@nodefony/framework 10.0.0-beta.2 → 10.0.0-beta.4

package/README.md

@@ -18,6 +18,10 @@ sert **HTTP et WebSocket dans le même contexte**, nativement.
   instance par requête (par connexion en WebSocket). `RealtimeController` est par connexion.
 - **Décorateurs** : `@controller`, `@route`, `@Get/@Post/...`, `@Param/@Body/@Query/@Headers`,
   `@Domain`, etc.
+- **Routes à schéma** : `@Post("/posts", { schema: { body } })` — l'entrée est validée avant
+  l'action (422 qui nomme chaque champ, sur HTTP comme par la socket) et reçue typée en un seul
+  argument, `input: RouteInput<S>`. Zod, Valibot, ArkType : tout Standard Schema. Détail :
+  [`docs/decorateurs.md`](docs/decorateurs.md).
 - **Data plane admin** : `AdminApiController` + `IAdminBroker` (surface `/nodefony/<module>/api/*`).
 
 ## Exemple

package/dist/_virtual/{_@oxc-project_runtime@0.152.0 → _@oxc-project_runtime@0.155.0}/helpers/esm/decorate.js

@@ -1,9 +1,8 @@
-//#region \0@oxc-project+runtime@0.152.0/helpers/esm/decorate.js
+// \0@oxc-project+runtime@0.155.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-//#endregion
 export { __decorate as default };

