@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/adapters/http/controllers/entities/session/module.mjs

@@ -3,14 +3,24 @@ import "node:url";
 import.meta.url;
 import { RECORD_QUERY_PARAMETERS, describeQuerySchema } from "../../../../../core/query/describe.mjs";
 import { sessionSchema } from "../../../../../core/entities/session/schema.mjs";
+import { SYSTEM_CLIENT_SCOPE_NAMES } from "../../../../../core/entities/client/system-clients.mjs";
+import { deriveAmrAcr } from "../../../../../core/oauth2/authorization/helpers.mjs";
 import { isSelfToken } from "../../../../../utils/self-id.mjs";
 import "../../../../../utils/index.mjs";
+import "../../../../../core/oauth2/session-credential/constants.mjs";
+import { resolveIntrospectionSubject } from "../../../../../core/oauth2/introspection/module.mjs";
 import "../../../../../core/index.mjs";
+import { useRequestIdentity } from "../../../request/helpers/identity.mjs";
 import { buildActorContext } from "../../../request/helpers/actor.mjs";
 import { useRequestSessionId } from "../../../request/helpers/session-id.mjs";
 import "../../../request/index.mjs";
+import { unsetSessionCookie } from "../../../cookie/session.mjs";
+import "../../../cookie/index.mjs";
 import { ForceLoggedInMiddleware } from "../../../middleware/built-in/loggedin/module.mjs";
 import "../../../middleware/index.mjs";
+import { IdentityType } from "@authup/core-kit";
+import { OAuth2SubKind, serializeOAuth2Scope } from "@authup/specs";
+import { useRequestCookie } from "@routup/basic/cookie";
 import { useRequestQuery } from "@routup/basic/query";
 import { DContext, DController, DDelete, DGet, DPath, DTags } from "@routup/decorators";
 //#region src/adapters/http/controllers/entities/session/module.ts
@@ -30,8 +40,64 @@ function _ts_param(paramIndex, decorator) {
 }
 var SessionController = class {
 	service;
+	baseURL;
+	identityResolver;
+	identityPermissionProvider;
+	sessionRepository;
 	constructor(ctx) {
 		this.service = ctx.service;
+		this.baseURL = ctx.baseURL;
+		this.identityResolver = ctx.identityResolver;
+		this.identityPermissionProvider = ctx.identityPermissionProvider;
+		this.sessionRepository = ctx.sessionRepository;
+	}
+	/**
+	* The caller's own session as a CONTEXT rather than a row: the identity
+	* claims and permission projection a console hydrates its store from, which
+	* is what `POST /token/introspect` answers minus everything token-shaped.
+	*
+	* A sibling of `@me` rather than a replacement for it: `GET /sessions/@me`
+	* returns the `auth_sessions` ROW, and a console needs the subject's claims
+	* and permissions, which are not on it. Named `introspect` because it is
+	* literally the introspection projection, keyed off the request's own
+	* credential instead of a token in the body.
+	*
+	* No client scope on the permission read, deliberately.
+	* `reduceBindingsByIdentityClient` keeps only permissions whose own
+	* `clientId` matches the one passed, so naming a console's client would
+	* drop every global permission — nearly all of them. The bearer path passes
+	* the token's `client_id` because a token IS issued to one client; a
+	* session is not.
+	*/ async getOwnIntrospection(event) {
+		event.response.headers.set("cache-control", "no-store");
+		event.response.headers.append("vary", "cookie");
+		const identity = useRequestIdentity(event);
+		const sessionId = useRequestSessionId(event);
+		if (!identity || !sessionId || identity.type !== IdentityType.USER || !this.identityResolver || !this.identityPermissionProvider) return { active: false };
+		const actor = buildActorContext(event);
+		const session = await this.service.getOne(sessionId, actor);
+		if (!session) return { active: false };
+		const subject = await resolveIntrospectionSubject({
+			identityResolver: this.identityResolver,
+			identityPermissionProvider: this.identityPermissionProvider
+		}, {
+			sub: identity.id,
+			subKind: identity.type,
+			realmId: identity.realmId,
+			active: true
+		});
+		return {
+			active: true,
+			permissions: subject.permissions,
+			sub: identity.id,
+			sub_kind: OAuth2SubKind.USER,
+			session_id: session.id,
+			realm_id: identity.realmId,
+			realm_name: identity.realmName,
+			scope: serializeOAuth2Scope(SYSTEM_CLIENT_SCOPE_NAMES),
+			...deriveAmrAcr(session),
+			...subject.claims
+		};
 	}
 	async getMany(event) {
 		const actor = buildActorContext(event);
@@ -65,6 +131,7 @@ var SessionController = class {
 		const actor = buildActorContext(event);
 		const resolvedId = isSelfToken(id) ? useRequestSessionId(event) ?? id : id;
 		const entity = await this.service.delete(resolvedId, actor);
+		if (this.baseURL && resolvedId === useRequestSessionId(event) && useRequestCookie(event, "authup_session")) unsetSessionCookie(event, this.baseURL);
 		event.response.status = 202;
 		return {
 			data: entity,
@@ -72,6 +139,13 @@ var SessionController = class {
 		};
 	}
 };
+_ts_decorate([
+	DGet("/@me/introspect", [ForceLoggedInMiddleware]),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], SessionController.prototype, "getOwnIntrospection", null);
 _ts_decorate([
 	DGet("", [ForceLoggedInMiddleware]),
 	_ts_param(0, DContext()),

