@adonis-agora/agent 0.25.5 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @adonis-agora/agent
 
+## 0.26.0
+
+### Minor Changes
+
+- [#90](https://github.com/DavideCarvalho/adonis-agora-agent/pull/90) [`c540ed5`](https://github.com/DavideCarvalho/adonis-agora-agent/commit/c540ed5884d8dc2ad4a22c0f29f9ec9c68ace6be) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Governance console: a refused request now gets a real page instead of `{"error":"forbidden"}`.
+  
+  Opening the console without permission used to answer the browser with JSON. Both providers
+  (the embedded `@adonis-agora/agent/dashboard_provider` and the standalone
+  `@adonis-agora/agent-dashboard`) now serve a built-in access-denied page in the console's own
+  visual language — the status, a sentence explaining the refusal and a "Back to app" link.
+  Statuses are unchanged (`401` when no actor resolves, `403` when `authorize` denies), and a
+  redirect written by `onUnauthenticated`/`authorize` still wins.
+  
+  The page carries no inline `<script>`, so a nonce'd `script-src` CSP cannot break it; its inline
+  `<style>` takes `@adonisjs/shield`'s request nonce when one exists.
+  
+  New `dashboard.accessDenied` option on `config/agent.ts` to customise it — an object (`brand`,
+  `title`, `message`, `homeHref`, `accent`, labels) to tweak the built-in page, or a function
+  `(info, ctx) => html | void` to render it yourself or redirect. `@adonis-agora/agent/dashboard`
+  exports the shared `answerDashboardDenial` + `renderAccessDeniedPage`.
+
 ## 0.25.5
 
 ### Patch Changes

package/dist/providers/dashboard_provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAiB/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;;IACxB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAc3C,IAAI,kBAqDT;CAgEF"}
+{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAmB/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;;IACxB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAc3C,IAAI,kBA0ET;CAiEF"}

package/dist/providers/dashboard_provider.js

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { resolve as resolvePath } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { apiBaseFor, contentTypeFor, decideDashboardMount, evaluateDashboardGate, injectApiBase, injectBaseHref, mountPathFor, resolveDashboardConfig, safeAssetSegments, } from '../src/dashboard/index.js';
+import { answerDashboardDenial, apiBaseFor, contentTypeFor, decideDashboardMount, evaluateDashboardGate, injectApiBase, injectBaseHref, mountPathFor, resolveDashboardConfig, safeAssetSegments, } from '../src/dashboard/index.js';
 /**
  * Serves the `@adonis-agora/agent-dashboard` governance SPA **from this package's own build** — no
  * separate install, no separate provider registration. `node ace configure @adonis-agora/agent`
@@ -88,20 +88,25 @@ export default class DashboardProvider {
         const mount = mountPathFor(agentPath, dashboardConfig.path);
         const actorResolver = agentConfig.actorResolver;
         const authorize = dashboardConfig.authorize;
+        // What a refused browser sees — the built-in access-denied page unless the host customised it.
+        const denial = {
+            basePath: mount,
+            accessDenied: dashboardConfig.accessDenied,
+        };
         // The SPA shell, served at the bare mount. We do NOT redirect to a trailing-slash variant: the
         // AdonisJS router normalizes trailing slashes, so `mount` and `${mount}/` are the SAME route
         // pattern — registering both throws "Duplicate route". Instead `sendIndex` injects a
         // `<base href="${mount}/">`, so the SPA's relative `./assets/*` URLs resolve against the mount
         // directory regardless of whether the browser's URL carries a trailing slash.
         router.get(mount, async (ctx) => {
-            if (!(await this.#gate(ctx, actorResolver, authorize, dashboardConfig.onUnauthenticated)))
+            if (!(await this.#gate(ctx, actorResolver, authorize, dashboardConfig.onUnauthenticated, denial)))
                 return;
             await this.#sendIndex(ctx, apiBase, mount);
         });
         // Built assets (JS/CSS/fonts/...), with an index fallback for any unmatched path so the
         // client-rendered console still boots on a deep link.
         router.get(`${mount}/*`, async (ctx) => {
-            if (!(await this.#gate(ctx, actorResolver, authorize, dashboardConfig.onUnauthenticated)))
+            if (!(await this.#gate(ctx, actorResolver, authorize, dashboardConfig.onUnauthenticated, denial)))
                 return;
             const segments = safeAssetSegments(ctx.params['*']);
             if (segments === null) {
@@ -114,18 +119,17 @@ export default class DashboardProvider {
      * Resolve the actor through the agent config's resolver, mirroring the governance routes, then run
      * the optional `authorize` gate. Returns `true` to proceed; replies `401` on a missing/failed
      * resolver and `403` when `authorize` denies the resolved actor. The decision itself lives in the
-     * router-free {@link evaluateDashboardGate} so it can be unit tested; this only writes the response —
-     * and, mirroring `@adonis-agora/durable`'s dashboard, ONLY when neither `onUnauthenticated` nor
-     * `authorize` already answered the request themselves: if either set a `location` header (typically
-     * via `ctx.response.redirect(...)`, e.g. to the app's own login page), that redirect stands and this
-     * skips writing its own `401`/`403` JSON on top of it.
+     * router-free {@link evaluateDashboardGate} so it can be unit tested; this only writes the response
+     * — the access-denied PAGE (a browser is what hits these routes), via the shared
+     * {@link answerDashboardDenial} — and, mirroring `@adonis-agora/durable`'s dashboard, ONLY when
+     * neither `onUnauthenticated` nor `authorize` already answered the request themselves: if either
+     * set a `location` header (typically via `ctx.response.redirect(...)`, e.g. to the app's own login
+     * page), that redirect stands and this skips writing its own `401`/`403` page on top of it.
      */
-    async #gate(ctx, actorResolver, authorize, onUnauthenticated) {
+    async #gate(ctx, actorResolver, authorize, onUnauthenticated, denial) {
         const verdict = await evaluateDashboardGate(ctx, actorResolver, authorize, !this.app.inProduction, onUnauthenticated);
         if (!verdict.ok) {
-            if (ctx.response.getHeader('location'))
-                return false;
-            ctx.response.status(verdict.status).json({ error: verdict.error });
+            await answerDashboardDenial(ctx, verdict, denial);
             return false;
         }
         return true;

package/dist/providers/dashboard_provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard_provider.js","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAGL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAInC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACd,GAAG;IAAzB,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD;;;;;OAKG;IACH,OAAO,CAAqB;IAC5B,aAAa;QACX,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAc,OAAO,EAAE,EAAiB,CAAC,CAAC;QACjF,8FAA8F;QAC9F,mGAAmG;QACnG,MAAM,eAAe,GAAG,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEtE,yFAAyF;QACzF,mGAAmG;QACnG,mGAAmG;QACnG,MAAM,QAAQ,GAAG,oBAAoB,CACnC,eAAe,CAAC,OAAO,EACvB,WAAW,CAAC,mBAAmB,EAC/B,WAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC;QAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;QAEhD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;QAE5C,+FAA+F;QAC/F,6FAA6F;QAC7F,qFAAqF;QACrF,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;gBACvF,OAAO;YACT,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,wFAAwF;QACxF,sDAAsD;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;gBACvF,OAAO;YACT,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CACT,GAAgB,EAChB,aAAwC,EACxC,SAAmC,EACnC,iBAAqD;QAErD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,GAAG,EACH,aAAa,EACb,SAAS,EACT,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EACtB,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAa;QAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACrF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,UAAU,CACd,GAAgB,EAChB,QAAkB,EAClB,OAAe,EACf,KAAa;QAEb,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;YAC9E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"dashboard_provider.js","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAGL,qBAAqB,EACrB,UAAU,EACV,cAAc,EAEd,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAInC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACd,GAAG;IAAzB,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD;;;;;OAKG;IACH,OAAO,CAAqB;IAC5B,aAAa;QACX,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAc,OAAO,EAAE,EAAiB,CAAC,CAAC;QACjF,8FAA8F;QAC9F,mGAAmG;QACnG,MAAM,eAAe,GAAG,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEtE,yFAAyF;QACzF,mGAAmG;QACnG,mGAAmG;QACnG,MAAM,QAAQ,GAAG,oBAAoB,CACnC,eAAe,CAAC,OAAO,EACvB,WAAW,CAAC,mBAAmB,EAC/B,WAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC;QAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;QAEhD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;QAC5C,+FAA+F;QAC/F,MAAM,MAAM,GAA2B;YACrC,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,eAAe,CAAC,YAAY;SAC3C,CAAC;QAEF,+FAA+F;QAC/F,6FAA6F;QAC7F,qFAAqF;QACrF,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9B,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAChB,GAAG,EACH,aAAa,EACb,SAAS,EACT,eAAe,CAAC,iBAAiB,EACjC,MAAM,CACP,CAAC;gBAEF,OAAO;YACT,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,wFAAwF;QACxF,sDAAsD;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAChB,GAAG,EACH,aAAa,EACb,SAAS,EACT,eAAe,CAAC,iBAAiB,EACjC,MAAM,CACP,CAAC;gBAEF,OAAO;YACT,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,CACT,GAAgB,EAChB,aAAwC,EACxC,SAA8C,EAC9C,iBAAgE,EAChE,MAA8B;QAE9B,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,GAAG,EACH,aAAa,EACb,SAAS,EACT,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EACtB,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAa;QAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACrF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,UAAU,CACd,GAAgB,EAChB,QAAkB,EAClB,OAAe,EACf,KAAa;QAEb,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;YAC9E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/src/dashboard/access_denied_page.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
+ * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * existed the guard answered every denial with the JSON it answers the API with
+ * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
+ * thing for a human staring at a browser tab.
+ *
+ * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
+ * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
+ * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
+ *
+ * Every string the host can supply ({@link AccessDeniedPageOptions}) is HTML-escaped on the way in.
+ * They are developer-controlled config values, not user input — but escaping them costs nothing and
+ * removes the one class of bug a "just interpolate it" template would invite.
+ *
+ * The visual language (Aviary neutrals, the console's own accent, mono eyebrow over a sans body)
+ * mirrors the agent SPA so the refusal reads as part of the same product, not a server default.
+ *
+ * Ported from `@adonis-agora/payments` (also in `@adonis-agora/durable`, `@adonis-agora/media`, `@adonis-agora/agent` and
+ * `@adonis-agora/telescope` with only {@link CONSOLE} changed, so the Agora consoles share ONE
+ * refusal story rather than each inventing its own.
+ */
+/** Why the guard refused. Drives the default title/message and which buttons make sense. */
+export type AccessDeniedReason = 
+/** Nobody is signed in (a `401`): offer the login page when one exists. */
+'unauthenticated'
+/** Somebody is signed in but `authorize` said no (a `403`). */
+ | 'forbidden'
+/** `dashboardAuth` runs in Mode A only and there is no session — the host app must mint one. */
+ | 'session-required';
+/** What the provider knows about the refusal — handed to a custom renderer and to the default page. */
+export interface AccessDeniedInfo {
+    /** The HTTP status the page is served with. */
+    status: 401 | 403;
+    reason: AccessDeniedReason;
+    /** The console's mount path (`/agent/dashboard`; `''` when mounted at the root). */
+    basePath: string;
+    /** The built-in login page, present only when `dashboardAuth.login` is configured. */
+    loginHref?: string;
+    /** A developer-facing detail (e.g. a thrown hook's message). Providers set it OUTSIDE production only. */
+    detail?: string;
+    /** The request's CSP nonce, applied to the inline `<style>` so a nonce'd `style-src` keeps the page styled. */
+    nonce?: string;
+}
+/**
+ * Knobs for the built-in page — the `accessDenied` config option in its OBJECT form. Every field is
+ * optional; omit the option entirely for the defaults.
+ */
+export interface AccessDeniedPageOptions {
+    /** Console name in the eyebrow and `<title>`. Default: the console's own name (`Agent`). */
+    brand?: string;
+    /** Heading. Default depends on {@link AccessDeniedInfo.reason}. */
+    title?: string;
+    /** The sentence under the heading. Default depends on the reason. */
+    message?: string;
+    /** Where "Back to app" points. Default `/`; `false` hides the button. */
+    homeHref?: string | false;
+    /** Label of the "Back to app" button. */
+    homeLabel?: string;
+    /** Where "Sign in" points. Default: the built-in login page when one exists; `false` hides it. */
+    loginHref?: string | false;
+    /** Label of the "Sign in" button. */
+    loginLabel?: string;
+    /** Accent colour (any CSS colour). Default: the console's own accent. */
+    accent?: string;
+}
+/**
+ * The `accessDenied` config option in its FUNCTION form: render the page yourself. Return an HTML
+ * string and the provider serves it (with the refusal's status, `text/html`, `no-store`). Return
+ * nothing after answering the request yourself — a redirect to your own login page, most commonly —
+ * and the provider stands down. Return nothing WITHOUT answering and the default page is served, so
+ * the hook is safe to use for side effects (logging) alone.
+ *
+ * `Ctx` is the host framework's HTTP context — the provider passes AdonisJS's `HttpContext` through
+ * untouched; it is generic here so this module stays framework-light and unit-testable.
+ */
+export type AccessDeniedRenderer<Ctx = unknown> = (info: AccessDeniedInfo, ctx: Ctx) => string | undefined | null | void | Promise<string | undefined | null | void>;
+/** The `accessDenied` config option: tweak the built-in page, or replace it. */
+export type AccessDeniedOption<Ctx = unknown> = AccessDeniedPageOptions | AccessDeniedRenderer<Ctx>;
+/** This console's identity — the ONLY thing that differs between the Agora ports of this file. */
+export declare const CONSOLE: {
+    readonly brand: 'Agent';
+    readonly accent: '#a78bfa';
+    readonly packageName: '@adonis-agora/agent';
+};
+/** