@adonis-agora/agent-dashboard 0.4.0 → 0.6.0

package/dist/src/server/define_config.d.ts

@@ -1,69 +0,0 @@
-import type { Actor, AgentGovernanceAuthorize } from '@adonis-agora/agent';
-import type { HttpContext } from '@adonisjs/core/http';
-/**
- * An extra authorization gate for the dashboard, run AFTER the agent config's `actorResolver` has
- * resolved the caller. Return `false` (or throw) to deny — the request gets `403`. The governance
- * read-model the SPA serves spans EVERY actor's spend/usage, so most apps restrict the console beyond
- * mere authentication, e.g. `(actor) => actor.roles?.includes('ADMIN') ?? false`.
- */
-export type AgentDashboardAuthorize = (actor: Actor, ctx: HttpContext) => boolean | Promise<boolean>;
-/**
- * Optional `config('agent').dashboard` block. The dashboard reuses the agent config's `path` and
- * `actorResolver` (so it sits behind the SAME actor gating as the governance routes); this block
- * toggles it on/off, optionally overrides the mount path, and optionally adds an `authorize` gate.
- */
-export interface AgentDashboardConfig {
-    /**
-     * Mount the SPA. Default `true` — set `false` to keep the routes off entirely. Note `true` is
-     * necessary but not sufficient: the console also needs the agent's `governanceAuthorize` gate, see
-     * {@link decideDashboardMount}.
-     */
-    enabled?: boolean;
-    /** Override the mount path. Default `<agentPath>/dashboard`. */
-    path?: string;
-    /**
-     * Extra authorization run after the actor resolves. Return `false` to deny (`403`). Omit to allow
-     * any resolved actor (the default) — note this is only an EXTRA gate on the SPA shell; whether the
-     * console mounts at all, and whether its data is readable, is decided by the agent config's
-     * `governanceAuthorize`.
-     */
-    authorize?: AgentDashboardAuthorize;
-}
-export interface ResolvedAgentDashboardConfig {
-    enabled: boolean;
-    path?: string;
-    authorize?: AgentDashboardAuthorize;
-}
-/** Fill defaults for the optional dashboard config block. */
-export declare function resolveDashboardConfig(config: AgentDashboardConfig | undefined): ResolvedAgentDashboardConfig;
-/** Whether the provider registers the console's routes, and (when it refuses) what to say about it. */
-export type DashboardMountDecision = {
-    mount: true;
-} | {
-    mount: false;
-    reason: 'disabled';
-} | {
-    mount: false;
-    reason: 'no-governance-gate';
-    warning: string;
-} | {
-    mount: false;
-    reason: 'no-governance-queries';
-    warning: string;
-};
-/**
- * Decide whether to register the console's routes at all — the router-free core of the provider's
- * mount check, extracted so it can be unit tested without booting an app.
- *
- * The console is a pure consumer of the agent's cross-actor `/agent/governance/*` read routes, and
- * those routes are not mounted unless the agent config carries a `governanceAuthorize` gate. Serving
- * a shell that can only 404 its own data is worse than not serving it: the failure shows up as seven
- * dead panels at click time with nothing anywhere explaining why. So the console follows the same
- * fail-closed-by-omission rule one layer down — no gate, no routes — and says so at boot.
- *
- * This costs nothing that still works: every app affected is an app whose console is ALREADY dead in
- * every view but Quota. `dashboard.authorize` is deliberately NOT the trigger; it gates the shell,
- * not the data, and an app can set it and still have a console with nothing to render.
- */
-export declare function decideDashboardMount(enabled: boolean, governanceAuthorize: AgentGovernanceAuthorize | undefined, governanceQueries?: unknown): DashboardMountDecision;
-//# sourceMappingURL=define_config.d.ts.map

package/dist/src/server/define_config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/server/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,4BAA4B,CAK9B;AAED,uGAAuG;AACvG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,wBAAwB,GAAG,SAAS,EACzD,iBAAiB,CAAC,EAAE,OAAO,GAC1B,sBAAsB,CAgBxB"}