package/dist/adapters/http/controllers/entities/session/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","isSelfToken","RECORD_QUERY_PARAMETERS","describeQuerySchema","sessionSchema","ForceLoggedInMiddleware","buildActorContext","useRequestSessionId","SessionController","service","ctx","getMany","event","actor","data","meta","schema","getOne","id","resolvedId","entity","dropMany","result","deleteMany","query","currentSessionId","response","status","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { Session } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse, EntityRecordResponse, SessionDeleteManyResponse } from '@authup/core-http-kit';\nimport { isSelfToken } from '../../../../../utils/index.ts';\nimport type { ISessionService } from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    describeQuerySchema,\n    sessionSchema,\n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, useRequestSessionId } from '../../../request/index.ts';\n\nexport type SessionControllerContext = {\n    service: ISessionService,\n};\n\n@DTags('session')\n@DController(['/sessions', '/realms/:realmId/sessions'])\nexport class SessionController {\n    protected service: ISessionService;\n\n    constructor(ctx: SessionControllerContext) {\n        this.service = ctx.service;\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Session>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(sessionSchema),\n            },\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<Session>> {\n        const actor = buildActorContext(event);\n\n        // `@me` / `@self` resolve to the caller's current session.\n        const resolvedId = isSelfToken(id) ? (useRequestSessionId(event) ?? id) : id;\n\n        const entity = await this.service.getOne(resolvedId, actor);\n\n        return { data: entity, meta: { schema: describeQuerySchema(sessionSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DDelete('', [ForceLoggedInMiddleware])\n    async dropMany(\n        @DContext() event: IAppEvent,\n    ): Promise<SessionDeleteManyResponse> {\n        const actor = buildActorContext(event);\n\n        // A recognized target filter (e.g. `?filter[userId]=<uuid>`) → admin\n        // force-logout (SESSION_DELETE + per-session realm-match). No filter →\n        // self-service \"log out my other devices\" (keeps the current session).\n        const result = await this.service.deleteMany(actor, {\n            query: useRequestQuery(event),\n            currentSessionId: useRequestSessionId(event),\n        });\n\n        event.response.status = 202;\n        return result;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<Session>> {\n        const actor = buildActorContext(event);\n\n        const resolvedId = isSelfToken(id) ? (useRequestSessionId(event) ?? id) : id;\n        const entity = await this.service.delete(resolvedId, actor);\n\n        event.response.status = 202;\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAac,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,QACF,OAC0C;EAC1C,MAAME,QAAQP,kBAAkBM,KAAAA;EAChC,MAAM,EACFE,MACAC,SACA,MAAM,KAAKN,QAAQE,QAAQX,gBAAgBY,KAAAA,GAAQC,KAAAA;EAEvD,OAAO;GACHC;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQb,oBAAoBC,aAAAA;GAChC;EACJ;CACJ;CAEA,MACMa,OACF,IACA,OACsC;EACtC,MAAMJ,QAAQP,kBAAkBM,KAAAA;EAGhC,MAAMO,aAAalB,YAAYiB,EAAAA,IAAOX,oBAAoBK,KAAAA,KAAUM,KAAMA;EAI1E,OAAO;GAAEJ,MAAMM,MAFM,KAAKX,QAAQQ,OAAOE,YAAYN,KAAAA;GAE9BE,MAAM,EAAEC,QAAQb,oBAAoBC,eAAeF,uBAAAA,EAAyB;EAAE;CACzG;CAEA,MACMmB,SACF,OACkC;EAClC,MAAMR,QAAQP,kBAAkBM,KAAAA;EAKhC,MAAMU,SAAS,MAAM,KAAKb,QAAQc,WAAWV,OAAO;GAChDW,OAAOxB,gBAAgBY,KAAAA;GACvBa,kBAAkBlB,oBAAoBK,KAAAA;EAC1C,CAAA;EAEAA,MAAMc,SAASC,SAAS;EACxB,OAAOL;CACX;CAEA,MACMM,KACF,IACA,OACsC;EACtC,MAAMf,QAAQP,kBAAkBM,KAAAA;EAEhC,MAAMO,aAAalB,YAAYiB,EAAAA,IAAOX,oBAAoBK,KAAAA,KAAUM,KAAMA;EAC1E,MAAME,SAAS,MAAM,KAAKX,QAAQoB,OAAOV,YAAYN,KAAAA;EAErDD,MAAMc,SAASC,SAAS;EACxB,OAAO;GAAEb,MAAMM;GAAQL,MAAM,CAAC;EAAE;CACpC;AACJ;;CAjEeV,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAmBIA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAeDA,QAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAkBIA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;CA5DR,YAAA,CAAA,aAAa,2BAAA,CAAA"}
+{"version":3,"file":"module.mjs","names":["DContext","DController","DDelete","DGet","DPath","DTags","useRequestQuery","isSelfToken","RECORD_QUERY_PARAMETERS","SESSION_COOKIE","deriveAmrAcr","describeQuerySchema","resolveIntrospectionSubject","sessionSchema","ForceLoggedInMiddleware","buildActorContext","useRequestIdentity","useRequestSessionId","IdentityType","OAuth2SubKind","serializeOAuth2Scope","useRequestCookie","SYSTEM_CLIENT_SCOPE_NAMES","unsetSessionCookie","SessionController","service","baseURL","identityResolver","identityPermissionProvider","sessionRepository","ctx","getOwnIntrospection","event","response","headers","set","append","identity","sessionId","type","USER","active","actor","session","getOne","subject","sub","id","subKind","realmId","permissions","sub_kind","session_id","realm_id","realm_name","realmName","scope","claims","getMany","data","meta","schema","resolvedId","entity","dropMany","result","deleteMany","query","currentSessionId","status","drop","delete"],"sources":["../../../../../../src/adapters/http/controllers/entities/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DContext,\n    DController,\n    DDelete,\n    DGet,\n    DPath,\n    DTags,\n} from '@routup/decorators';\nimport type { Session } from '@authup/core-kit';\nimport type { IAppEvent } from 'routup';\nimport { useRequestQuery } from '@routup/basic/query';\nimport type { EntityCollectionResponse, EntityRecordResponse, SessionDeleteManyResponse } from '@authup/core-http-kit';\nimport { isSelfToken } from '../../../../../utils/index.ts';\nimport type { \n    IIdentityPermissionProvider, \n    IIdentityResolver, \n    ISessionRepository, \n    ISessionService,  \n} from '../../../../../core/index.ts';\nimport {\n    RECORD_QUERY_PARAMETERS,\n    SESSION_COOKIE,\n    deriveAmrAcr, \n    describeQuerySchema, \n    resolveIntrospectionSubject, \n    sessionSchema, \n} from '../../../../../core/index.ts';\nimport { ForceLoggedInMiddleware } from '../../../middleware/index.ts';\nimport { buildActorContext, useRequestIdentity, useRequestSessionId } from '../../../request/index.ts';\nimport { IdentityType } from '@authup/core-kit';\nimport type { OAuth2TokenIntrospectionResponse } from '@authup/specs';\nimport { OAuth2SubKind, serializeOAuth2Scope } from '@authup/specs';\nimport { useRequestCookie } from '@routup/basic/cookie';\nimport { SYSTEM_CLIENT_SCOPE_NAMES } from '../../../../../core/entities/client/system-clients.ts';\nimport { unsetSessionCookie } from '../../../cookie/index.ts';\n\nexport type SessionControllerContext = {\n    /**\n     * Only the cookie-session additions below use these (plan 088). The entity\n     * routes delegate wholly to `service`, as every entity controller does.\n     */\n    baseURL?: string,\n    identityResolver?: IIdentityResolver,\n    identityPermissionProvider?: IIdentityPermissionProvider,\n    sessionRepository?: ISessionRepository,\n    service: ISessionService,\n};\n\n@DTags('session')\n@DController(['/sessions', '/realms/:realmId/sessions'])\nexport class SessionController {\n    protected service: ISessionService;\n\n    protected baseURL?: string;\n\n    protected identityResolver?: IIdentityResolver;\n\n    protected identityPermissionProvider?: IIdentityPermissionProvider;\n\n    protected sessionRepository?: ISessionRepository;\n\n    constructor(ctx: SessionControllerContext) {\n        this.service = ctx.service;\n        this.baseURL = ctx.baseURL;\n        this.identityResolver = ctx.identityResolver;\n        this.identityPermissionProvider = ctx.identityPermissionProvider;\n        this.sessionRepository = ctx.sessionRepository;\n    }\n\n    /**\n     * The caller's own session as a CONTEXT rather than a row: the identity\n     * claims and permission projection a console hydrates its store from, which\n     * is what `POST /token/introspect` answers minus everything token-shaped.