@eventcatalog/core 4.12.0 → 4.12.1

package/dist/analytics/analytics.cjs

@@ -36,7 +36,7 @@ module.exports = __toCommonJS(analytics_exports);
 var import_os = __toESM(require("os"), 1);
 
 // package.json
-var version = "4.12.0";
+var version = "4.12.1";
 
 // src/constants.ts
 var VERSION = version;

package/dist/analytics/analytics.js

@@ -1,7 +1,7 @@
 import {
   raiseEvent
-} from "../chunk-SQXIGSIJ.js";
-import "../chunk-MZ5QBEFA.js";
+} from "../chunk-HH6GPY4H.js";
+import "../chunk-HHZFKWX7.js";
 export {
   raiseEvent
 };

package/dist/analytics/log-build.cjs

@@ -176,7 +176,7 @@ var verifyRequiredFieldsAreInCatalogConfigFile = async (projectDirectory) => {
 var import_os = __toESM(require("os"), 1);
 
 // package.json
-var version = "4.12.0";
+var version = "4.12.1";
 
 // src/constants.ts
 var VERSION = version;

package/dist/analytics/log-build.js

@@ -1,9 +1,9 @@
 import {
   log_build_default
-} from "../chunk-UC3HZHW4.js";
+} from "../chunk-UWSBZYF5.js";
+import "../chunk-HH6GPY4H.js";
 import "../chunk-ZAZHAVKB.js";
-import "../chunk-SQXIGSIJ.js";
-import "../chunk-MZ5QBEFA.js";
+import "../chunk-HHZFKWX7.js";
 import "../chunk-RFIXKATC.js";
 export {
   log_build_default as default

package/dist/{chunk-Q46W7LGT.js → chunk-DZZDBFUM.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-MZ5QBEFA.js";
+} from "./chunk-HHZFKWX7.js";
 
 // src/utils/cli-logger.ts
 import pc from "picocolors";

package/dist/{chunk-DWTU2R2Z.js → chunk-EVXNBTRA.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-Q46W7LGT.js";
+} from "./chunk-DZZDBFUM.js";
 import {
   cleanup,
   getEventCatalogConfigFile

package/dist/{chunk-SQXIGSIJ.js → chunk-HH6GPY4H.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-MZ5QBEFA.js";
+} from "./chunk-HHZFKWX7.js";
 
 // src/analytics/analytics.js
 import os from "os";

package/dist/{chunk-MZ5QBEFA.js → chunk-HHZFKWX7.js}

@@ -1,5 +1,5 @@
 // package.json
-var version = "4.12.0";
+var version = "4.12.1";
 
 // src/constants.ts
 var VERSION = version;

package/dist/{chunk-UC3HZHW4.js → chunk-UWSBZYF5.js}

@@ -1,11 +1,11 @@
+import {
+  raiseEvent
+} from "./chunk-HH6GPY4H.js";
 import {
   countResources,
   hashCatalogContent,
   serializeCounts
 } from "./chunk-ZAZHAVKB.js";
-import {
-  raiseEvent
-} from "./chunk-SQXIGSIJ.js";
 import {
   getEventCatalogConfigFile,
   verifyRequiredFieldsAreInCatalogConfigFile

package/dist/constants.cjs

@@ -25,7 +25,7 @@ __export(constants_exports, {
 module.exports = __toCommonJS(constants_exports);
 
 // package.json
-var version = "4.12.0";
+var version = "4.12.1";
 
 // src/constants.ts
 var VERSION = version;

package/dist/constants.js

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-MZ5QBEFA.js";
+} from "./chunk-HHZFKWX7.js";
 export {
   VERSION
 };

package/dist/eventcatalog.cjs

@@ -181,7 +181,7 @@ var verifyRequiredFieldsAreInCatalogConfigFile = async (projectDirectory) => {
 var import_picocolors = __toESM(require("picocolors"), 1);
 
 // package.json
-var version = "4.12.0";
+var version = "4.12.1";
 
