refactor(authup)!: rename admin UI to client-admin-console (values: ui -> adminConsole)

.agents/architecture.md

@@ -76,7 +76,7 @@ editing templates or values.
     ingress blocks; the UI origin is auto-appended to `TRUSTED_ORIGINS`
     (`server.trustedOriginsAppendUI`). A missing trusted origin is the #1
     dead-login misconfiguration. The chart never sets
-    `NUXT_PUBLIC_COOKIE_DOMAIN`: sharing a cookie domain between client-web
+    `NUXT_PUBLIC_COOKIE_DOMAIN`: sharing a cookie domain between client-console
     and the hosted auth pages is unsupported by authup.
 16. **Every list/map passthrough is tpl-rendered** via
     `authup.tplvalues.render`, so umbrella charts can inject template

.agents/references/authup.md

@@ -9,7 +9,7 @@ v1.0.0-beta.58 line (chart `appVersion`).
 
 | Fact | authup source | Chart counterpart |
 |---|---|---|
-| One image `authup/authup`, arg-dispatched entrypoint (`server/core start`, `client/web start`, `server/core migration run`, `server/core healthcheck`) | `Dockerfile`, `entrypoint.sh` (repo root) | `args` in `templates/{server,ui}/deployment.yaml`, `server/migration-job.yaml` |
+| One image `authup/authup`, arg-dispatched entrypoint (`server/core start`, `client/console start`, `server/core migration run`, `server/core healthcheck`) | `Dockerfile`, `entrypoint.sh` (repo root) | `args` in `templates/{server,ui}/deployment.yaml`, `server/migration-job.yaml` |
 | Entrypoint force-exports `PORT=3000` / `NUXT_PORT=3000` (chart-set PORT is dead) | `entrypoint.sh` | containerPort pinned 3000 everywhere |
 | Image runs as root; writable paths `/usr/src/app/writable` + npm cache | `Dockerfile` (`WRITABLE_DIRECTORY_PATH`, no `USER`) | emptyDir mounts + `npm_config_cache=/tmp/.npm-cache`; root securityContext default |
 | `latest`/`<version>`/`beta`/`next` tags | `.github/workflows/release.yml`, `docker-nightly.yml` | `image.tag` defaults to `Chart.AppVersion` |
@@ -39,11 +39,11 @@ Config file: `authup.server.core.conf` in the process cwd
 `<writable>/provisioning/*` scanned at boot, fail-closed
 (`app/modules/provisioning/module.ts`) -> `server.provisioning.*` mount.
 
-## client-web env surface
+## client-console env surface
 
 Runtime config only (prebuilt Nitro bundle; bare `API_URL` etc. are build-time
-and dead): `apps/client-web/nuxt.config.ts`,
-`docs/src/guide/deployment/configuration-client-web.md`.
+and dead): `apps/client-console/nuxt.config.ts`,
+`docs/src/guide/deployment/configuration-client-console.md`.
 `NUXT_PUBLIC_API_URL` (browser-reachable server URL), `NUXT_PUBLIC_PUBLIC_URL`,
 `NUXT_API_URL` (SSR-side override), `NUXT_PUBLIC_COOKIE_DOMAIN` (deliberately
 never set by the chart: sharing a cookie domain with the server origin is
@@ -54,7 +54,7 @@ unsupported per `.agents/architecture.md` in the monorepo). Chart counterpart:
 
 - `GET /` = anonymous status endpoint `{version, date, features}`
   (`adapters/http/controllers/workflows/status/`) -> liveness/readiness for
-  server-core; client-web uses its SSR `/`.
+  server-core; client-console uses its SSR `/`.
 - server-core auto-runs migrations + provisioning at boot
   (`app/modules/database/module.ts`; no off-switch) -> generous startupProbe;
   optional pre-upgrade migration Job for multi-replica DDL serialization.

.agents/structure.md

@@ -47,7 +47,7 @@ authup/helm
         ├── server/              # server-core: deployment, service, ingress, httproute,
         │                        # configmap-env, configmap-configuration, configmap-provisioning,
         │                        # migration-job, hpa, pdb, networkpolicy, servicemonitor
-        ├── ui/                  # client-web: deployment, service, ingress, httproute,
+        ├── ui/                  # client-console: deployment, service, ingress, httproute,
         │                        # configmap-env, hpa, pdb, networkpolicy
         ├── postgresql/          # built-in instance: statefulset, service, secret
         ├── mysql/               # built-in instance: statefulset, service, secret
@@ -57,14 +57,14 @@ authup/helm
 ## Two components, per-role template directories
 
 `server/` (server-core, the IdP: OAuth2/OIDC surface + SSR auth pages) and
-`ui/` (client-web admin console) are separate template directories with ~85%
+`ui/` (client-console admin console) are separate template directories with ~85%
 similar deployment templates. This duplication is DELIBERATE: authentik built
 the DRY role-loop and reverted it ("takes DRY maybe a bit too far", their
 PR #163). Do not introduce a role loop. A future authup server/worker split
 becomes a third directory with the same skeleton.
 
 Both services run the SAME image (`authup/authup`) with different args
-(`server/core start` vs `client/web start`). The image entrypoint force-exports
+(`server/core start` vs `client/console start`). The image entrypoint force-exports
 `PORT=3000` for both, so `containerPort` is pinned to 3000 everywhere and only
 Service ports are values.
 

AGENTS.md

@@ -5,7 +5,7 @@
 Helm charts for [Authup](https://authup.org), an authentication & authorization
 system. One application chart today: `charts/authup` deploys the two runtime
 services of the [authup monorepo](https://github.com/authup/authup) (server-core
-IdP/API and the client-web admin UI) plus optional built-in PostgreSQL, MySQL
+IdP/API and the client-console admin UI) plus optional built-in PostgreSQL, MySQL
 and Valkey instances.
 
 `DESIGN.md` at the repo root is the authoritative design record: every major

DESIGN.md

@@ -23,7 +23,7 @@ repo; every decision below cites its evidence.
    vendored locally (Apache-2.0-clean, bitnami-compatible key names).
 2. **Two workloads, one chart, one image.** `authup/authup` is a single image whose
    entrypoint dispatches on args: `server/core start` (server-core, the IdP/API) and
-   `client/web start` (client-web, the Nuxt admin UI). The `authup` CLI supervisor is
+   `client/console start` (client-console, the Nuxt admin UI). The `authup` CLI supervisor is
    **not routable through the container entrypoint** and the monorepo docs pin
    "containers with one service each" as the production topology — so the chart
    ships two Deployments and never a combined pod.
@@ -76,7 +76,7 @@ authup/helm
 │       ├── server/             # server-core: deployment, service, ingress,
 │       │                       # httproute, configmap-env, migration-job, hpa,
 │       │                       # pdb, networkpolicy, servicemonitor
-│       ├── ui/                 # client-web: deployment, service, ingress,
+│       ├── ui/                 # client-console: deployment, service, ingress,
 │       │                       # httproute, configmap-env, hpa, pdb, networkpolicy
 │       ├── postgresql/         # optional built-in dev instance (statefulset,
 │       │                       # service, secret) — docker-official image
@@ -100,9 +100,9 @@ charts (e.g. an `authup-remote` RBAC chart, authentik-style).
 
 ### 3.1 Workloads
 
-| | `server` (server-core) | `ui` (client-web) |
+| | `server` (server-core) | `ui` (client-console) |
 |---|---|---|
-| args | `["server/core", "start"]` | `["client/web", "start"]` |
+| args | `["server/core", "start"]` | `["client/console", "start"]` |
 | containerPort | 3000 (pinned) | 3000 (pinned) |
 | role | OAuth2/OIDC IdP origin + SSR auth pages | admin console, ordinary OAuth2 RP |
 | state | stateless w/ external DB+redis | fully stateless |
@@ -274,7 +274,7 @@ externalRedis:
 ### 3.7 Ingress and topology
 
 Two-host model as the default (server-core is the IdP origin serving the SSR auth
-pages; client-web is an ordinary RP; **cookie-domain sharing between the two is
+pages; client-console is an ordinary RP; **cookie-domain sharing between the two is
 unsupported by authup** — the chart never sets `NUXT_PUBLIC_COOKIE_DOMAIN` and
 validates against foot-guns):
 

README.md

@@ -27,7 +27,7 @@ on Kubernetes.
 ## Highlights
 
 - 🔐 **Complete deployment** - the server-core IdP/API (OAuth2 / OpenID Connect,
-  hosted login & consent pages) and the client-web admin UI, from one chart
+  hosted login & consent pages) and the client-console admin UI, from one chart
 - 🗄️ **Hybrid database model** - built-in PostgreSQL **or** MySQL for a
   one-command start, or bring your own external database
 - ⚡ **Optional Valkey cache** - built-in instance or external Redis; required
@@ -100,7 +100,7 @@ key).
 
 | Chart | Description |
 |---|---|
-| [authup](./charts/authup) | server-core (IdP/API) + client-web (admin UI), optional built-in PostgreSQL / MySQL / Valkey |
+| [authup](./charts/authup) | server-core (IdP/API) + client-console (admin UI), optional built-in PostgreSQL / MySQL / Valkey |
 
 ## Documentation
 

charts/authup/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: authup
-description: Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-web admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances.
+description: Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-console admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances.
 type: application
 version: 0.1.0
 appVersion: "1.0.0-beta.58"

charts/authup/README.md

@@ -8,12 +8,12 @@
 
 ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0-beta.58](https://img.shields.io/badge/AppVersion-1.0.0--beta.58-informational?style=flat-square)
 
-Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-web admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances. It deploys:
+Authup is an authentication & authorization system. This chart deploys the server-core IdP/API service and the client-console admin UI, with optional built-in PostgreSQL, MySQL and Valkey instances. It deploys:
 
 - **server-core** — the Authup IdP/API service: the OAuth2/OIDC protocol
   surface plus the server-rendered auth pages (login, consent, registration,
   password recovery). This is the identity origin.
-- **client-web** — the Nuxt-based admin UI, an ordinary OAuth2 relying party
+- **client-console** — the Nuxt-based admin UI, an ordinary OAuth2 relying party
   (optional; disable with `ui.enabled=false` for a headless IdP).
 - optionally, single-instance **PostgreSQL**, **MySQL** or **Valkey** built-in
   instances on docker-official images — a convenience for dev and small
@@ -313,7 +313,7 @@ Kubernetes: `>=1.25.0-0`
 | server.topologySpreadConstraints | list | `[]` | Topology spread constraints (a missing labelSelector is filled with the pod's selector labels) |
 | server.trustProxy | string | `"1"` | TRUST_PROXY setting. The chart defaults to one trusted hop (the ingress), not authup's spoofable trust-everything default |
 | server.trustedOrigins | list | `[]` | Additional trusted first-party app origins (TRUSTED_ORIGINS). Each listed origin can obtain full-permission tokens via the per-realm web client. List or comma-separated string; tpl-rendered. |
-| server.trustedOriginsAppendUI | bool | `true` | Automatically append the client-web UI origin to TRUSTED_ORIGINS (removes the most common dead-login misconfiguration) |
+| server.trustedOriginsAppendUI | bool | `true` | Automatically append the client-console UI origin to TRUSTED_ORIGINS (removes the most common dead-login misconfiguration) |
 | server.updateStrategy | object | `{"type":"RollingUpdate"}` | Deployment update strategy |
 | serviceAccount.annotations | object | `{}` | ServiceAccount annotations (tpl-rendered) |
 | serviceAccount.automountServiceAccountToken | bool | `false` | Automount the service account token |
@@ -337,7 +337,7 @@ Kubernetes: `>=1.25.0-0`
 | ui.customReadinessProbe | object | `{}` | Custom readiness probe |
 | ui.customStartupProbe | object | `{}` | Custom startup probe |
 | ui.disableRestartOnChanges | bool | `false` | Disable the checksum annotations that roll pods on config changes |
-| ui.enabled | bool | `true` | Deploy the client-web admin UI (false = headless IdP) |
+| ui.enabled | bool | `true` | Deploy the client-console admin UI (false = headless IdP) |
 | ui.extraEnvVars | list | `[]` | Extra environment variables for the UI container |
 | ui.extraEnvVarsCM | string | `""` | Extra ConfigMap with environment variables (tpl-rendered name) |
 | ui.extraEnvVarsSecret | string | `""` | Extra Secret with environment variables (tpl-rendered name) |

charts/authup/templates/NOTES.txt

@@ -27,7 +27,7 @@ server-core (IdP / API):
 
 {{- if .Values.ui.enabled }}
 
-client-web (admin UI):
+client-console (admin UI):
 {{- if $uiUrl }}
   URL: {{ $uiUrl }}
 {{- else }}

charts/authup/templates/_ui-env.tpl

@@ -1,9 +1,9 @@
 {{/*
-client-web environment as a YAML map. The published UI bundle only honors Nuxt
+client-console environment as a YAML map. The published UI bundle only honors Nuxt
 runtime-config names (NUXT_*); the API URL must be the BROWSER-reachable
 server-core URL, never a cluster-internal service name.
 The chart deliberately never sets NUXT_PUBLIC_COOKIE_DOMAIN: sharing a cookie
-domain between client-web and the hosted auth pages is unsupported by authup.
+domain between client-console and the hosted auth pages is unsupported by authup.
 */}}
 {{- define "authup.ui.configEnv" -}}
 {{- $apiUrl := include "authup.ui.apiUrl" . }}

charts/authup/templates/ui/deployment.yaml

@@ -81,7 +81,7 @@ spec:
           args: {{- include "authup.tplvalues.render" (dict "value" .Values.ui.args "context" $) | nindent 12 }}
           {{- else }}
           args:
-            - client/web
+            - client/console
             - start
           {{- end }}
           {{- end }}

charts/authup/values.yaml

@@ -406,7 +406,7 @@ server:
   # origin can obtain full-permission tokens via the per-realm web client.
   # List or comma-separated string; tpl-rendered.
   trustedOrigins: []
-  # -- Automatically append the client-web UI origin to TRUSTED_ORIGINS (removes the
+  # -- Automatically append the client-console UI origin to TRUSTED_ORIGINS (removes the
   # most common dead-login misconfiguration)
   trustedOriginsAppendUI: true
   # -- TRUST_PROXY setting. The chart defaults to one trusted hop (the ingress),
@@ -757,10 +757,10 @@ server:
     # -- Extra egress rules
     extraEgress: []
 
-## @section client-web (admin UI)
+## @section client-console (admin UI)
 
 ui:
-  # -- Deploy the client-web admin UI (false = headless IdP)
+  # -- Deploy the client-console admin UI (false = headless IdP)
   enabled: true
   # -- Number of UI replicas (fully stateless, scale freely)
   replicaCount: 1