\n     *\n     * A sibling of `@me` rather than a replacement for it: `GET /sessions/@me`\n     * returns the `auth_sessions` ROW, and a console needs the subject's claims\n     * and permissions, which are not on it. Named `introspect` because it is\n     * literally the introspection projection, keyed off the request's own\n     * credential instead of a token in the body.\n     *\n     * No client scope on the permission read, deliberately.\n     * `reduceBindingsByIdentityClient` keeps only permissions whose own\n     * `clientId` matches the one passed, so naming a console's client would\n     * drop every global permission — nearly all of them. The bearer path passes\n     * the token's `client_id` because a token IS issued to one client; a\n     * session is not.\n     */\n    @DGet('/@me/introspect', [ForceLoggedInMiddleware])\n    async getOwnIntrospection(\n        @DContext() event: IAppEvent,\n    ): Promise<OAuth2TokenIntrospectionResponse> {\n        // A per-user document whose only discriminator may be an opaque\n        // cookie, which is exactly what an intermediary can cross-serve.\n        // `vary` is APPENDED because @routup/cors already put `origin` there.\n        event.response.headers.set('cache-control', 'no-store');\n        event.response.headers.append('vary', 'cookie');\n\n        const identity = useRequestIdentity(event);\n        const sessionId = useRequestSessionId(event);\n\n        if (\n            !identity ||\n            !sessionId ||\n            identity.type !== IdentityType.USER ||\n            !this.identityResolver ||\n            !this.identityPermissionProvider\n        ) {\n            return { active: false };\n        }\n\n        const actor = buildActorContext(event);\n        const session = await this.service.getOne(sessionId, actor);\n        if (!session) {\n            return { active: false };\n        }\n\n        const subject = await resolveIntrospectionSubject({\n            identityResolver: this.identityResolver,\n            identityPermissionProvider: this.identityPermissionProvider,\n        }, {\n            sub: identity.id,\n            subKind: identity.type,\n            realmId: identity.realmId,\n            active: true,\n        });\n\n        return {\n            active: true,\n            // todo: permissions property should be removed.\n            permissions: subject.permissions,\n            sub: identity.id,\n            sub_kind: OAuth2SubKind.USER,\n            session_id: session.id,\n            realm_id: identity.realmId,\n            realm_name: identity.realmName,\n            scope: serializeOAuth2Scope(SYSTEM_CLIENT_SCOPE_NAMES),\n            ...deriveAmrAcr(session),\n            ...subject.claims,\n        };\n    }\n\n    @DGet('', [ForceLoggedInMiddleware])\n    async getMany(\n        @DContext() event: IAppEvent,\n    ): Promise<EntityCollectionResponse<Session>> {\n        const actor = buildActorContext(event);\n        const {\n            data,\n            meta,\n        } = await this.service.getMany(useRequestQuery(event), actor);\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                schema: describeQuerySchema(sessionSchema),\n            },\n        };\n    }\n\n    @DGet('/:id', [ForceLoggedInMiddleware])\n    async getOne(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<Session>> {\n        const actor = buildActorContext(event);\n\n        // `@me` / `@self` resolve to the caller's current session.\n        const resolvedId = isSelfToken(id) ? (useRequestSessionId(event) ?? id) : id;\n\n        const entity = await this.service.getOne(resolvedId, actor);\n\n        return { data: entity, meta: { schema: describeQuerySchema(sessionSchema, RECORD_QUERY_PARAMETERS) } };\n    }\n\n    @DDelete('', [ForceLoggedInMiddleware])\n    async dropMany(\n        @DContext() event: IAppEvent,\n    ): Promise<SessionDeleteManyResponse> {\n        const actor = buildActorContext(event);\n\n        // A recognized target filter (e.g. `?filter[userId]=<uuid>`) → admin\n        // force-logout (SESSION_DELETE + per-session realm-match). No filter →\n        // self-service \"log out my other devices\" (keeps the current session).\n        const result = await this.service.deleteMany(actor, {\n            query: useRequestQuery(event),\n            currentSessionId: useRequestSessionId(event),\n        });\n\n        event.response.status = 202;\n        return result;\n    }\n\n    @DDelete('/:id', [ForceLoggedInMiddleware])\n    async drop(\n        @DPath('id') id: string,\n        @DContext() event: IAppEvent,\n    ): Promise<EntityRecordResponse<Session>> {\n        const actor = buildActorContext(event);\n\n        const resolvedId = isSelfToken(id) ? (useRequestSessionId(event) ?? id) : id;\n        const entity = await this.service.delete(resolvedId, actor);\n\n        // Sign-out for a cookie session, folded in here rather than given its\n        // own route (plan 088). Revoking the row was always most of the job;\n        // the reason this endpoint could not BE the sign-out was that it left\n        // a dead cookie the browser kept presenting on every request. Clearing\n        // it removes that, and the same-origin gate is already upstream: a\n        // cookie only authenticates at all when the middleware accepted it.\n        // Only for the caller's OWN session: revoking another device must not\n        // drop the credential of the one doing the revoking.\n        if (\n            this.baseURL &&\n            resolvedId === useRequestSessionId(event) &&\n            useRequestCookie(event, SESSION_COOKIE)\n        ) {\n            unsetSessionCookie(event, this.baseURL);\n        }\n\n        event.response.status = 202;\n        return { data: entity, meta: {} };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,IAAawB,oBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEAC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,KAAKL,UAAUK,IAAIL;EACnB,KAAKC,UAAUI,IAAIJ;EACnB,KAAKC,mBAAmBG,IAAIH;EAC5B,KAAKC,6BAA6BE,IAAIF;EACtC,KAAKC,oBAAoBC,IAAID;CACjC;;;;;;;;;;;;;;;;;;IAoBA,MACME,oBACF,OACyC;EAIzCC,MAAMC,SAASC,QAAQC,IAAI,iBAAiB,UAAA;EAC5CH,MAAMC,SAASC,QAAQE,OAAO,QAAQ,QAAA;EAEtC,MAAMC,WAAWrB,mBAAmBgB,KAAAA;EACpC,MAAMM,YAAYrB,oBAAoBe,KAAAA;EAEtC,IACI,CAACK,YACD,CAACC,aACDD,SAASE,SAASrB,aAAasB,QAC/B,CAAC,KAAKb,oBACN,CAAC,KAAKC,4BAEN,OAAO,EAAEa,QAAQ,MAAM;EAG3B,MAAMC,QAAQ3B,kBAAkBiB,KAAAA;EAChC,MAAMW,UAAU,MAAM,KAAKlB,QAAQmB,OAAON,WAAWI,KAAAA;EACrD,IAAI,CAACC,SACD,OAAO,EAAEF,QAAQ,MAAM;EAG3B,MAAMI,UAAU,MAAMjC,4BAA4B;GAC9Ce,kBAAkB,KAAKA;GACvBC,4BAA4B,KAAKA;EACrC,GAAG;GACCkB,KAAKT,SAASU;GACdC,SAASX,SAASE;GAClBU,SAASZ,SAASY;GAClBR,QAAQ;EACZ,CAAA;EAEA,OAAO;GACHA,QAAQ;GAERS,aAAaL,QAAQK;GACrBJ,KAAKT,SAASU;GACdI,UAAUhC,cAAcqB;GACxBY,YAAYT,QAAQI;GACpBM,UAAUhB,SAASY;GACnBK,YAAYjB,SAASkB;GACrBC,OAAOpC,qBAAqBE,yBAAAA;GAC5B,GAAGZ,aAAaiC,OAAAA;GAChB,GAAGE,QAAQY;EACf;CACJ;CAEA,MACMC,QACF,OAC0C;EAC1C,MAAMhB,QAAQ3B,kBAAkBiB,KAAAA;EAChC,MAAM,EACF2B,MACAC,SACA,MAAM,KAAKnC,QAAQiC,QAAQpD,gBAAgB0B,KAAAA,GAAQU,KAAAA;EAEvD,OAAO;GACHiB;GACAC,MAAM;IACF,GAAGA;IACHC,QAAQlD,oBAAoBE,aAAAA;GAChC;EACJ;CACJ;CAEA,MACM+B,OACF,IACA,OACsC;EACtC,MAAMF,QAAQ3B,kBAAkBiB,KAAAA;EAGhC,MAAM8B,aAAavD,YAAYwC,EAAAA,IAAO9B,oBAAoBe,KAAAA,KAAUe,KAAMA;EAI1E,OAAO;GAAEY,MAAMI,MAFM,KAAKtC,QAAQmB,OAAOkB,YAAYpB,KAAAA;GAE9BkB,MAAM,EAAEC,QAAQlD,oBAAoBE,eAAeL,uBAAAA,EAAyB;EAAE;CACzG;CAEA,MACMwD,SACF,OACkC;EAClC,MAAMtB,QAAQ3B,kBAAkBiB,KAAAA;EAKhC,MAAMiC,SAAS,MAAM,KAAKxC,QAAQyC,WAAWxB,OAAO;GAChDyB,OAAO7D,gBAAgB0B,KAAAA;GACvBoC,kBAAkBnD,oBAAoBe,KAAAA;EAC1C,CAAA;EAEAA,MAAMC,SAASoC,SAAS;EACxB,OAAOJ;CACX;CAEA,MACMK,KACF,IACA,OACsC;EACtC,MAAM5B,QAAQ3B,kBAAkBiB,KAAAA;EAEhC,MAAM8B,aAAavD,YAAYwC,EAAAA,IAAO9B,oBAAoBe,KAAAA,KAAUe,KAAMA;EAC1E,MAAMgB,SAAS,MAAM,KAAKtC,QAAQ8C,OAAOT,YAAYpB,KAAAA;EAUrD,IACI,KAAKhB,WACLoC,eAAe7C,oBAAoBe,KAAAA,KACnCX,iBAAiBW,OAAAA,gBAAOvB,GAExBc,mBAAmBS,OAAO,KAAKN,OAAO;EAG1CM,MAAMC,SAASoC,SAAS;EACxB,OAAO;GAAEV,MAAMI;GAAQH,MAAM,CAAC;EAAE;CACpC;AACJ;;CAvI8B9C,KAAAA,mBAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAsDfA,KAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAmBIA,KAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;CAeDA,QAAAA,IAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;CAkBIA,QAAAA,QAAAA,CAAAA,uBAAAA,CAAAA;;;;;;;;;CAhJR,YAAA,CAAA,aAAa,2BAAA,CAAA"}

package/dist/adapters/http/controllers/index.mjs

@@ -16,8 +16,10 @@ import { IdentityProviderRoleMappingController } from "./entities/identity-provi
 import { KeyController } from "./entities/key/module.mjs";
 import { PermissionController } from "./entities/permission/module.mjs";
 import { PermissionPolicyController } from "./entities/permission-policy/module.mjs";
+import { ConsoleLogin } from "./workflows/console-login/module.mjs";
 import { AccountController } from "./workflows/account/module.mjs";
 import { ActivateController } from "./workflows/activate/module.mjs";
+import { AdminController } from "./workflows/admin/module.mjs";
 import { AuthenticatorChallengeController } from "./workflows/authenticator-challenge/module.mjs";
 import { AuthorizeController } from "./workflows/authorize/module.mjs";
 import { getJwkRouteHandler, getJwksRouteHandler } from "./workflows/jwks/handlers/read.mjs";
@@ -53,4 +55,4 @@ import { UserPermissionRequestValidator } from "./entities/user-permission/utils
 import { UserRoleController } from "./entities/user-role/module.mjs";
 import { UserRoleRequestValidator } from "./entities/user-role/utils/validation.mjs";
 import "./entities/index.mjs";
-export { AccountController, ActivateController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };
+export { AccountController, ActivateController, AdminController, AuthenticatorChallengeController, AuthorizeController, ClientController, ClientPermissionController, ClientPermissionRequestValidator, ClientRoleController, ClientRoleRequestValidator, ClientScopeController, ClientScopeRequestValidator, ConsentController, ConsoleLogin, EventController, IdentityProviderAccountController, IdentityProviderController, IdentityProviderRoleMappingController, JwkController, KeyController, LogoutController, OpenIDController, PasswordForgotController, PasswordResetController, PermissionController, PermissionPolicyController, PolicyAttributesValidator, PolicyController, PolicyValidator, RealmController, RegisterController, RoleAttributeController, RoleAttributeRequestValidator, RoleController, RolePermissionController, RolePermissionRequestValidator, ScopeController, SessionController, SessionTokenController, StatusController, TokenController, TrustAnchorController, UserAttributeController, UserAttributeRequestValidator, UserAuthenticatorController, UserController, UserInfoController, UserPermissionController, UserPermissionRequestValidator, UserRoleController, UserRoleRequestValidator, getJwkRouteHandler, getJwksRouteHandler };

package/dist/adapters/http/controllers/workflows/account/index.d.ts

@@ -1,2 +1,3 @@
 export * from './module.ts';
+export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/http/controllers/workflows/account/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/account/module.d.ts