 // src/constants.ts
 var VERSION = version;

package/dist/eventcatalog.js

@@ -1,25 +1,25 @@
+import {
+  log_build_default
+} from "./chunk-UWSBZYF5.js";
+import "./chunk-HH6GPY4H.js";
+import "./chunk-ZAZHAVKB.js";
 import {
   runMigrations
 } from "./chunk-XUAF2H54.js";
 import "./chunk-CA4U2JP7.js";
-import {
-  log_build_default
-} from "./chunk-UC3HZHW4.js";
-import "./chunk-ZAZHAVKB.js";
 import {
   FederationConflictError,
   FederationDiagnosticError,
   federateCatalog
-} from "./chunk-U4YJSTGV.js";
-import "./chunk-WRNH5C3U.js";
-import "./chunk-5EPNFDT5.js";
-import "./chunk-A2RZR3U4.js";
-import "./chunk-R7Z5ALYI.js";
+} from "./chunk-WRLNLWPW.js";
 import {
   getFederationDiagnosticCounts,
   getVisibleFederationDiagnostics
 } from "./chunk-JJPB6EOZ.js";
 import "./chunk-FV56YFM4.js";
+import "./chunk-WRNH5C3U.js";
+import "./chunk-5EPNFDT5.js";
+import "./chunk-A2RZR3U4.js";
 import "./chunk-SDZQJTJW.js";
 import "./chunk-352FGP6W.js";
 import {
@@ -30,10 +30,10 @@ import {
 } from "./chunk-MDWB5HLO.js";
 import {
   generate
-} from "./chunk-DWTU2R2Z.js";
+} from "./chunk-EVXNBTRA.js";
 import {
   logger
-} from "./chunk-Q46W7LGT.js";
+} from "./chunk-DZZDBFUM.js";
 import {
   resolve_catalog_dependencies_default
 } from "./chunk-36RYTYT5.js";
@@ -47,7 +47,7 @@ import {
 import {
   watch
 } from "./chunk-U63GDPPY.js";
-import "./chunk-SQXIGSIJ.js";
+import "./chunk-R7Z5ALYI.js";
 import {
   getAstroConfigPath
 } from "./chunk-VIJJ7JKH.js";
@@ -63,7 +63,7 @@ import {
 } from "./chunk-LFQJXLHG.js";
 import {
   VERSION
-} from "./chunk-MZ5QBEFA.js";
+} from "./chunk-HHZFKWX7.js";
 import {
   getEventCatalogConfigFile,
   verifyRequiredFieldsAreInCatalogConfigFile

package/dist/federation/federate.js

@@ -2,15 +2,15 @@ import {
   FederationConflictError,
   FederationDiagnosticError,
   federateCatalog
-} from "../chunk-U4YJSTGV.js";
+} from "../chunk-WRLNLWPW.js";
+import "../chunk-JJPB6EOZ.js";
+import "../chunk-FV56YFM4.js";
 import "../chunk-WRNH5C3U.js";
 import "../chunk-5EPNFDT5.js";
 import "../chunk-A2RZR3U4.js";
-import "../chunk-R7Z5ALYI.js";
-import "../chunk-JJPB6EOZ.js";
-import "../chunk-FV56YFM4.js";
 import "../chunk-SDZQJTJW.js";
 import "../chunk-352FGP6W.js";
+import "../chunk-R7Z5ALYI.js";
 import "../chunk-RFIXKATC.js";
 export {
   FederationConflictError,

package/dist/generate.cjs

@@ -112,7 +112,7 @@ var getEventCatalogConfigFile = async (projectDirectory) => {
 var import_picocolors = __toESM(require("picocolors"), 1);
 
 // package.json
-var version = "4.12.0";
+var version = "4.12.1";
 