package/dist/src/server/define_config.js

@@ -1,56 +0,0 @@
-/** Fill defaults for the optional dashboard config block. */
-export function resolveDashboardConfig(config) {
-    const resolved = { enabled: config?.enabled ?? true };
-    if (config?.path !== undefined)
-        resolved.path = config.path;
-    if (config?.authorize !== undefined)
-        resolved.authorize = config.authorize;
-    return resolved;
-}
-/**
- * The exact wording the provider logs when it declines to mount. Mirrors the agent provider's own
- * governance boot warning — same three facts, same vocabulary — so a reader who sees one recognises
- * the other.
- */
-const NO_GOVERNANCE_GATE_WARNING = '[@adonis-agora/agent-dashboard] the governance console was NOT mounted: every panel but Quota reads the cross-actor `/agent/governance/*` routes, and those are themselves not mounted because no `governanceAuthorize` gate is configured — so the console would load and then fail on every panel. Set `governanceAuthorize` in config/agent.ts (e.g. an ADMIN check) to mount the routes and this console gated, or `governanceAuthorize: () => true` to deliberately restore the old behaviour of letting ANY authenticated actor read them. `GET /agent/approvals/mine` is unaffected — it stays mounted and scoped to the calling actor. To keep the console off on purpose and silence this, set `dashboard: { enabled: false }`.';
-/**
- * The wording logged when the read-model itself was turned off. Deliberately distinct from
- * {@link NO_GOVERNANCE_GATE_WARNING}: both produce the same dead console, and an operator staring at
- * a 404 must be able to tell from the log ALONE which of the two knobs is responsible. A shared
- * "governance is not configured" message would recreate exactly the diagnosability problem this
- * check exists to remove.
- */
-const NO_GOVERNANCE_QUERIES_WARNING = '[@adonis-agora/agent-dashboard] the governance console was NOT mounted: `governanceQueries` is set to `false` in config/agent.ts, so the cross-actor read-model was never built and the `/agent/governance/*` routes it serves do not exist — the console would load and then fail on every panel but Quota. A `governanceAuthorize` gate is NOT the missing piece here; it is already configured. Remove `governanceQueries: false` (omit it to get the Lucid read-model when the main store is Lucid, or pass a store/factory explicitly) to mount the read-model and this console. To keep the console off on purpose and silence this, set `dashboard: { enabled: false }`.';
-/**
- * Decide whether to register the console's routes at all — the router-free core of the provider's
- * mount check, extracted so it can be unit tested without booting an app.
- *
- * The console is a pure consumer of the agent's cross-actor `/agent/governance/*` read routes, and
- * those routes are not mounted unless the agent config carries a `governanceAuthorize` gate. Serving
- * a shell that can only 404 its own data is worse than not serving it: the failure shows up as seven
- * dead panels at click time with nothing anywhere explaining why. So the console follows the same
- * fail-closed-by-omission rule one layer down — no gate, no routes — and says so at boot.
- *
- * This costs nothing that still works: every app affected is an app whose console is ALREADY dead in
- * every view but Quota. `dashboard.authorize` is deliberately NOT the trigger; it gates the shell,
- * not the data, and an app can set it and still have a console with nothing to render.
- */
-export function decideDashboardMount(enabled, governanceAuthorize, governanceQueries) {
-    if (!enabled)
-        return { mount: false, reason: 'disabled' };
-    if (governanceAuthorize === undefined) {
-        return { mount: false, reason: 'no-governance-gate', warning: NO_GOVERNANCE_GATE_WARNING };
-    }
-    // ONLY an explicit `false` is decidable here. `undefined` does NOT mean "no read-model": the agent
-    // provider's `#resolveGovernance` defaults it to the Lucid read-model whenever the main store is
-    // Lucid, and reproducing that resolution would duplicate provider logic in the dashboard.
-    if (governanceQueries === false) {
-        return {
-            mount: false,
-            reason: 'no-governance-queries',
-            warning: NO_GOVERNANCE_QUERIES_WARNING,
-        };
-    }
-    return { mount: true };
-}
-//# sourceMappingURL=define_config.js.map

package/dist/src/server/define_config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/server/define_config.ts"],"names":[],"mappings":"AA2CA,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,MAAM,QAAQ,GAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACpF,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;GAIG;AACH,MAAM,0BAA0B,GAC9B,0sBAA0sB,CAAC;AAE7sB;;;;;;GAMG;AACH,MAAM,6BAA6B,GACjC,ipBAAipB,CAAC;AAEppB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,mBAAyD,EACzD,iBAA2B;IAE3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC7F,CAAC;IACD,mGAAmG;IACnG,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,6BAA6B;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/src/server/gate.d.ts

