if (config.accountConsolePath) config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);
-	if (typeof config.trustProxy === "string") config.trustProxy = canonicalizeTrustProxy(config.trustProxy);
-	else if (Array.isArray(config.trustProxy)) config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);
-	if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) throw new AuthupError("loginAttemptThrottleEnabled requires eventLogEnabled.");
-	if (config.mfaRequired && !config.mfaEnabled) throw new AuthupError("mfaRequired requires mfaEnabled.");
-	if (config.mtlsPublicUrl && config.certificateSource === "disabled") throw new AuthupError("mtlsPublicUrl requires certificateSource to be enabled.");
-	if (config.secretsEncryptionKey) {
-		let byteLength = -1;
-		try {
-			byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;
-		} catch {}
-		if (byteLength !== 32) throw new AuthupError("secretsEncryptionKey must decode to exactly 32 bytes (base64).");
-	}
-	return config;
-}
-//#endregion
-export { normalizeConfig };
-
-//# sourceMappingURL=normalize.mjs.map

package/dist/app/modules/config/normalize.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"normalize.mjs","names":["read","path","process","USER_PASSWORD_MIN_LENGTH","AuthupError","EnvironmentName","base64ToArrayBuffer","EVENT_LOG_RETENTION_DAYS_DEFAULT","toPublicHost","expandToOrigins","parseConfig","canonicalizeTrustProxy","canonicalizeTrustProxyListEntry","normalizeConfig","input","parsed","port","host","publicUrl","regex","match","env","DEVELOPMENT","trustedOrigins","value","origin","includes","push","PRODUCTION","devOrigin","config","rootPath","cwd","writableDirectoryPath","themeDirectoryPath","themeFragmentsEnabled","authConsolePath","accountConsolePath","logger","redis","smtp","mtlsPublicUrl","certificateSource","trustProxy","middlewareBody","middlewareCookie","middlewareCors","middlewarePrometheus","middlewareQuery","middlewareRateLimit","middlewareSwagger","tokenRefreshMaxAge","tokenAccessMaxAge","tokenRefreshGracePeriod","promptLoginMaxAge","endSessionHintGracePeriod","registrationEnabled","emailVerificationEnabled","passwordRecoveryEnabled","passwordMinLength","accountConsoleEnabled","eventLogEnabled","eventLogRetentionDays","eventLogEntityEnabled","eventLogEntityRetentionDays","loginAttemptThrottleEnabled","loginAttemptThreshold","loginAttemptWindow","secretsEncryptionKey","mfaEnabled","mfaRequired","mfaFreshnessMaxAge","mfaTicketMaxAge","clientAuthBasic","clientSystemEnabled","clientSystemSecret","clientSystemSecretReset","userAuthBasic","userAdminEnabled","userAdminPassword","userAdminPasswordReset","permissions","permissionsDefaultPolicyAssignment","resolve","Array","isArray","map","byteLength","trim"],"sources":["../../../../src/app/modules/config/normalize.ts"],"sourcesContent":["/*\n * Copyright (c) 2023-2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { read } from 'envix';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { USER_PASSWORD_MIN_LENGTH } from '@authup/core-kit';\nimport { AuthupError } from '@authup/errors';\nimport { EnvironmentName, base64ToArrayBuffer } from '@authup/kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from '../../../core/index.ts';\nimport { toPublicHost } from '../../../utils/host.ts';\nimport { expandToOrigins } from './origins.ts';\nimport { parseConfig } from './parse.ts';\nimport { canonicalizeTrustProxy, canonicalizeTrustProxyListEntry } from './trust-proxy.ts';\nimport type { Config, ConfigInput } from './types.ts';\n\nexport async function normalizeConfig(input: ConfigInput = {}): Promise<Config> {\n    const parsed = await parseConfig(input);\n\n    const port = parsed.port ?? 