 // src/constants.ts
 var VERSION = version;

package/dist/generate.js

@@ -1,8 +1,8 @@
 import {
   generate
-} from "./chunk-DWTU2R2Z.js";
-import "./chunk-Q46W7LGT.js";
-import "./chunk-MZ5QBEFA.js";
+} from "./chunk-EVXNBTRA.js";
+import "./chunk-DZZDBFUM.js";
+import "./chunk-HHZFKWX7.js";
 import "./chunk-RFIXKATC.js";
 export {
   generate

package/dist/runtime-dependencies/manifest.json

@@ -65,9 +65,6 @@
   "astro/logger/node": "astro__logger__node.mjs",
   "astro/types": "astro__types.mjs",
   "astro/zod": "astro__zod.mjs",
-  "auth-astro": "auth-astro.mjs",
-  "auth-astro/client": "auth-astro__client.mjs",
-  "auth-astro/server": "auth-astro__server.mjs",
   "boxen": "boxen.mjs",
   "commander": "commander.mjs",
   "cross-env": "cross-env.mjs",
@@ -123,6 +120,7 @@
   "remark-gfm": "remark-gfm.mjs",
   "rimraf": "rimraf.mjs",
   "semver": "semver.mjs",
+  "set-cookie-parser": "set-cookie-parser.mjs",
   "shelljs": "shelljs.mjs",
   "sonner": "sonner.mjs",
   "sql.js": "sql.js.mjs",

package/dist/runtime-dependencies/set-cookie-parser.mjs

@@ -0,0 +1,3 @@
+export * from "set-cookie-parser";
+import * as dependency from "set-cookie-parser";
+export default dependency.default;

package/dist/utils/cli-logger.cjs

@@ -36,7 +36,7 @@ module.exports = __toCommonJS(cli_logger_exports);
 var import_picocolors = __toESM(require("picocolors"), 1);
 
 // package.json
-var version = "4.12.0";
+var version = "4.12.1";
 
 // src/constants.ts
 var VERSION = version;

package/dist/utils/cli-logger.js

@@ -1,7 +1,7 @@
 import {
   logger
-} from "../chunk-Q46W7LGT.js";
-import "../chunk-MZ5QBEFA.js";
+} from "../chunk-DZZDBFUM.js";
+import "../chunk-HHZFKWX7.js";
 export {
   logger
 };

package/eventcatalog/auth.config.ts

@@ -1,4 +1,4 @@
-import { defineConfig } from 'auth-astro';
+import { defineConfig } from '@utils/auth-astro/config';
 import { join } from 'node:path';
 import GitHub from '@auth/core/providers/github';
 import Okta from '@auth/core/providers/okta';
@@ -22,9 +22,8 @@ const getAuthProviders = async () => {
     // GitHub provider
     if (authConfig.providers?.github) {
       const githubConfig = authConfig.providers.github;
-      // GitHub sends an RFC 9207 `iss` parameter on OAuth callbacks. Pin the issuer so
-      // validation works even when the resolved @auth/core copy predates the upstream
-      // default (auth-astro's peer range can hoist an older @auth/core in user projects).
+      // GitHub sends an RFC 9207 `iss` parameter on OAuth callbacks. Pin the issuer,
+      // including for GitHub Enterprise base URLs, so validation works.
       const githubBaseUrl = githubConfig?.enterprise?.baseUrl ?? 'https://github.com';
       providers.push(
         GitHub({

package/eventcatalog/src/components/Header.astro

@@ -8,7 +8,7 @@ import {
   isEventCatalogChatVisible,
   isEventCatalogChatEnabled,
 } from '@utils/feature';
-import { getSession } from 'auth-astro/server';
+import { getSession } from '@utils/auth-astro/server';
 import { isAuthEnabled, isSSR } from '@utils/feature';
 import { EnvironmentDropdown } from './EnvironmentDropdown';
 import ChatPanelButton from './ChatPanel/ChatPanelButton';
@@ -28,6 +28,27 @@ const logo = {
 };
 
 const repositoryUrl = catalog?.repositoryUrl || 'https://github.com/event-catalog/eventcatalog';
+
+const user = session?.user as { name?: string; email?: string; image?: string; provider?: string } | undefined;
+const userName = user?.name || user?.email || 'User';
+const userInitials =
+  userName
+    .split(/[\s@.]+/)
+    .filter(Boolean)
+    .map((part) => part[0])
+    .join('')
+    .substring(0, 2)
+    .toUpperCase() || 'U';
+// Google avatar URLs are blocked by some browsers' tracking protection, so fall back to initials
+const userImage = user?.image && !user.image.includes('googleusercontent.com') ? user.image : undefined;
+const providerNames: Record<string, string> = {
+  github: 'GitHub',
+  google: 'Google',
+  okta: 'Okta',
+  auth0: 'Auth0',
+  'microsoft-entra-id': 'Microsoft Entra ID',
+};
+const providerName = user?.provider ? providerNames[user.provider] || user.provider : undefined;
 ---
 
 <nav
@@ -58,46 +79,90 @@ const repositoryUrl = catalog?.repositoryUrl || 'https://github.com/event-catalo
                 <button
                   id="profile-menu-button"
                   type="button"
-                  class="flex items-center focus:outline-hidden focus:ring-2 focus:ring-offset-2 focus:ring-gray-400 rounded-full"
+                  class="group flex items-center gap-1 rounded-full p-0.5 pr-1.5 text-[rgb(var(--ec-icon-color))] hover:text-[rgb(var(--ec-icon-hover))] hover:bg-[rgb(var(--ec-dropdown-hover))] aria-expanded:bg-[rgb(var(--ec-dropdown-hover))] transition-colors focus:outline-hidden focus-visible:ring-2 focus-visible:ring-[rgb(var(--ec-accent))]"
                   aria-expanded="false"
-                  aria-haspopup="true"
-                  aria-label="User menu"
+                  aria-haspopup="menu"
+                  aria-controls="profile-dropdown"
+                  aria-label={`Account menu for ${userName}`}
                 >
-                  {session.user?.image && !session.user?.image?.includes('googleusercontent.com') ? (
+                  {userImage ? (
                     <img
-                      src={session.user.image}
-                      alt={session.user?.name || 'User'}
-                      class="h-9 w-9 rounded-full border-2 border-gray-200 hover:border-gray-400 transition-all shadow-xs"
+                      src={userImage}
+                      alt=""
+                      class="h-8 w-8 rounded-full object-cover ring-1 ring-[rgb(var(--ec-page-border))]"
                     />
                   ) : (
-                    <div class="h-9 w-9 rounded-full border-2 border-gray-200 hover:border-gray-400 transition-all bg-gray-100 hover:bg-gray-200 flex items-center justify-center text-sm font-medium text-gray-600 shadow-xs">
-                      {session.user?.name
-                        ? session.user.name
-                            .split(' ')
-                            .map((n) => n[0])
-                            .join('')
-                            .substring(0, 2)
-                            .toUpperCase()
-                        : 'U'}
-                    </div>
+                    <span class="h-8 w-8 rounded-full bg-[rgb(var(--ec-accent-subtle))] text-[rgb(var(--ec-accent))] ring-1 ring-[rgb(var(--ec-page-border))] flex items-center justify-center text-xs font-semibold">
+                      {userInitials}
+                    </span>
                   )}
+                  <svg
+                    viewBox="0 0 24 24"
+                    class="h-4 w-4 transition-transform group-aria-expanded:rotate-180"
+                    fill="none"
+                    stroke="currentColor"
+                    stroke-width="2"
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                    aria-hidden="true"
+                  >
+                    <path d="m6 9 6 6 6-6" />
+                  </svg>
                 </button>
                 <div
                   id="profile-dropdown"
-                  class="ec-hidden absolute right-0 mt-2 w-48 bg-[rgb(var(--ec-dropdown-bg))] rounded-lg shadow-md py-1 z-50 border-2 border-[rgb(var(--ec-dropdown-border))] overflow-hidden"
+                  role="menu"
+                  aria-labelledby="profile-menu-button"
+                  class="ec-hidden absolute right-0 mt-2 w-64 bg-[rgb(var(--ec-dropdown-bg))] rounded-xl shadow-lg z-50 border border-[rgb(var(--ec-dropdown-border))] overflow-hidden"
                 >
-                  <div class="px-4 py-2 text-sm text-[rgb(var(--ec-dropdown-text))] border-b border-[rgb(var(--ec-dropdown-border))]">
-                    <div class="font-semibold">{session.user?.name || 'User'}</div>
-                    {session.user?.email && (
-                      <div class="text-[rgb(var(--ec-icon-color))] text-xs mt-0.5">{session.user.email}</div>
+                  <div class="flex items-center gap-3 px-4 py-3 border-b border-[rgb(var(--ec-dropdown-border))]">
+                    {userImage ? (
+                      <img
+                        src={userImage}
+                        alt=""
+                        class="h-10 w-10 shrink-0 rounded-full object-cover ring-1 ring-[rgb(var(--ec-page-border))]"
+                      />
+                    ) : (
+                      <span class="h-10 w-10 shrink-0 rounded-full bg-[rgb(var(--ec-accent-subtle))] text-[rgb(var(--ec-accent))] flex items-center justify-center text-sm font-semibold">
+                        {userInitials}
+                      </span>
                     )}
+                    <div class="min-w-0">
+                      <div class="truncate text-sm font-semibold text-[rgb(var(--ec-dropdown-text))]">{userName}</div>
+                      {user?.email && user.email !== userName && (
+                        <div class="truncate text-xs font-normal text-[rgb(var(--ec-page-text-muted))]">{user.email}</div>
+                      )}
+                      {providerName && (
+                        <div class="truncate text-xs font-normal text-[rgb(var(--ec-page-text-muted))]">
+                          Signed in with {providerName}
+                        </div>
+                      )}
+                    </div>
+                  </div>
+                  <div class="p-1">
+                    <button
+                      id="signout-btn"
+                      type="button"
+                      role="menuitem"
+                      class="flex w-full items-center gap-2 rounded-lg px-3 py-2 text-left text-sm font-medium text-[rgb(var(--ec-dropdown-text))] hover:bg-[rgb(var(--ec-dropdown-hover))] focus:outline-hidden focus-visible:bg-[rgb(var(--ec-dropdown-hover))] transition-colors"
+                    >
+                      <svg
+                        viewBox="0 0 24 24"
+                        class="h-4 w-4 text-[rgb(var(--ec-icon-color))]"
+                        fill="none"
+                        stroke="currentColor"
+                        stroke-width="2"
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        aria-hidden="true"
+                      >
+                        <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
+                        <polyline points="16 17 21 12 16 7" />
+                        <line x1="21" x2="9" y1="12" y2="12" />
+                      </svg>
+                      Sign out
+                    </button>
                   </div>
-                  <button
-                    id="signout-btn"
-                    class="block w-full text-left px-4 py-2 text-sm text-[rgb(var(--ec-dropdown-text))] hover:bg-[rgb(var(--ec-dropdown-hover))] transition-colors font-medium"
-                  >
-                    Sign out
-                  </button>
                 </div>
               </div>
             </div>
@@ -210,9 +275,15 @@ const repositoryUrl = catalog?.repositoryUrl || 'https://github.com/event-catalo
 <!-- Spacer to prevent content from being hidden under the fixed header -->
 
 <script>
-  import { signOut } from 'auth-astro/client';
+  import { signOut } from '@utils/auth-astro/client';
 
   function initializeHeader() {
+    // ClientRouter fires astro:page-load on the first load too, and the header persists across
+    // navigations. Bind once per element so clicks don't toggle the menus open and shut again.
+    const header = document.getElementById('eventcatalog-header');
+    if (!header || header.dataset.initialized === 'true') return;
+    header.dataset.initialized = 'true';
+
     const menuToggle = document.getElementById('menu-toggle');
     const mobileMenu = document.getElementById('mobile-menu');
 
@@ -261,10 +332,7 @@ const repositoryUrl = catalog?.repositoryUrl || 'https://github.com/event-catalo
     }
   }
 
-  // Initialize on first load
   initializeHeader();
-
-  // Re-initialize after Astro view transitions (needed because of transition:persist on header)
   document.addEventListener('astro:page-load', initializeHeader);
 </script>
 

package/eventcatalog/src/enterprise/auth/[...auth].ts

@@ -3,6 +3,6 @@
  * See /packages/core/eventcatalog/src/enterprise/LICENSE
  */
 
-import { AstroAuth } from 'auth-astro/server';
+import { AstroAuth } from '@utils/auth-astro/server';
 export const prerender = false;
 export const { GET, POST } = AstroAuth();

package/eventcatalog/src/enterprise/auth/login.astro

@@ -5,7 +5,7 @@ const { title, logo } = config;
 import { join } from 'node:path';
 import { isAuthEnabled, isSSR } from '@utils/feature';
 import { buildUrl } from '@utils/url-builder';
-import { getSession } from 'auth-astro/server';
+import { getSession } from '@utils/auth-astro/server';
 
 const catalogDirectory = process.env.PROJECT_DIR || process.cwd();
 
@@ -408,7 +408,7 @@ const providerConfig = {
 </html>
 
 <script>
-  import { signIn } from 'auth-astro/client';
+  import { signIn } from '@utils/auth-astro/client';
 
   // Add event listeners to all provider login buttons
   const providerButtons = document.querySelectorAll('.provider-login-btn');

package/eventcatalog/src/enterprise/auth/middleware/middleware-auth.ts

@@ -5,7 +5,7 @@
 
 // src/middleware/auth.ts
 import type { MiddlewareHandler } from 'astro';
-import { getSession } from 'auth-astro/server';
+import { getSession } from '@utils/auth-astro/server';
 import { isAuthEnabled, isEventCatalogMCPAuthEnabled } from '@utils/feature';
 import jwt from 'jsonwebtoken';
 import { isLLMSTxtEnabled } from '@utils/feature';

package/eventcatalog/src/utils/auth-astro/client.ts

@@ -0,0 +1,89 @@
+/**
+ * Adapted from auth-astro 4.2.0 (MIT, https://github.com/nowaythatworked/auth-astro).
+ * See ./config.ts for why this lives in Core.
+ */
+
+interface AstroSignInOptions extends Record<string, unknown> {
+  /** Where to send the user after signing in. Defaults to the current page. */
+  callbackUrl?: string;
+  /** Redirect after signing in. Defaults to `true`. */
+  redirect?: boolean;
+  /** Base path for authentication. Defaults to `/api/auth`. */
+  prefix?: string;
+}
+
+interface AstroSignOutParams {
+  /** Where to send the user after signing out. Defaults to the current page. */
+  callbackUrl?: string;
+  /** Base path for authentication. Defaults to `/api/auth`. */
+  prefix?: string;
+}
+
+/**
+ * Starts a sign-in flow for a provider. Adds the CSRF token to the request.
+ */
+export async function signIn(providerId?: string, options?: AstroSignInOptions, authorizationParams?: Record<string, string>) {
+  const { callbackUrl = window.location.href, redirect = true } = options ?? {};
+  const { prefix = '/api/auth', ...opts } = options ?? {};
+
+  const isCredentials = providerId === 'credentials';
+  const isEmail = providerId === 'email';
+  const isSupportingReturn = isCredentials || isEmail;
+
+  const signInUrl = `${prefix}/${isCredentials ? 'callback' : 'signin'}/${providerId}`;
+  const _signInUrl = `${signInUrl}?${new URLSearchParams(authorizationParams)}`;
+
+  const csrfTokenResponse = await fetch(`${prefix}/csrf`);
+  const { csrfToken } = await csrfTokenResponse.json();
+
+  const res = await fetch(_signInUrl, {
+    method: 'post',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      'X-Auth-Return-Redirect': '1',
+    },
+    body: new URLSearchParams({
+      ...(opts as Record<string, string>),
+      csrfToken,
+      callbackUrl,
+    }),
+  });
+
+  const data = await res.clone().json();
+  const error = new URL(data.url).searchParams.get('error');
+
+  if (redirect || !isSupportingReturn || !error) {
+    window.location.href = data.url ?? callbackUrl;
+    // The browser does not reload when only the hash changes
+    if (data.url.includes('#')) window.location.reload();
+    return;
+  }
+
+  return res;
+}
+
+/**
+ * Signs the user out by removing the session cookie. Adds the CSRF token to the request.
+ */
+export async function signOut(options?: AstroSignOutParams) {
+  const { callbackUrl = window.location.href, prefix = '/api/auth' } = options ?? {};
+  const csrfTokenResponse = await fetch(`${prefix}/csrf`);
+  const { csrfToken } = await csrfTokenResponse.json();
+  const res = await fetch(`${prefix}/signout`, {
+    method: 'post',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      'X-Auth-Return-Redirect': '1',
+    },
+    body: new URLSearchParams({
+      csrfToken,
+      callbackUrl,
+    }),
+  });
+  const data = await res.json();
+
+  const url = data.url ?? callbackUrl;
+  window.location.href = url;
+  // The browser does not reload when only the hash changes
+  if (url.includes('#')) window.location.reload();
+}

package/eventcatalog/src/utils/auth-astro/config.ts

@@ -0,0 +1,24 @@
+/**
+ * Adapted from auth-astro 4.2.0 (MIT, https://github.com/nowaythatworked/auth-astro).
+ *
+ * Kept in Core so every Auth.js import resolves to Core's own `@auth/core`. The
+ * auth-astro package pins an older `@auth/core` peer range, which makes npm install
+ * a second, vulnerable copy in user projects.
+ */
+import type { AuthConfig } from '@auth/core/types';
+
+export interface AstroAuthConfig {
+  /**
+   * Base path for the auth routes.
+   * @default '/api/auth'
+   */
+  prefix?: string;
+}
+
+export interface FullAuthConfig extends AstroAuthConfig, Omit<AuthConfig, 'raw'> {}
+
+export const defineConfig = (config: FullAuthConfig) => {
+  config.prefix ??= '/api/auth';
+  config.basePath = config.prefix;
+  return config;
+};

package/eventcatalog/src/utils/auth-astro/server.ts

@@ -0,0 +1,74 @@
+/**
+ * Adapted from auth-astro 4.2.0 (MIT, https://github.com/nowaythatworked/auth-astro).
+ * See ./config.ts for why this lives in Core.
+ */
+import { Auth } from '@auth/core';
+import type { AuthAction, Session } from '@auth/core/types';
+import type { APIContext } from 'astro';
+import { parseString } from 'set-cookie-parser';
+import authConfig from 'auth:config';
+
+const actions: AuthAction[] = ['providers', 'session', 'csrf', 'signin', 'signout', 'callback', 'verify-request', 'error'];
+
+function AstroAuthHandler(prefix: string, options = authConfig) {
+  return async ({ cookies, request }: APIContext) => {
+    const url = new URL(request.url);
+    const action = url.pathname.slice(prefix.length + 1).split('/')[0] as AuthAction;
+
+    if (!actions.includes(action) || !url.pathname.startsWith(prefix + '/')) return;
+
+    const res = await Auth(request, options);
+    if (['callback', 'signin', 'signout'].includes(action)) {
+      // Multiple Set-Cookie headers can't be concatenated, so hand each one to Astro
+      const setCookies = res.headers.getSetCookie();
+      if (setCookies.length > 0) {
+        setCookies.forEach((cookie) => {
+          const { name, value, ...cookieOptions } = parseString(cookie);
+          cookies.set(name, value, cookieOptions as Parameters<(typeof cookies)['set']>[2]);
+        });
+        res.headers.delete('Set-Cookie');
+      }
+    }
+    return res;
+  };
+}
+
+/**
+ * Creates the Astro GET and POST endpoints for authentication.
+ */
+export function AstroAuth(options = authConfig) {
+  const { AUTH_SECRET, AUTH_TRUST_HOST, VERCEL, NODE_ENV } = import.meta.env;
+
+  options.secret ??= AUTH_SECRET;
+  options.trustHost ??= !!(AUTH_TRUST_HOST ?? VERCEL ?? NODE_ENV !== 'production');
+
+  const { prefix = '/api/auth', ...authOptions } = options;
+
+  const handler = AstroAuthHandler(prefix, authOptions);
+  return {
+    async GET(context: APIContext) {
+      return await handler(context);
+    },
+    async POST(context: APIContext) {
+      return await handler(context);
+    },
+  };
+}
+
+/**
+ * Fetches the current session, or `null` if there is none.
+ */
+export async function getSession(req: Request, options = authConfig): Promise<Session | null> {
+  options.secret ??= import.meta.env.AUTH_SECRET;
+  options.trustHost ??= true;
+
+  const url = new URL(`${options.prefix}/session`, req.url);
+  const response = await Auth(new Request(url, { headers: req.headers }), options);
+  const { status = 200 } = response;
+
+  const data = await response.json();
+
+  if (!data || !Object.keys(data).length) return null;
+  if (status === 200) return data;
+  throw new Error(data.message);
+}

package/package.json

@@ -7,7 +7,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
-  "version": "4.12.0",
+  "version": "4.12.1",
   "publishConfig": {
     "access": "public"
   },
@@ -78,7 +78,6 @@
     "astro": "7.3.3",
     "astro-expressive-code": "^0.44.0",
     "astro-seo": "^0.8.4",
-    "auth-astro": "^4.2.0",
     "boxen": "^8.0.1",
     "commander": "^12.1.0",
     "cross-env": "^7.0.3",
@@ -124,6 +123,7 @@
     "remark-gfm": "^4.0.1",
     "rimraf": "^6.1.3",
     "semver": "7.6.3",
+    "set-cookie-parser": "^2.7.1",
     "shelljs": "^0.9.0",
     "sonner": "^2.0.7",
     "sql.js": "^1.12.0",
@@ -155,6 +155,7 @@
     "@types/react-dom": "^19.2.3",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/semver": "^7.5.8",
+    "@types/set-cookie-parser": "^2.4.10",
     "@types/shelljs": "^0.8.15",
     "@types/update-notifier": "^6.0.8",
     "@types/uuid": "^10.0.0",

package/dist/runtime-dependencies/auth-astro.mjs

@@ -1,3 +0,0 @@
-export * from "auth-astro";
-import * as dependency from "auth-astro";
-export default dependency.default;

package/dist/runtime-dependencies/auth-astro__client.mjs

@@ -1,3 +0,0 @@
-export * from "auth-astro/client";
-import * as dependency from "auth-astro/client";
-export default dependency.default;

package/dist/runtime-dependencies/auth-astro__server.mjs

@@ -1,3 +0,0 @@
-export * from "auth-astro/server";
-import * as dependency from "auth-astro/server";
-export default dependency.default;

package/dist/{chunk-U4YJSTGV.js → chunk-WRLNLWPW.js}

@@ -1,3 +1,10 @@
+import {
+  getFederationDiagnostics,
+  resolveFederationRules
+} from "./chunk-JJPB6EOZ.js";
+import {
+  isFederationEnabled
+} from "./chunk-FV56YFM4.js";
 import {
   withFederationOutputTransaction
 } from "./chunk-WRNH5C3U.js";
@@ -10,13 +17,6 @@ import {
 import {
   createFederationContentCache
 } from "./chunk-R7Z5ALYI.js";
-import {
-  getFederationDiagnostics,
-  resolveFederationRules
-} from "./chunk-JJPB6EOZ.js";
-import {
-  isFederationEnabled
-} from "./chunk-FV56YFM4.js";
 import {
   getEventCatalogConfigFile
 } from "./chunk-RFIXKATC.js";