package/dist/index.js

@@ -4,17 +4,18 @@ import { getIdempotencyStoreFactory, listIdempotencyBackends, listIdempotencySto
 import { RedisIdempotencyStore } from "./nodefony/src/RedisIdempotencyStore.js";
 import { scheduleIdempotencyGc } from "./nodefony/src/idempotencyGc.js";
 import Route from "./nodefony/src/Route.js";
+import { validateRouteInput } from "./nodefony/src/routeSchema.js";
 import Controller from "./nodefony/src/Controller.js";
-import { All, Anonymous, Body, BypassFirewall, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, Options, Param, Patch, Post, Put, Query, Redirect, Req, RequireScope, Res, Scope, Session, UploadedFile, UploadedFiles, UseSession, controller, controllers, route, routeExpectsBodyStream } from "./nodefony/decorators/routerDecorators.js";
+import { All, Anonymous, Body, BypassFirewall, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, Options, Param, Patch, Post, Put, Query, Redirect, Req, RequireAuthentication, RequireScope, Res, Scope, Session, UploadedFile, UploadedFiles, UseSession, buildContextParamArgs, controller, controllers, getParamArgsMeta, route, routeExpectsBodyStream } from "./nodefony/decorators/routerDecorators.js";
 import Resolver from "./nodefony/src/Resolver.js";
-import __decorateMetadata from "./_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
-import __decorate from "./_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
-import router_default from "./nodefony/service/router.js";
+import __decorate from "./_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import router_default, { FRAMEWORK_ROUTER, isFrameworkRouter } from "./nodefony/service/router.js";
 import ResourceController from "./nodefony/src/ResourceController.js";
 import AdminApiController from "./nodefony/controller/AdminApiController.js";
 import AdminBroker_default from "./nodefony/service/AdminBroker.js";
 import IdempotencyStore_default from "./nodefony/service/IdempotencyStore.js";
 import SessionAuthController, { mountSessionAuthRoutes } from "./nodefony/controller/SessionAuthController.js";
+import LoginPageController, { mountLoginPage } from "./nodefony/controller/LoginPageController.js";
 import TokenAuthController, { mountTokenAuthRoutes } from "./nodefony/controller/TokenAuthController.js";
 import IssuerMetadataController, { mountIssuerMetadataRoutes } from "./nodefony/controller/IssuerMetadataController.js";
 import ProtectedResourceMetadataController, { collectProtectedResources, mountProtectedResourceRoutes, protectedResourceRoutePaths } from "./nodefony/controller/ProtectedResourceMetadataController.js";
@@ -29,10 +30,8 @@ import { createFrameworkAdminApi } from "./nodefony/src/FrameworkAdminApi.js";
 import { createSyslogAdminApi } from "./nodefony/src/SyslogAdminApi.js";
 import Eta from "./nodefony/service/Eta.js";
 import path from "node:path";
-import { AUTO_STORE, EMPTY_INFRA, Kernel, Module, durableStoreRemedy, readStoreConnector, readStoreLocation, resolveAutoStore, runNeedsExternalServices, services } from "nodefony";
-import { mergeResolvers, mergeTypeDefs } from "@graphql-tools/merge";
-import { makeExecutableSchema, mergeSchemas } from "@graphql-tools/schema";
-//#region index.ts
+import { AUTO_STORE, EMPTY_INFRA, Module, durableStoreRemedy, readStoreConnector, readStoreLocation, resolveAutoStore, services, storeConnectivity } from "nodefony";
+// index.ts
 registerIdempotencyStore("redis", (ctx) => {
 	const redis = ctx.module.kernel?.container?.get("redis");
 	if (!redis) throw new Error("the @nodefony/redis module is not loaded (add use(\"@nodefony/redis\") in nodefony.config.ts)");
@@ -91,13 +90,13 @@ let Framework = class Framework extends Module {
 		let name = configured;
 		let reason = `store explicitement configuré ("${configured}")`;
 		if (name === AUTO_STORE) {
-			const auto = resolveAutoStore("ephemeral", this.kernel?.infra ?? EMPTY_INFRA, listIdempotencyBackends(), "memory", runNeedsExternalServices(this.kernel));
+			const auto = resolveAutoStore("ephemeral", this.kernel?.infra ?? EMPTY_INFRA, listIdempotencyBackends(), "memory", storeConnectivity(this.kernel));
 			name = auto.store;
 			reason = auto.reason;
 			this.log(`idempotency.store "auto" → "${name}" (${auto.reason})`, "INFO");