@@ -1,33 +0,0 @@
-import type { ActorResolver } from '@adonis-agora/agent';
-import type { HttpContext } from '@adonisjs/core/http';
-import type { AgentDashboardAuthorize } from './define_config.js';
-/** The outcome of the dashboard access gate: proceed, or deny with an HTTP status + message. */
-export type DashboardGateVerdict = {
-    ok: true;
-} | {
-    ok: false;
-    status: 401 | 403;
-    error: string;
-};
-/**
- * Decide whether a request may reach the dashboard, WITHOUT touching the response — so it is unit
- * testable free of the AdonisJS router/app: resolve the actor through the agent config's resolver
- * (missing/failed → `401`), then run the optional `authorize` gate over the resolved actor
- * (denied/threw → `403`).
- *
- * This gates the SPA **shell**, and only the shell. It is NOT what decides whether the console's data
- * is readable, and it is no longer the last line of defence it once had to be:
- *
- * - Whether the console mounts at all is decided earlier, by {@link decideDashboardMount} — the
- *   routes are not registered unless the agent config carries a `governanceAuthorize` gate AND its
- *   `governanceQueries` read-model exists. So this function never runs for a console that could only
- *   404 its own panels.
- * - Whether the DATA is readable is decided by the agent's own `governanceAuthorize` on the
- *   `/agent/governance/*` routes, not here. Omitting `authorize` while a gate is configured leaves
- *   the shell open to any resolved actor but exposes no cross-actor data.
- *
- * Omitting BOTH the resolver and `authorize` would expose the shell to any request; the provider is
- * expected to short-circuit on a missing resolver via the `401` here.
- */
-export declare function evaluateDashboardGate(ctx: HttpContext, actorResolver: ActorResolver | undefined, authorize?: AgentDashboardAuthorize): Promise<DashboardGateVerdict>;
-//# sourceMappingURL=gate.d.ts.map

package/dist/src/server/gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/server/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElE,gGAAgG;AAChG,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,SAAS,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,oBAAoB,CAAC,CA4B/B"}

package/dist/src/server/gate.js

@@ -1,52 +0,0 @@
-/**
- * Decide whether a request may reach the dashboard, WITHOUT touching the response — so it is unit
- * testable free of the AdonisJS router/app: resolve the actor through the agent config's resolver
- * (missing/failed → `401`), then run the optional `authorize` gate over the resolved actor
- * (denied/threw → `403`).
- *
- * This gates the SPA **shell**, and only the shell. It is NOT what decides whether the console's data
- * is readable, and it is no longer the last line of defence it once had to be:
- *
- * - Whether the console mounts at all is decided earlier, by {@link decideDashboardMount} — the
- *   routes are not registered unless the agent config carries a `governanceAuthorize` gate AND its
- *   `governanceQueries` read-model exists. So this function never runs for a console that could only
- *   404 its own panels.
- * - Whether the DATA is readable is decided by the agent's own `governanceAuthorize` on the
- *   `/agent/governance/*` routes, not here. Omitting `authorize` while a gate is configured leaves
- *   the shell open to any resolved actor but exposes no cross-actor data.
- *
- * Omitting BOTH the resolver and `authorize` would expose the shell to any request; the provider is
- * expected to short-circuit on a missing resolver via the `401` here.
- */
-export async function evaluateDashboardGate(ctx, actorResolver, authorize) {
-    if (actorResolver === undefined) {
-        return { ok: false, status: 401, error: 'no actor resolver configured' };
-    }
-    let actor;
-    try {
-        actor = await actorResolver.resolve(ctx);
-    }
-    catch (error) {
-        return {
-            ok: false,
-            status: 401,
-            error: error instanceof Error ? error.message : 'unauthorized',
-        };
-    }
-    if (authorize !== undefined) {
-        try {
-            if (!(await authorize(actor, ctx))) {
-                return { ok: false, status: 403, error: 'forbidden' };
-            }
-        }
-        catch (error) {
-            return {
-                ok: false,
-                status: 403,
-                error: error instanceof Error ? error.message : 'forbidden',
-            };
-        }
-    }
-    return { ok: true };
-}
-//# sourceMappingURL=gate.js.map

package/dist/src/server/gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/server/gate.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,aAAwC,EACxC,SAAmC;IAEnC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAoD,CAAC;IACzD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;aAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/src/server/paths.d.ts

@@ -1,35 +0,0 @@
-/**
- * Pure path/asset helpers for the dashboard provider — extracted so they can be unit-tested without
- * booting an AdonisJS app. The provider composes these; it holds only the router wiring + I/O.
- */
-/** Collapse duplicate slashes and strip leading/trailing ones: `/agent//` → `agent`. */
-export declare function trimSlashes(path: string): string;
-/** The agent API base as an absolute path with a single leading slash: `agent` → `/agent`. */
-export declare function apiBaseFor(agentPath: string): string;
-/**
- * The canonical dashboard mount path (no trailing slash), default `<agentPath>/dashboard`. A caller
- * may override with an explicit `dashboardPath`; both are normalized to a single leading slash.
- */
-export declare function mountPathFor(agentPath: string, dashboardPath?: string): string;
-/** MIME type for a filename by extension; `application/octet-stream` for anything unknown. */
-export declare function contentTypeFor(filename: string): string;
-/**
- * Reject a wildcard asset request that tries to escape the SPA root via `..` or an absolute path.
- * Returns the safe, normalized relative segments (never starting with `..`), or `null` to deny.
- */
-export declare function safeAssetSegments(wildcard: string | string[] | undefined): string[] | null;
-/**
- * Inject the resolved agent API base into the served `index.html` as a global the SPA reads before
- * boot, so the client calls the exact base the provider mounted (no build-time coupling). Idempotent
- * per response — inserted right before `</head>`.
- */
-export declare function injectApiBase(html: string, apiBase: string): string;
-/**
- * Inject a `<base href="${mount}/">` as the FIRST thing inside `<head>`, so the SPA's relative
- * `./assets/*` URLs (Vite `base: './'`) resolve against the mount directory no matter whether the
- * browser's URL carries a trailing slash. This replaces the old trailing-slash redirect, which the
- * AdonisJS router (it normalizes trailing slashes) turned into a duplicate-route crash. `mount` is a
- * leading-slash, no-trailing-slash path (e.g. `/agent/dashboard`).
- */
-export declare function injectBaseHref(html: string, mount: string): string;
-//# sourceMappingURL=paths.d.ts.map

package/dist/src/server/paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/server/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAM9E;AAsBD,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,IAAI,CAU1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAInE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQlE"}