@@ -1,24 +1,33 @@
-import type { StatusResponseFeatures } from '@authup/core-http-kit';
 import type { IAppEvent } from 'routup';
-export type AccountControllerOptions = {
-    baseURL: string;
-    features: StatusResponseFeatures;
-    trustedOrigins: string[];
-};
-export type AccountControllerContext = {
-    options: AccountControllerOptions;
-};
+import { ConsoleLogin } from '../console-login/index.ts';
+import type { AccountControllerContext, AccountControllerOptions } from './types.ts';
 /**
- * Serves the account console SPA (`@authup/client-account-console`) shell —
- * client-side routing owns the sub-paths, so every route returns the same
- * shell with the runtime config (apiUrl, base path, feature flags) injected.
- * The bundle's static assets ride the assets middleware (/account/assets).
+ * The account console's server half (plan 088): the login kick and the code
+ * redemption, so no OAuth2 token ever reaches the console's JavaScript.
+ *
+ * The console itself is served by `@authup/server-account-console`, which
+ * owns everything else under `/console/account`. These two routes stay here
+ * because they are sessions, keys and cache, and because the pending-login
+ * cookie has to be issued on the origin that reads it back (plan 101
+ * invariant 3). A proxy therefore routes these two exact paths to the API
+ * set and the rest of the console's segment to the console set.
  */
 export declare class AccountController {
     protected options: AccountControllerOptions;
+    protected consoleLogin: ConsoleLogin;
     constructor(ctx: AccountControllerContext);
-    serve(event: IAppEvent): Promise<string>;
-    servePage(event: IAppEvent): Promise<string>;
-    protected render(event: IAppEvent): Promise<string>;
+    /**
+     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+     * The bare `/login` is the console's own page now, served by the console
+     * service, so there is nothing left here to dispatch against.
+     */
+    login(event: IAppEvent): Promise<Response>;
+    callback(event: IAppEvent): Promise<Response>;
+    /**
+     * Disabled means disabled on the server too: the kick must not mint a
+     * pending login and a session for a console nothing is serving. There is
+     * no shell to answer with any more, so the route simply does not exist.
+     */
+    protected assertEnabled(): void;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/account/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAMpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF;;;;;GAKG;AACH,qBACa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,GAAG,EAAE,wBAAwB;IAKnC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpD,SAAS,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9D,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAOtD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;;;;;;GAUG;AACH,qBACa,iBAAiB;IAC1B,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAE5C,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;gBAEzB,GAAG,EAAE,wBAAwB;IAoBzC;;;;OAIG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOtD,QAAQ,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAM/D;;;;OAIG;IACH,SAAS,CAAC,aAAa,IAAI,IAAI;CAKlC"}

package/dist/adapters/http/controllers/workflows/account/module.mjs

@@ -1,8 +1,11 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveAccountConsolePage } from "../../../ui/account-console/module.mjs";
-import "../../../ui/index.mjs";
+import { ACCOUNT_CONSOLE_SEGMENT } from "../../../constants.mjs";
+import { ConsoleLogin } from "../console-login/module.mjs";
+import "../console-login/index.mjs";
+import { CLIENT_ACCOUNT_CONSOLE_NAME } from "@authup/core-kit";
+import { NotFoundError } from "@ebec/http";
 import { DContext, DController, DGet } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/account/module.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -21,39 +24,59 @@ function _ts_param(paramIndex, decorator) {
 }
 var AccountController = class {
 	options;
+	consoleLogin;
 	constructor(ctx) {
 		this.options = ctx.options;
+		this.consoleLogin = new ConsoleLogin({
+			clientName: CLIENT_ACCOUNT_CONSOLE_NAME,
+			segment: ACCOUNT_CONSOLE_SEGMENT,
+			consoleUrl: ctx.options.consoleUrl
+		}, {
+			options: { baseURL: ctx.options.baseURL },
+			loginStore: ctx.loginStore,
+			sessionRepository: ctx.sessionRepository,
+			sessionManager: ctx.sessionManager,
+			tokenVerifier: ctx.tokenVerifier,
+			tokenRevoker: ctx.tokenRevoker,
+			logger: ctx.logger
+		});
 	}
-	async serve(event) {
-		return this.render(event);
+	/**
+	* A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+	* The bare `/login` is the console's own page now, served by the console
+	* service, so there is nothing left here to dispatch against.
+	*/ async login(event) {
+		this.assertEnabled();
+		return this.consoleLogin.login(event);
 	}
-	async servePage(event) {
-		return this.render(event);
+	async callback(event) {
+		this.assertEnabled();
+		return this.consoleLogin.callback(event);
 	}
-	render(event) {
-		return serveAccountConsolePage(event, {
-			baseURL: this.options.baseURL,
-			features: this.options.features,
-			trustedOrigins: this.options.trustedOrigins
-		});
+	/**
+	* Disabled means disabled on the server too: the kick must not mint a
+	* pending login and a session for a console nothing is serving. There is
+	* no shell to answer with any more, so the route simply does not exist.
+	*/ assertEnabled() {
+		if (!this.options.enabled) throw new NotFoundError();
 	}
 };
 _ts_decorate([
-	DGet("", []),
+	DGet("/login/start", []),
 	_ts_param(0, DContext()),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
-], AccountController.prototype, "serve", null);
+], AccountController.prototype, "login", null);
 _ts_decorate([
-	DGet("/:page", []),
+	DGet("/callback", []),
 	_ts_param(0, DContext()),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
 	_ts_metadata("design:returntype", Promise)
-], AccountController.prototype, "servePage", null);
+], AccountController.prototype, "callback", null);
 AccountController = _ts_decorate([
-	DController("/account"),
+	DController(`/${ACCOUNT_CONSOLE_SEGMENT}`),
 	_ts_metadata("design:type", Function),
 	_ts_metadata("design:paramtypes", [typeof AccountControllerContext === "undefined" ? Object : AccountControllerContext])
 ], AccountController);

package/dist/adapters/http/controllers/workflows/account/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DContext","DController","DGet","serveAccountConsolePage","AccountController","options","ctx","serve","event","render","servePage","baseURL","features","trustedOrigins"],"sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { StatusResponseFeatures } from '@authup/core-http-kit';\nimport {\n    DContext,\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { serveAccountConsolePage } from '../../../ui/index.ts';\n\nexport type AccountControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n    trustedOrigins: string[],\n};\n\nexport type AccountControllerContext = {\n    options: AccountControllerOptions,\n};\n\n/**\n * Serves the account console SPA (`@authup/client-account-console`) shell —\n * client-side routing owns the sub-paths, so every route returns the same\n * shell with the runtime config (apiUrl, base path, feature flags) injected.\n * The bundle's static assets ride the assets middleware (/account/assets).\n */\n@DController('/account')\nexport class AccountController {\n    protected options: AccountControllerOptions;\n\n    constructor(ctx: AccountControllerContext) {\n        this.options = ctx.options;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return this.render(event);\n    }\n\n    @DGet('/:page', [])\n    async servePage(@DContext() event: IAppEvent): Promise<string> {\n        return this.render(event);\n    }\n\n    protected render(event: IAppEvent): Promise<string> {\n        return serveAccountConsolePage(event, {\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            trustedOrigins: this.options.trustedOrigins,\n        });\n    }\n}\n"],"mappings":";;;;;;;AAKC,SAAA,aAAA,YAAA,QAAA,KAAA,MAAA;;;;;;;;;;;;;;AA4BD,IAAaI,oBAAb,MAAaA;CACCC;CAEV,YAAYC,KAA+B;EACvC,KAAKD,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAO,KAAKE,OAAOD,KAAAA;CACvB;CAEA,MACME,UAAU,OAA+C;EAC3D,OAAO,KAAKD,OAAOD,KAAAA;CACvB;CAEUC,OAAOD,OAAmC;EAChD,OAAOL,wBAAwBK,OAAO;GAClCG,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,gBAAgB,KAAKR,QAAQQ;EACjC,CAAA;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["CLIENT_ACCOUNT_CONSOLE_NAME","NotFoundError","DContext","DController","DGet","ACCOUNT_CONSOLE_SEGMENT","ConsoleLogin","AccountController","options","consoleLogin","ctx","clientName","segment","consoleUrl","baseURL","loginStore","sessionRepository","sessionManager","tokenVerifier","tokenRevoker","logger","login","event","assertEnabled","callback","enabled"],"sources":["../../../../../../src/adapters/http/controllers/workflows/account/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { CLIENT_ACCOUNT_CONSOLE_NAME } from '@authup/core-kit';\nimport { NotFoundError } from '@ebec/http';\nimport {\n    DContext,\n    DController,\n    DGet,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport { ACCOUNT_CONSOLE_SEGMENT } from '../../../constants.ts';\nimport { ConsoleLogin } from '../console-login/index.ts';\nimport type { AccountControllerContext, AccountControllerOptions } from './types.ts';\n\n/**\n * The account console's server half (plan 088): the login kick and the code\n * redemption, so no OAuth2 token ever reaches the console's JavaScript.\n *\n * The console itself is served by `@authup/server-account-console`, which\n * owns everything else under `/console/account`. These two routes stay here\n * because they are sessions, keys and cache, and because the pending-login\n * cookie has to be issued on the origin that reads it back (plan 101\n * invariant 3). A proxy therefore routes these two exact paths to the API\n * set and the rest of the console's segment to the console set.\n */\n@DController(`/${ACCOUNT_CONSOLE_SEGMENT}`)\nexport class AccountController {\n    protected options: AccountControllerOptions;\n\n    protected consoleLogin: ConsoleLogin;\n\n    constructor(ctx: AccountControllerContext) {\n        this.options = ctx.options;\n        this.consoleLogin = new ConsoleLogin(\n            {\n                clientName: CLIENT_ACCOUNT_CONSOLE_NAME,\n                segment: ACCOUNT_CONSOLE_SEGMENT,\n                consoleUrl: ctx.options.consoleUrl,\n            },\n            {\n                options: { baseURL: ctx.options.baseURL },\n                loginStore: ctx.loginStore,\n                sessionRepository: ctx.sessionRepository,\n                sessionManager: ctx.sessionManager,\n                tokenVerifier: ctx.tokenVerifier,\n                tokenRevoker: ctx.tokenRevoker,\n                logger: ctx.logger,\n            },\n        );\n    }\n\n    /**\n     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).\n     * The bare `/login` is the console's own page now, served by the console\n     * service, so there is nothing left here to dispatch against.\n     */\n    @DGet('/login/start', [])\n    async login(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.login(event);\n    }\n\n    @DGet('/callback', [])\n    async callback(@DContext() event: IAppEvent): Promise<Response> {\n        this.assertEnabled();\n\n        return this.consoleLogin.callback(event);\n    }\n\n    /**\n     * Disabled means disabled on the server too: the kick must not mint a\n     * pending login and a session for a console nothing is serving. There is\n     * no shell to answer with any more, so the route simply does not exist.\n     */\n    protected assertEnabled(): void {\n        if (!this.options.enabled) {\n            throw new NotFoundError();\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAaO,oBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAA+B;EACvC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,eAAe,IAAIH,aACpB;GACIK,YAAYX;GACZY,SAASP;GACTQ,YAAYH,IAAIF,QAAQK;EAC5B,GACA;GACIL,SAAS,EAAEM,SAASJ,IAAIF,QAAQM,QAAQ;GACxCC,YAAYL,IAAIK;GAChBC,mBAAmBN,IAAIM;GACvBC,gBAAgBP,IAAIO;GACpBC,eAAeR,IAAIQ;GACnBC,cAAcT,IAAIS;GAClBC,QAAQV,IAAIU;EAChB,CAAA;CAER;;;;;IAOA,MACMC,MAAM,OAAiD;EACzD,KAAKE,cAAa;EAElB,OAAO,KAAKd,aAAaY,MAAMC,KAAAA;CACnC;CAEA,MACME,SAAS,OAAiD;EAC5D,KAAKD,cAAa;EAElB,OAAO,KAAKd,aAAae,SAASF,KAAAA;CACtC;;;;;IAOA,gBAAgC;EAC5B,IAAI,CAAC,KAAKd,QAAQiB,SACd,MAAM,IAAIxB,cAAAA;CAElB;AACJ;;;;;;;;;;;;;;;;CAvDc,YAAA,IAAGI,yBAAAA"}

package/dist/adapters/http/controllers/workflows/account/types.d.ts

@@ -0,0 +1,33 @@
+import type { Logger } from '@authup/server-kit';
+import type { IConsoleLoginStore, IOAuth2TokenRevoker, IOAuth2TokenVerifier, ISessionManager, ISessionRepository } from '../../../../../core/index.ts';
+export type AccountControllerOptions = {
+    baseURL: string;
+    /**
+     * Where the console this authenticates for is served. The browser lands
+     * there once the credential is issued, and a refusal renders there.
+     */
+    consoleUrl: string;
+    enabled: boolean;
+};
+export type AccountControllerContext = {
+    options: AccountControllerOptions;
+    /**
+     * Holds the PKCE verifier and `state` while the browser is away at
+     * `/authorize` (plan 088).
+     */
+    loginStore: IConsoleLoginStore;
+    /**
+     * Writes and clears the opaque credential on the session row. The session
+     * MANAGER cannot: the column is `select: false` and has a dedicated write.
+     */
+    sessionRepository: ISessionRepository;
+    sessionManager: ISessionManager;
+    /**
+     * Reads the exchanged access token (session, subject) and the refresh
+     * token, so both can be revoked before either leaves the process.
+     */
+    tokenVerifier: IOAuth2TokenVerifier;
+    tokenRevoker: IOAuth2TokenRevoker;
+    logger?: Logger;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/adapters/http/controllers/workflows/account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/account/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EACR,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EACrB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,wBAAwB,CAAC;IAClC;;;OAGG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAC;IAChC;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,mBAAmB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/adapters/http/controllers/workflows/activate/module.d.ts

@@ -1,9 +1,8 @@
 import type { IAppEvent } from 'routup';
-import type { ActivatePayload, StatusResponseFeatures } from '@authup/core-http-kit';
+import type { ActivatePayload } from '@authup/core-http-kit';
 import type { IRegistrationService } from '../../../../../core/index.ts';
 export type ActivateControllerOptions = {
-    baseURL: string;
-    features: StatusResponseFeatures;
+    authConsoleUrl: string;
 };
 export type ActivateControllerContext = {
     options: ActivateControllerOptions;
@@ -13,7 +12,12 @@ export declare class ActivateController {
     protected options: ActivateControllerOptions;
     protected service: IRegistrationService;
     constructor(ctx: ActivateControllerContext);
-    serve(event: IAppEvent): Promise<string>;
+    /**
+     * The page renders in the auth console service; this hop carries the
+     * request's own parameters over to it. The POST below stays here:
+     * server-core keeps the protocol, the service keeps the render.
+     */
+    serve(event: IAppEvent): Promise<Response>;
     execute(data: ActivatePayload, event: IAppEvent): Promise<null>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/activate/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBACa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,yBAAyB;IAMpC,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAUpD,OAAO,CACA,IAAI,EAAE,eAAe,EAClB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CASnB"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GAAG;IACpC,cAAc,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,EAAE,oBAAoB,CAAC;CACjC,CAAC;AAEF,qBACa,kBAAkB;IAC3B,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAE7C,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE5B,GAAG,EAAE,yBAAyB;IAK1C;;;;OAIG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKtD,OAAO,CACA,IAAI,EAAE,eAAe,EAClB,KAAK,EAAE,SAAS,GAC7B,OAAO,CAAC,IAAI,CAAC;CASnB"}

package/dist/adapters/http/controllers/workflows/activate/module.mjs

@@ -1,8 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { serveWorkflowPage } from "../../../ui/auth-console/serve.mjs";
-import "../../../ui/index.mjs";
+import { redirectToAuthConsole } from "../auth-console.mjs";
 import { ActivateRequestValidator } from "./validator.mjs";
 import { DBody, DContext, DController, DGet, DPost } from "@routup/decorators";
 //#region src/adapters/http/controllers/workflows/activate/module.ts
@@ -27,13 +26,12 @@ var ActivateController = class {
 		this.options = ctx.options;
 		this.service = ctx.service;
 	}
-	async serve(event) {
-		return serveWorkflowPage(event, {
-			url: "/activate",
-			baseURL: this.options.baseURL,
-			features: this.options.features,
-			tokenAware: true
-		});
+	/**
+	* The page renders in the auth console service; this hop carries the
+	* request's own parameters over to it. The POST below stays here:
+	* server-core keeps the protocol, the service keeps the render.
+	*/ async serve(event) {
+		return redirectToAuthConsole(event, this.options.authConsoleUrl, "/activate");
 	}
 	async execute(data, event) {
 		const validated = await new ActivateRequestValidator().run(data);

package/dist/adapters/http/controllers/workflows/activate/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","serveWorkflowPage","ActivateRequestValidator","ActivateController","options","service","ctx","serve","event","url","baseURL","features","tokenAware","execute","data","validator","validated","run","activate","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { ActivatePayload, StatusResponseFeatures } from '@authup/core-http-kit';\nimport type { IRegistrationService } from '../../../../../core/index.ts';\nimport { serveWorkflowPage } from '../../../ui/index.ts';\nimport { ActivateRequestValidator } from './validator.ts';\n\nexport type ActivateControllerOptions = {\n    baseURL: string,\n    features: StatusResponseFeatures,\n};\n\nexport type ActivateControllerContext = {\n    options: ActivateControllerOptions,\n    service: IRegistrationService,\n};\n\n@DController('/activate')\nexport class ActivateController {\n    protected options: ActivateControllerOptions;\n\n    protected service: IRegistrationService;\n\n    constructor(ctx: ActivateControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<string> {\n        return serveWorkflowPage(event, {\n            url: '/activate',\n            baseURL: this.options.baseURL,\n            features: this.options.features,\n            tokenAware: true,\n        });\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: ActivatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        const validator = new ActivateRequestValidator();\n        const validated = await validator.run(data);\n\n        await this.service.activate(validated);\n\n        event.response.status = 202;\n        return null;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAaO,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;CAEA,MACME,MAAM,OAA+C;EACvD,OAAON,kBAAkBO,OAAO;GAC5BC,KAAK;GACLC,SAAS,KAAKN,QAAQM;GACtBC,UAAU,KAAKP,QAAQO;GACvBC,YAAY;EAChB,CAAA;CACJ;CAEA,MACMC,QACF,MACA,OACa;EAEb,MAAMG,YAAY,MAAMD,IADFb,yBACEa,CAAAA,CAAUE,IAAIH,IAAAA;EAEtC,MAAM,KAAKT,QAAQa,SAASF,SAAAA;EAE5BR,MAAMW,SAASC,SAAS;EACxB,OAAO;CACX;AACJ"}
+{"version":3,"file":"module.mjs","names":["DBody","DContext","DController","DGet","DPost","redirectToAuthConsole","ActivateRequestValidator","ActivateController","options","service","ctx","serve","event","authConsoleUrl","execute","data","validator","validated","run","activate","response","status"],"sources":["../../../../../../src/adapters/http/controllers/workflows/activate/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    DBody,\n    DContext,\n    DController,\n    DGet,\n    DPost,\n} from '@routup/decorators';\nimport type { IAppEvent } from 'routup';\nimport type { ActivatePayload } from '@authup/core-http-kit';\nimport type { IRegistrationService } from '../../../../../core/index.ts';\nimport { redirectToAuthConsole } from '../auth-console.ts';\nimport { ActivateRequestValidator } from './validator.ts';\n\nexport type ActivateControllerOptions = {\n    authConsoleUrl: string,\n};\n\nexport type ActivateControllerContext = {\n    options: ActivateControllerOptions,\n    service: IRegistrationService,\n};\n\n@DController('/activate')\nexport class ActivateController {\n    protected options: ActivateControllerOptions;\n\n    protected service: IRegistrationService;\n\n    constructor(ctx: ActivateControllerContext) {\n        this.options = ctx.options;\n        this.service = ctx.service;\n    }\n\n    /**\n     * The page renders in the auth console service; this hop carries the\n     * request's own parameters over to it. The POST below stays here:\n     * server-core keeps the protocol, the service keeps the render.\n     */\n    @DGet('', [])\n    async serve(@DContext() event: IAppEvent): Promise<Response> {\n        return redirectToAuthConsole(event, this.options.authConsoleUrl, '/activate');\n    }\n\n    @DPost('', [])\n    async execute(\n        @DBody() data: ActivatePayload,\n        @DContext() event: IAppEvent,\n    ): Promise<null> {\n        const validator = new ActivateRequestValidator();\n        const validated = await validator.run(data);\n\n        await this.service.activate(validated);\n\n        event.response.status = 202;\n        return null;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA8BA,IAAaO,qBAAb,MAAaA;CACCC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,UAAUC,IAAID;CACvB;;;;;IAOA,MACME,MAAM,OAAiD;EACzD,OAAON,sBAAsBO,OAAO,KAAKJ,QAAQK,gBAAgB,WAAA;CACrE;CAEA,MACMC,QACF,MACA,OACa;EAEb,MAAMG,YAAY,MAAMD,IADFV,yBACEU,CAAAA,CAAUE,IAAIH,IAAAA;EAEtC,MAAM,KAAKN,QAAQU,SAASF,SAAAA;EAE5BL,MAAMQ,SAASC,SAAS;EACxB,OAAO;CACX;AACJ"}

package/dist/adapters/http/controllers/workflows/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/admin/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/adapters/http/controllers/workflows/admin/index.mjs

@@ -0,0 +1,5 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { AdminController } from "./module.mjs";
+export { AdminController };

package/dist/adapters/http/controllers/workflows/admin/module.d.ts

@@ -0,0 +1,30 @@
+import type { IAppEvent } from 'routup';
+import { ConsoleLogin } from '../console-login/index.ts';
+import type { AdminControllerContext, AdminControllerOptions } from './types.ts';
+/**
+ * The admin console's server half (plan 088): the login kick and the code
+ * redemption, bound to the per-realm `admin-console` client.
+ *
+ * The console itself is served by `@authup/server-admin-console`. See
+ * {@link AccountController} for why these two routes stay on the API.
+ */
+export declare class AdminController {
+    protected options: AdminControllerOptions;
+    protected consoleLogin: ConsoleLogin;
+    constructor(ctx: AdminControllerContext);
+    /**
+     * A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+     * One URL used to mean two things: with a realm the server-side kick,
+     * without one the console's own login PAGE. The page is served by the
+     * console service now, so the kick can no longer fall back to it and the
+     * split became required rather than optional.
+     */
+    login(event: IAppEvent): Promise<Response>;
+    callback(event: IAppEvent): Promise<Response>;
+    /**
+     * Disabled means disabled on the server too: the kick must not mint a
+     * pending login and a session for a console nothing is serving.
+     */
+    protected assertEnabled(): void;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/adapters/http/controllers/workflows/admin/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../../../src/adapters/http/controllers/workflows/admin/module.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEjF;;;;;;GAMG;AACH,qBACa,eAAe;IACxB,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAE1C,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;gBAEzB,GAAG,EAAE,sBAAsB;IAwBvC;;;;;;OAMG;IAEG,KAAK,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAOtD,QAAQ,CAAa,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAM/D;;;OAGG;IACH,SAAS,CAAC,aAAa,IAAI,IAAI;CAKlC"}

package/dist/adapters/http/controllers/workflows/admin/module.mjs

@@ -0,0 +1,88 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { ADMIN_CONSOLE_SEGMENT } from "../../../constants.mjs";
+import { ConsoleLogin } from "../console-login/module.mjs";
+import "../console-login/index.mjs";
+import { CLIENT_ADMIN_CONSOLE_NAME } from "@authup/core-kit";
+import { NotFoundError } from "@ebec/http";
+import { DContext, DController, DGet } from "@routup/decorators";
+//#region src/adapters/http/controllers/workflows/admin/module.ts
+function _ts_decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(metadataKey, metadataValue);
+}
+function _ts_param(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+var AdminController = class {
+	options;
+	consoleLogin;
+	constructor(ctx) {
+		this.options = ctx.options;
+		this.consoleLogin = new ConsoleLogin({
+			clientName: CLIENT_ADMIN_CONSOLE_NAME,
+			segment: ADMIN_CONSOLE_SEGMENT,
+			consoleUrl: ctx.options.consoleUrl,
+			refusalPath: "login"
+		}, {
+			options: { baseURL: ctx.options.baseURL },
+			loginStore: ctx.loginStore,
+			sessionRepository: ctx.sessionRepository,
+			sessionManager: ctx.sessionManager,
+			tokenVerifier: ctx.tokenVerifier,
+			tokenRevoker: ctx.tokenRevoker,
+			logger: ctx.logger
+		});
+	}
+	/**
+	* A path of its own rather than a `realmId`-carrying `/login` (098 C1).
+	* One URL used to mean two things: with a realm the server-side kick,
+	* without one the console's own login PAGE. The page is served by the
+	* console service now, so the kick can no longer fall back to it and the
+	* split became required rather than optional.
+	*/ async login(event) {
+		this.assertEnabled();
+		return this.consoleLogin.login(event);
+	}
+	async callback(event) {
+		this.assertEnabled();
+		return this.consoleLogin.callback(event);
+	}
+	/**
+	* Disabled means disabled on the server too: the kick must not mint a
+	* pending login and a session for a console nothing is serving.
+	*/ assertEnabled() {
+		if (!this.options.enabled) throw new NotFoundError();
+	}
+};
+_ts_decorate([
+	DGet("/login/start", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AdminController.prototype, "login", null);
+_ts_decorate([
+	DGet("/callback", []),
+	_ts_param(0, DContext()),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof IAppEvent === "undefined" ? Object : IAppEvent]),
+	_ts_metadata("design:returntype", Promise)
+], AdminController.prototype, "callback", null);
+AdminController = _ts_decorate([
+	DController(`/${ADMIN_CONSOLE_SEGMENT}`),
+	_ts_metadata("design:type", Function),
+	_ts_metadata("design:paramtypes", [typeof AdminControllerContext === "undefined" ? Object : AdminControllerContext])
+], AdminController);
+//#endregion
+export { AdminController };
+
+//# sourceMappingURL=module.mjs.map