 		}
 		if (name === "memory") {
-			if (this.kernel?.environment === "production") this.log("idempotency.store \"memory\" en PRODUCTION — déduplication per-pod uniquement : un rejeu routé vers un autre pod n'est pas dédupliqué (double-effet possible). " + durableStoreRemedy(runNeedsExternalServices(this.kernel)), "WARNING");
+			if (this.kernel?.environment === "production") this.log("idempotency.store \"memory\" en PRODUCTION — déduplication per-pod uniquement : un rejeu routé vers un autre pod n'est pas dédupliqué (double-effet possible). " + durableStoreRemedy(storeConnectivity(this.kernel)), "WARNING");
 			this.kernel?.registerStoreResolution({
 				brick: "idempotency",
 				nature: "ephemeral",
@@ -176,7 +175,10 @@ let Framework = class Framework extends Module {
 			}
 			broker.mountAll();
 		}
-		if (this.kernel?.container?.get("authFlow")) mountSessionAuthRoutes(this);
+		if (this.kernel?.container?.get("authFlow")) {
+			mountSessionAuthRoutes(this);
+			mountLoginPage(this);
+		}
 		if (this.kernel?.container?.get("tokenService")) {
 			mountTokenAuthRoutes(this);
 			const issuer = this.kernel.container.get("tokenService")?.publishedIssuer();
@@ -200,13 +202,6 @@ Framework = __decorate([services([
 	Eta,
 	AdminBroker_default,
 	IdempotencyStore_default
-]), __decorateMetadata("design:paramtypes", [typeof Kernel === "undefined" ? Object : Kernel])], Framework);
-const graphql = {
-	mergeSchemas,
-	makeExecutableSchema,
-	mergeResolvers,
-	mergeTypeDefs
-};
+])], Framework);
 var framework_default = Framework;
-//#endregion
-export { AdminApiController, AdminBroker_default as AdminBroker, All, Anonymous, ApiKeyController, BenchController, Body, BypassFirewall, Controller, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Eta, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, IssuerMetadataController, IdempotencyStore_default as MemoryIdempotencyStore, OAuth2Controller, Options, Param, Patch, Post, ProtectedResourceMetadataController, Put, Query, Redirect, Req, RequireScope, Res, Resolver, ResourceController, Route, router_default as Router, Scope, Session, SessionAuthController, TokenAuthController, TotpController, UploadedFile, UploadedFiles, UseSession, WebAuthnController, buildPlaygroundSnapshot, collectProtectedResources, controller, controllers, createFrameworkAdminApi, createKernelAdminApi, createSyslogAdminApi, framework_default as default, defineFrameworkConfig, frameworkConfigJsonSchema, frameworkConfigSchema, getIdempotencyStoreFactory, graphql, listIdempotencyStores, mountApiKeyRoutes, mountBenchRoutes, mountIssuerMetadataRoutes, mountOAuth2Routes, mountProtectedResourceRoutes, mountSessionAuthRoutes, mountTokenAuthRoutes, mountTotpRoutes, mountWebAuthnRoutes, protectedResourceRoutePaths, registerIdempotencyStore, route, routeExpectsBodyStream };
+export { AdminApiController, AdminBroker_default as AdminBroker, All, Anonymous, ApiKeyController, BenchController, Body, BypassFirewall, Controller, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Eta, FRAMEWORK_ROUTER, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, IssuerMetadataController, LoginPageController, IdempotencyStore_default as MemoryIdempotencyStore, OAuth2Controller, Options, Param, Patch, Post, ProtectedResourceMetadataController, Put, Query, Redirect, Req, RequireAuthentication, RequireScope, Res, Resolver, ResourceController, Route, router_default as Router, Scope, Session, SessionAuthController, TokenAuthController, TotpController, UploadedFile, UploadedFiles, UseSession, WebAuthnController, buildContextParamArgs, buildPlaygroundSnapshot, collectProtectedResources, controller, controllers, createFrameworkAdminApi, createKernelAdminApi, createSyslogAdminApi, framework_default as default, defineFrameworkConfig, frameworkConfigJsonSchema, frameworkConfigSchema, getIdempotencyStoreFactory, getParamArgsMeta, isFrameworkRouter, listIdempotencyStores, mountApiKeyRoutes, mountBenchRoutes, mountIssuerMetadataRoutes, mountLoginPage, mountOAuth2Routes, mountProtectedResourceRoutes, mountSessionAuthRoutes, mountTokenAuthRoutes, mountTotpRoutes, mountWebAuthnRoutes, protectedResourceRoutePaths, registerIdempotencyStore, route, routeExpectsBodyStream, validateRouteInput };

package/dist/nodefony/config/config.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region nodefony/config/config.ts
+// nodefony/config/config.ts
 /**
 * @nodefony/framework — CONFIGURATION DU MODULE (schéma Zod = source unique).
 *
@@ -58,5 +58,4 @@ var config_default = {
 		}
 	} }
 };
-//#endregion
 export { config_default as default, frameworkConfigSchema };

package/dist/nodefony/config/defineModuleConfig.js

@@ -1,7 +1,7 @@
 import { frameworkConfigSchema } from "./config.js";
 import { parseModuleConfig } from "nodefony";
 import { z } from "zod";
-//#region nodefony/config/defineModuleConfig.ts
+// nodefony/config/defineModuleConfig.ts
 /**
 * Builder type-safe de la configuration de `@nodefony/framework` (PUR — ne
 * retape JAMAIS un défaut : source unique = `./config.ts`).
@@ -32,5 +32,4 @@ function defineFrameworkConfig(config = {}) {
 function frameworkConfigJsonSchema() {
 	return z.toJSONSchema(frameworkConfigSchema);
 }
-//#endregion
 export { defineFrameworkConfig, frameworkConfigJsonSchema };

package/dist/nodefony/controller/AdminApiController.js

@@ -1,7 +1,39 @@
 import Controller from "../src/Controller.js";
 import { computeFingerprint, evaluateIdempotency, resolveIdempotencyKey, resolveIdentity } from "../src/idempotency.js";
-import { RequestContext, RpcError, executeAdminEndpoint } from "nodefony";
-//#region nodefony/controller/AdminApiController.ts
+import { JsonRpcServerError, RequestContext, RpcError, executeAdminEndpoint } from "nodefony";
+// nodefony/controller/AdminApiController.ts
+/** Vrai pour une chaîne ou un tableau de chaînes — ce que porte {@link IAdminRequest.query}. */
+function isAdminQueryValue(value) {
+	if (typeof value === "string") return true;
+	if (!Array.isArray(value)) return false;
+	for (const item of value) if (typeof item !== "string") return false;
+	return true;
+}
+/**
+* Ramène les paramètres d'URL au contrat {@link IAdminRequest.query} : seules
+* les chaînes et les tableaux de chaînes passent. `qs` produit des objets pour
+* `a[b]=1` ; les laisser passer sous un type qui les nie tromperait chaque
+* producteur du plan d'administration.
+*
+* @param source - paramètres d'URL de la requête (`Controller.query`)
+* @returns `source` lui-même quand il respecte déjà le contrat (aucune
+*   allocation), sinon une copie sans les valeurs imbriquées
+*/
+function toAdminQuery(source) {
+	if (source === void 0) return {};
+	let conforms = true;
+	for (const key of Object.keys(source)) if (!isAdminQueryValue(source[key])) {
+		conforms = false;
+		break;
+	}
+	if (conforms) return source;
+	const kept = [];
+	for (const key of Object.keys(source)) {
+		const value = source[key];
+		if (isAdminQueryValue(value)) kept.push([key, value]);
+	}
+	return Object.fromEntries(kept);
+}
 /**
 * Controller pont unique du data plane admin (Studio).
 *
@@ -43,10 +75,10 @@ var AdminApiController = class AdminApiController extends Controller {
 	*/
 	async dispatch(...args) {
 		const { status, headers, body } = await this.runAdmin(args);
-		if (this.context?.type.startsWith("websocket")) {
+		if (this.context?.type === "websocket") {
 			if (status >= 400) {
 				const message = body?.error ?? "admin error";
-				throw new RpcError(message, -32e3, {
+				throw new RpcError(message, JsonRpcServerError.DEFAULT, {
 					status,
 					body
 				});
@@ -84,7 +116,10 @@ var AdminApiController = class AdminApiController extends Controller {
 			request: this.buildRequest(args),
 			requiredRole: adminRoute.role,
 			gate: (request) => this.idempotencyGate(adminRoute, request),
-			onServerError: (error) => this.log(error, "ERROR")
+			onServerError: (error) => this.log(error, "ERROR"),
+			assertCredentialTransport: () => {
+				this.get("credentialTransport")?.assert(this.context ?? {}, `admin ${name}`);
+			}
 		});
 	}
 	/**
@@ -104,14 +139,14 @@ var AdminApiController = class AdminApiController extends Controller {
 		const store = this.get("idempotencyStore");
 		const verdict = await evaluateIdempotency({
 			store,
-			identity: resolveIdentity(request.user),
+			identity: resolveIdentity(),
 			clientKey: request.idempotencyKey,
 			fingerprint: computeFingerprint([
 				adminRoute.name,
 				request.params,
 				request.body ?? null
 			]),
-			isWs: Boolean((this.context?.type)?.startsWith("websocket")),
+			isWs: this.context?.type === "websocket",
 			required: false
 		});
 		switch (verdict.kind) {
@@ -140,10 +175,10 @@ var AdminApiController = class AdminApiController extends Controller {
 		}
 		const als = RequestContext.get();
 		const user = als?.user ?? null;
-		const post = this.queryPost;
+		const post = this.body;
 		return {
 			params,
-			query: this.query ?? {},
+			query: toAdminQuery(this.query),
 			body: als?.body !== void 0 ? als.body : post ?? null,
 			user,
 			roles: this.extractRoles(user),
@@ -180,5 +215,4 @@ var AdminApiController = class AdminApiController extends Controller {
 		return [...walker.reachableRoles(roles)];
 	}
 };
-//#endregion
-export { AdminApiController as default };
+export { AdminApiController as default, toAdminQuery };

package/dist/nodefony/controller/ApiKeyController.js

@@ -1,7 +1,7 @@
-import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
+import SecurityApiController from "../src/SecurityApiController.js";
 import { collectDeclaredApiScopes } from "../src/scopeCatalog.js";
-//#region nodefony/controller/ApiKeyController.ts
+// nodefony/controller/ApiKeyController.ts
 let mounted = false;
 /**
 * Endpoints HTTP de **gestion des clés API personnelles (PAT, P6.12)** — console
@@ -24,7 +24,7 @@ let mounted = false;
 * Erreurs mappées par DUCK-TYPING sur `code` (400/409/503) — framework ne peut pas
 * importer les classes d'erreur de security.
 */
-var ApiKeyController = class extends Controller {
+var ApiKeyController = class extends SecurityApiController {
 	constructor(context) {
 		super("ApiKeyController", context);
 	}
@@ -32,15 +32,15 @@ var ApiKeyController = class extends Controller {
 	async create() {
 		const svc = this.#manager();
 		if (!svc || !svc.isEnabled()) return this.renderJson({ error: "API keys unavailable" }, 503);
-		const subject = await this.#currentSubject();
-		if (subject === null) return this.renderJson({ error: "Unauthorized" }, 401);
-		const body = this.queryPost ?? {};
+		const holder = await this.#currentHolder();
+		if (holder === null) return this.renderJson({ error: "Unauthorized" }, 401);
+		const body = this.body ?? {};
 		try {
-			const created = await svc.createForSubject(subject, "user", {
+			const created = await svc.createForSubject(holder.identifier, "user", {
 				name: body.name,
 				scopes: body.scopes,
 				expiresInDays: body.expiresInDays
-			});
+			}, holder.roles);
 			return await this.renderJson(created, 201);
 		} catch (e) {
 			return this.#renderApiKeyError(e);
@@ -86,10 +86,18 @@ var ApiKeyController = class extends Controller {
 	}
 	/** Identifiant du porteur courant (session BFF revalidée), ou `null` si non authentifié. */
 	async #currentSubject() {
+		return (await this.#currentHolder())?.identifier ?? null;
+	}
+	async #currentHolder() {
 		const flow = this.#flow();
 		if (!flow) return null;
 		const me = await flow.me(this.context);
-		return me && typeof me.username === "string" ? me.username : null;
+		if (!me || typeof me.identifier !== "string") return null;
+		const roles = Array.isArray(me.roles) ? me.roles.filter((r) => typeof r === "string") : [];
+		return {
+			identifier: me.identifier,
+			roles
+		};
 	}
 	#renderApiKeyError(e) {
 		const code = e.code;
@@ -97,6 +105,7 @@ var ApiKeyController = class extends Controller {
 			const message = e.message;
 			return this.renderJson({ error: typeof message === "string" ? message : "Bad request" }, 400);
 		}
+		if (code === 403) return this.renderJson({ error: e instanceof Error ? e.message : "Forbidden" }, 403);
 		if (code === 409) return this.renderJson({ error: "API key limit reached" }, 409);
 		if (code === 503) return this.renderJson({ error: "API keys unavailable" }, 503);
 		throw e;
@@ -149,5 +158,4 @@ function mountApiKeyRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(ApiKeyController.prototype, "module")) router_default.setController(ApiKeyController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { ApiKeyController as default, mountApiKeyRoutes };

package/dist/nodefony/controller/BenchController.js

@@ -1,6 +1,6 @@
 import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
-//#region nodefony/controller/BenchController.ts
+// nodefony/controller/BenchController.ts
 /**
 * Corps servi par la cible de banc — **gelé et partagé** : ce qu'on chronomètre
 * est le pipeline, pas la construction d'un objet. Le figer évite qu'une
@@ -128,5 +128,4 @@ function mountBenchRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(BenchController.prototype, "module")) router_default.setController(BenchController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { BenchController as default, mountBenchRoutes };

package/dist/nodefony/controller/IssuerMetadataController.js

@@ -2,7 +2,7 @@ import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
 import { askedAuthority, onDeclaredAuthority } from "./oauthAuthority.js";
 import { JWKS_PATH, authorizationServerMetadataPath, buildAuthorizationServerMetadata } from "nodefony";
-//#region nodefony/controller/IssuerMetadataController.ts
+// nodefony/controller/IssuerMetadataController.ts
 let mounted = false;
 /**
 * Les deux documents qui rendent une application Nodefony **découvrable** comme
@@ -144,5 +144,4 @@ function mountIssuerMetadataRoutes(frameworkModule, issuer) {
 	if (!Object.prototype.hasOwnProperty.call(IssuerMetadataController.prototype, "module")) router_default.setController(IssuerMetadataController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { IssuerMetadataController as default, mountIssuerMetadataRoutes };

package/dist/nodefony/controller/LoginPageController.js

@@ -0,0 +1,117 @@
+import { isDevelopment } from "../src/singletonGuard.js";
+import Controller from "../src/Controller.js";
+import { Csp } from "../decorators/routerDecorators.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import router_default from "../service/router.js";
+import { LOGIN_PAGE_ASSET_FILES, LOGIN_PAGE_TEMPLATE, buildLoginPageView, keepSuccess } from "../src/loginPage.js";
+import path from "node:path";
+import { LOGIN_PAGE_ASSETS_BASE, LOGIN_PAGE_SKINS, loginPageSkinFile } from "nodefony";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { Eta } from "eta";
+// nodefony/controller/LoginPageController.ts
+const NO_STORE = { "cache-control": "no-store" };
+let mounted = false;
+let engine = null;
+let defaultTemplate = null;
+let appTemplate = null;
+/** Dossier des fichiers de la page (`dist/login/` du paquet `nodefony`). */
+function assetsDir() {
+	return path.dirname(fileURLToPath(import.meta.resolve("nodefony/login.js")));
+}
+function eta() {
+	return engine ??= new Eta({
+		autoEscape: true,
+		useWith: false
+	});
+}
+function templateFor(page) {
+	if (page.template === null) return Promise.resolve(defaultTemplate ??= eta().compile(LOGIN_PAGE_TEMPLATE));
+	if (appTemplate?.file !== page.template) {
+		const file = page.template;
+		appTemplate = {
+			file,
+			template: keepSuccess(() => readFile(file, "utf8").then((source) => eta().compile(source)))
+		};
+	}
+	return appTemplate.template();
+}
+const version = keepSuccess(async () => {
+	const dir = assetsDir();
+	const hash = createHash("sha256");
+	const skins = LOGIN_PAGE_SKINS.map(loginPageSkinFile).filter((file) => file !== null);
+	for (const file of [
+		LOGIN_PAGE_ASSET_FILES.script,
+		LOGIN_PAGE_ASSET_FILES.style,
+		...skins
+	]) hash.update(await readFile(path.join(dir, file)));
+	return hash.digest("hex").slice(0, 12);
+});
+/**
+* Page de connexion par défaut (ADR-0015) : gabarit F03 rendu côté serveur,
+* feuille `nodefony/login.css`, script `nodefony/login.js`. Aucun front, aucun
+* build côté application.
+*
+* Joignable sans session ; jamais mise en cache (`no-store`) ni affichable
+* dans un cadre (`frame-ancestors 'none'`).
+*/
+var LoginPageController = class extends Controller {
+	constructor(context) {
+		super("LoginPageController", context);
+	}
+	/**
+	* Rend la page de connexion.
+	*
+	* @returns la page HTML, ou 404 quand security ne la décrit plus
+	*/
+	async page() {
+		const page = this.get("authFlow")?.describeLoginPage?.() ?? null;
+		if (page === null) return this.renderJson({ error: "Not Found" }, 404, NO_STORE);
+		const query = this.query;
+		const view = buildLoginPageView(page, {
+			from: query?.from,
+			reason: query?.reason,
+			theme: query?.theme,
+			skin: query?.skin,
+			layout: query?.layout,
+			preview: isDevelopment(this.kernel?.environment),
+			nonce: this.context?.cspNonce ?? "",
+			projectName: this.kernel?.projectName ?? "Nodefony",
+			assetsVersion: await version()
+		});
+		const template = await templateFor(page);
+		return this.render(template.call(eta(), view), "utf8", 200, {
+			...NO_STORE,
+			"content-type": "text/html; charset=utf-8"
+		});
+	}
+};
+__decorate([Csp({ "frame-ancestors": ["'none'"] })], LoginPageController.prototype, "page", null);
+/**
+* Monte la page de connexion par défaut quand security la décrit : la route
+* sur `loginPage.path`, et ses fichiers sous `LOGIN_PAGE_ASSETS_BASE`.
+*
+* La page est le chemin vers la session : elle échappe au pare-feu, comme les
+* routes de connexion — sinon une application qui protège `^/` exigerait
+* d'être connecté pour se connecter.
+*
+* @param frameworkModule - module framework, qui porte les contrôleurs
+*/
+function mountLoginPage(frameworkModule) {
+	if (mounted) return;
+	const page = frameworkModule.get("authFlow")?.describeLoginPage?.() ?? null;
+	if (page === null) return;
+	if (!page.password && !page.passkey && page.providers.length === 0) frameworkModule.log(`${page.path} : aucun moyen de connexion — loginPage.password à false, passkeys coupées, aucun fournisseur opérationnel`, "WARNING");
+	router_default.createRoute("security.login.page", {
+		path: page.path,
+		constructor: LoginPageController,
+		classMethod: "page",
+		requirements: { methods: ["GET", "HEAD"] },
+		bypassFirewall: true
+	});
+	frameworkModule.get("server-static")?.addMount(LOGIN_PAGE_ASSETS_BASE, assetsDir());
+	if (!Object.prototype.hasOwnProperty.call(LoginPageController.prototype, "module")) router_default.setController(LoginPageController, frameworkModule);
+	mounted = true;
+}
+export { LoginPageController as default, mountLoginPage };