package/dist/src/server/paths.js

@@ -1,94 +0,0 @@
-/**
- * Pure path/asset helpers for the dashboard provider — extracted so they can be unit-tested without
- * booting an AdonisJS app. The provider composes these; it holds only the router wiring + I/O.
- */
-/** Collapse duplicate slashes and strip leading/trailing ones: `/agent//` → `agent`. */
-export function trimSlashes(path) {
-    return path.replace(/\/+/g, '/').replace(/^\/+|\/+$/g, '');
-}
-/** The agent API base as an absolute path with a single leading slash: `agent` → `/agent`. */
-export function apiBaseFor(agentPath) {
-    const trimmed = trimSlashes(agentPath);
-    return trimmed === '' ? '/' : `/${trimmed}`;
-}
-/**
- * The canonical dashboard mount path (no trailing slash), default `<agentPath>/dashboard`. A caller
- * may override with an explicit `dashboardPath`; both are normalized to a single leading slash.
- */
-export function mountPathFor(agentPath, dashboardPath) {
-    if (dashboardPath !== undefined && trimSlashes(dashboardPath) !== '') {
-        return `/${trimSlashes(dashboardPath)}`;
-    }
-    const trimmed = trimSlashes(agentPath);
-    return trimmed === '' ? '/dashboard' : `/${trimmed}/dashboard`;
-}
-const CONTENT_TYPES = {
-    html: 'text/html; charset=utf-8',
-    js: 'text/javascript; charset=utf-8',
-    mjs: 'text/javascript; charset=utf-8',
-    css: 'text/css; charset=utf-8',
-    json: 'application/json; charset=utf-8',
-    svg: 'image/svg+xml',
-    png: 'image/png',
-    jpg: 'image/jpeg',
-    jpeg: 'image/jpeg',
-    gif: 'image/gif',
-    webp: 'image/webp',
-    ico: 'image/x-icon',
-    woff: 'font/woff',
-    woff2: 'font/woff2',
-    ttf: 'font/ttf',
-    map: 'application/json; charset=utf-8',
-    txt: 'text/plain; charset=utf-8',
-};
-/** MIME type for a filename by extension; `application/octet-stream` for anything unknown. */
-export function contentTypeFor(filename) {
-    const dot = filename.lastIndexOf('.');
-    const ext = dot === -1 ? '' : filename.slice(dot + 1).toLowerCase();
-    return CONTENT_TYPES[ext] ?? 'application/octet-stream';
-}
-/**
- * Reject a wildcard asset request that tries to escape the SPA root via `..` or an absolute path.
- * Returns the safe, normalized relative segments (never starting with `..`), or `null` to deny.
- */
-export function safeAssetSegments(wildcard) {
-    const parts = Array.isArray(wildcard) ? wildcard : (wildcard ?? '').split('/');
-    const segments = [];
-    for (const raw of parts) {
-        const part = raw.trim();
-        if (part === '' || part === '.')
-            continue;
-        if (part === '..' || part.includes('\0') || part.includes('\\'))
-            return null;
-        segments.push(part);
-    }
-    return segments;
-}
-/**
- * Inject the resolved agent API base into the served `index.html` as a global the SPA reads before
- * boot, so the client calls the exact base the provider mounted (no build-time coupling). Idempotent
- * per response — inserted right before `</head>`.
- */
-export function injectApiBase(html, apiBase) {
-    const tag = `<script>window.__AGENT_DASHBOARD_BASE__=${JSON.stringify(apiBase)}</script>`;
-    if (html.includes('</head>'))
-        return html.replace('</head>', `${tag}</head>`);
-    return `${tag}${html}`;
-}
-/**
- * Inject a `<base href="${mount}/">` as the FIRST thing inside `<head>`, so the SPA's relative
- * `./assets/*` URLs (Vite `base: './'`) resolve against the mount directory no matter whether the
- * browser's URL carries a trailing slash. This replaces the old trailing-slash redirect, which the
- * AdonisJS router (it normalizes trailing slashes) turned into a duplicate-route crash. `mount` is a
- * leading-slash, no-trailing-slash path (e.g. `/agent/dashboard`).
- */
-export function injectBaseHref(html, mount) {
-    const tag = `<base href="${mount}/">`;
-    const headOpen = html.match(/<head[^>]*>/i);
-    if (headOpen?.index !== undefined) {
-        const at = headOpen.index + headOpen[0].length;
-        return html.slice(0, at) + tag + html.slice(at);
-    }
-    return `${tag}${html}`;
-}
-//# sourceMappingURL=paths.js.map

package/dist/src/server/paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/server/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,aAAsB;IACpE,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,OAAO,YAAY,CAAC;AACjE,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,0BAA0B;IAChC,EAAE,EAAE,gCAAgC;IACpC,GAAG,EAAE,gCAAgC;IACrC,GAAG,EAAE,yBAAyB;IAC9B,IAAI,EAAE,iCAAiC;IACvC,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,iCAAiC;IACtC,GAAG,EAAE,2BAA2B;CACjC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,MAAM,GAAG,GAAG,2CAA2C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC;IAC1F,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;IAC9E,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IACxD,MAAM,GAAG,GAAG,eAAe,KAAK,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AACzB,CAAC"}