3001;\n    let host = parsed.host || '0.0.0.0';\n\n    let publicUrl : string;\n    if (parsed.publicUrl) {\n        publicUrl = parsed.publicUrl;\n    } else {\n        const regex = /^([^:]+)(?::(\\d+))?$/;\n        const match = host.match(regex);\n        if (match) {\n            [, host] = match;\n            publicUrl = `http://${toPublicHost(host)}:${match[2] || port}`;\n        } else {\n            publicUrl = `http://${toPublicHost(host)}:${port}`;\n        }\n    }\n\n    const env = parsed.env || read('NODE_ENV', EnvironmentName.DEVELOPMENT);\n\n    // Canonicalize to bare origins (scheme://host[:port]) — a scheme-less\n    // entry (e.g. `hub.local`) expands to both its http and https origin.\n    // Downstream consumers (redirect allowlist, getAppOrigins) can rely on\n    // every entry being a full origin. Building a fresh array also keeps a\n    // repeated normalizeConfig() on the same input from accumulating the\n    // dev origin into a security-sensitive allowlist.\n    const trustedOrigins: string[] = [];\n    for (const value of parsed.trustedOrigins ?? []) {\n        for (const origin of expandToOrigins(value)) {\n            if (!trustedOrigins.includes(origin)) {\n                trustedOrigins.push(origin);\n            }\n        }\n    }\n\n    // In non-production (development & test) client-admin-console runs on :3000 while\n    // the API (publicUrl) runs on :3001. Seed :3000 into the trusted origins\n    // so the redirect allowlist (<origin>/**) and CORS accept logins from the\n    // dev UI out of the box; otherwise the realm-selection login is dead on\n    // first run.\n    if (env !== EnvironmentName.PRODUCTION) {\n        const devOrigin = 'http://localhost:3000';\n        if (!trustedOrigins.includes(devOrigin)) {\n            trustedOrigins.push(devOrigin);\n        }\n    }\n\n    const config : Config = {\n        env,\n        rootPath: process.cwd(),\n        writableDirectoryPath: 'writable',\n        // '' = theming disabled. Deliberately NOT defaulted under\n        // writableDirectoryPath: that directory is process-writable, and\n        // pairing \"process-writable\" with \"content injected into the login\n        // page\" would turn any write primitive landing there into\n        // persistent branding control on the IdP origin.\n        themeDirectoryPath: '',\n        themeFragmentsEnabled: false,\n        authConsolePath: '',\n        accountConsolePath: '',\n\n        logger: true,\n        redis: false,\n        smtp: false,\n\n        port,\n        host,\n        publicUrl,\n        mtlsPublicUrl: null,\n        certificateSource: 'disabled',\n        trustProxy: true,\n\n        middlewareBody: true,\n        middlewareCookie: true,\n        middlewareCors: true,\n        middlewarePrometheus: true,\n        middlewareQuery: true,\n        middlewareRateLimit: true,\n        middlewareSwagger: true,\n        tokenRefreshMaxAge: 259_200,\n        tokenAccessMaxAge: 900,\n        tokenRefreshGracePeriod: 0,\n        promptLoginMaxAge: 60,\n        endSessionHintGracePeriod: 0,\n        registrationEnabled: false,\n        emailVerificationEnabled: false,\n        passwordRecoveryEnabled: false,\n        passwordMinLength: USER_PASSWORD_MIN_LENGTH,\n        accountConsoleEnabled: true,\n\n        eventLogEnabled: true,\n        eventLogRetentionDays: EVENT_LOG_RETENTION_DAYS_DEFAULT,\n        eventLogEntityEnabled: true,\n        eventLogEntityRetentionDays: 7,\n        loginAttemptThrottleEnabled: false,\n        loginAttemptThreshold: 5,\n        loginAttemptWindow: 900,\n\n        secretsEncryptionKey: '',\n\n        mfaEnabled: false,\n        mfaRequired: false,\n        mfaFreshnessMaxAge: 60,\n        mfaTicketMaxAge: 600,\n\n        clientAuthBasic: false,\n        clientSystemEnabled: false,\n        clientSystemSecret: 'start123',\n        clientSystemSecretReset: false,\n\n        userAuthBasic: false,\n        userAdminEnabled: true,\n        userAdminPassword: 'start123',\n        userAdminPasswordReset: false,\n\n        permissions: [],\n        permissionsDefaultPolicyAssignment: true,\n        ...parsed,\n\n        // After the spread so the canonicalized + dev-seeded list wins over\n        // the raw parsed list (parsed.trustedOrigins is merged in above).\n        trustedOrigins,\n    };\n\n    // After the spread, so a relative value supplied by any config surface\n    // is resolved. Every consumer then receives an absolute path and none\n    // of them has to care what the process cwd was.\n    config.writableDirectoryPath = path.resolve(\n        config.rootPath,\n        config.writableDirectoryPath || 'writable',\n    );\n\n    if (config.themeDirectoryPath) {\n        config.themeDirectoryPath = path.resolve(config.rootPath, config.themeDirectoryPath);\n    }\n\n    if (config.authConsolePath) {\n        config.authConsolePath = path.resolve(config.rootPath, config.authConsolePath);\n    }\n\n    if (config.accountConsolePath) {\n        config.accountConsolePath = path.resolve(config.rootPath, config.accountConsolePath);\n    }\n\n    // Canonicalize the string form on EVERY config surface (env, .conf,\n    // file, programmatic) — proxy-addr accepts single-integer \"long value\"\n    // IPv4 notation, so an un-canonicalized `trustProxy: \"1\"` would silently\n    // compile to an allowlist of `0.0.0.1` instead of one trusted hop.\n    if (typeof config.trustProxy === 'string') {\n        config.trustProxy = canonicalizeTrustProxy(config.trustProxy);\n    } else if (Array.isArray(config.trustProxy)) {\n        config.trustProxy = config.trustProxy.map(canonicalizeTrustProxyListEntry);\n    }\n\n    // fail loud at boot: the throttle counts loginFailed rows in\n    // auth_events — with the audit log disabled it would silently no-op.\n    if (config.loginAttemptThrottleEnabled && !config.eventLogEnabled) {\n        throw new AuthupError('loginAttemptThrottleEnabled requires eventLogEnabled.');\n    }\n\n    if (config.mfaRequired && !config.mfaEnabled) {\n        throw new AuthupError('mfaRequired requires mfaEnabled.');\n    }\n\n    if (config.mtlsPublicUrl && config.certificateSource === 'disabled') {\n        throw new AuthupError('mtlsPublicUrl requires certificateSource to be enabled.');\n    }\n\n    // fail loud at boot rather than at first key-store access: wrapped key\n    // material must never be minted under a malformed KEK. Validate the\n    // DECODED length here (not just base64 shape) so a whitespace / invalid /\n    // wrong-length key fails at config time, not asynchronously inside the\n    // cipher at first wrap/unwrap.\n    if (config.secretsEncryptionKey) {\n        let byteLength = -1;\n        try {\n            byteLength = base64ToArrayBuffer(config.secretsEncryptionKey.trim()).byteLength;\n        } catch {\n            // fall through — treated as invalid below\n        }\n        if (byteLength !== 32) {\n            throw new AuthupError('secretsEncryptionKey must decode to exactly 32 bytes (base64).');\n        }\n    }\n\n    return config;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,eAAsBa,gBAAgBC,QAAqB,CAAC,GAAC;CACzD,MAAMC,SAAS,MAAML,YAAYI,KAAAA;CAEjC,MAAME,OAAOD,OAAOC,QAAQ;CAC5B,IAAIC,OAAOF,OAAOE,QAAQ;CAE1B,IAAIC;CACJ,IAAIH,OAAOG,WACPA,YAAYH,OAAOG;MAChB;EAEH,MAAME,QAAQH,KAAKG,MAAMD,sBAAAA;EACzB,IAAIC,OAAO;GACP,GAAGH,QAAQG;GACXF,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGG,MAAM,MAAMJ;EAC5D,OACIE,YAAY,UAAUV,aAAaS,IAAAA,EAAM,GAAGD;CAEpD;CAEA,MAAMK,MAAMN,OAAOM,OAAOrB,KAAK,YAAYK,gBAAgBiB,WAAW;CAQtE,MAAMC,iBAA2B,CAAA;CACjC,KAAK,MAAMC,SAAST,OAAOQ,kBAAkB,CAAA,GACzC,KAAK,MAAME,UAAUhB,gBAAgBe,KAAAA,GACjC,IAAI,CAACD,eAAeG,SAASD,MAAAA,GACzBF,eAAeI,KAAKF,MAAAA;CAUhC,IAAIJ,QAAQhB,gBAAgBuB,YAAY;EACpC,MAAMC,YAAY;EAClB,IAAI,CAACN,eAAeG,SAASG,SAAAA,GACzBN,eAAeI,KAAKE,SAAAA;CAE5B;CAEA,MAAMC,SAAkB;EACpBT;EACAU,UAAU7B,QAAQ8B,IAAG;EACrBC,uBAAuB;EAMvBC,oBAAoB;EACpBC,uBAAuB;EACvBC,iBAAiB;EACjBC,oBAAoB;EAEpBC,QAAQ;EACRC,OAAO;EACPC,MAAM;EAENxB;EACAC;EACAC;EACAuB,eAAe;EACfC,mBAAmB;EACnBC,YAAY;EAEZC,gBAAgB;EAChBC,kBAAkB;EAClBC,gBAAgB;EAChBC,sBAAsB;EACtBC,iBAAiB;EACjBC,qBAAqB;EACrBC,mBAAmB;EACnBC,oBAAoB;EACpBC,mBAAmB;EACnBC,yBAAyB;EACzBC,mBAAmB;EACnBC,2BAA2B;EAC3BC,qBAAqB;EACrBC,0BAA0B;EAC1BC,yBAAyB;EACzBC,mBAAmBxD;EACnByD,uBAAuB;EAEvBC,iBAAiB;EACjBC,uBAAAA;EACAC,uBAAuB;EACvBC,6BAA6B;EAC7BC,6BAA6B;EAC7BC,uBAAuB;EACvBC,oBAAoB;EAEpBC,sBAAsB;EAEtBC,YAAY;EACZC,aAAa;EACbC,oBAAoB;EACpBC,iBAAiB;EAEjBC,iBAAiB;EACjBC,qBAAqB;EACrBC,oBAAoB;EACpBC,yBAAyB;EAEzBC,eAAe;EACfC,kBAAkB;EAClBC,mBAAmB;EACnBC,wBAAwB;EAExBC,aAAa,CAAA;EACbC,oCAAoC;EACpC,GAAGnE;EAIHQ;CACJ;CAKAO,OAAOG,wBAAwBhC,KAAKkF,QAChCrD,OAAOC,UACPD,OAAOG,yBAAyB,UAAA;CAGpC,IAAIH,OAAOI,oBACPJ,OAAOI,qBAAqBjC,KAAKkF,QAAQrD,OAAOC,UAAUD,OAAOI,kBAAkB;CAGvF,IAAIJ,OAAOM,iBACPN,OAAOM,kBAAkBnC,KAAKkF,QAAQrD,OAAOC,UAAUD,OAAOM,eAAe;CAGjF,IAAIN,OAAOO,oBACPP,OAAOO,qBAAqBpC,KAAKkF,QAAQrD,OAAOC,UAAUD,OAAOO,kBAAkB;CAOvF,IAAI,OAAOP,OAAOa,eAAe,UAC7Bb,OAAOa,aAAahC,uBAAuBmB,OAAOa,UAAU;MACzD,IAAIyC,MAAMC,QAAQvD,OAAOa,UAAU,GACtCb,OAAOa,aAAab,OAAOa,WAAW2C,IAAI1E,+BAAAA;CAK9C,IAAIkB,OAAOmC,+BAA+B,CAACnC,OAAO+B,iBAC9C,MAAM,IAAIzD,YAAY,uDAAA;CAG1B,IAAI0B,OAAOwC,eAAe,CAACxC,OAAOuC,YAC9B,MAAM,IAAIjE,YAAY,kCAAA;CAG1B,IAAI0B,OAAOW,iBAAiBX,OAAOY,sBAAsB,YACrD,MAAM,IAAItC,YAAY,yDAAA;CAQ1B,IAAI0B,OAAOsC,sBAAsB;EAC7B,IAAImB,aAAa;EACjB,IAAI;GACAA,aAAajF,oBAAoBwB,OAAOsC,qBAAqBoB,KAAI,CAAA,CAAA,CAAID;EACzE,QAAQ,CAER;EACA,IAAIA,eAAe,IACf,MAAM,IAAInF,YAAY,gEAAA;CAE9B;CAEA,OAAO0B;AACX"}

package/dist/app/modules/config/origins.d.ts

@@ -1,25 +0,0 @@
-import type { Config } from './types.ts';
-/**
- * Expand a configured trusted-origin value to its canonical origin(s).
- *
- * A value with an explicit scheme contributes exactly that origin —
- * the way to restrict a host to https only. A bare host[:port]
- * (e.g. `hub.local`) contributes both the http and https origin.
- *
- * Only http(s) is accepted: other schemes either have no usable web
- * origin (`new URL('myapp://x').origin` is the literal string "null")
- * or are meaningless as a redirect target for the web client — letting
- * them through would put garbage into a security-sensitive allowlist.
- *
- * Throws on values that don't parse as a URL/host or use another scheme.
- */
-export declare function expandToOrigins(value: string): string[];
-/**
- * Derive the set of trusted application origins (scheme://host[:port]).
- *
- * publicUrl may carry a path, so its origin is extracted; trustedOrigins
- * entries are canonical origins — normalizeConfig owns that invariant
- * (expansion + dedupe via expandToOrigins) — and are merged verbatim.
- */
-export declare function getAppOrigins(config: Pick<Config, 'publicUrl' | 'trustedOrigins'>): string[];
-//# sourceMappingURL=origins.d.ts.map

package/dist/app/modules/config/origins.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../../../src/app/modules/config/origins.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAMzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBvD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,MAAM,EAAE,CAS5F"}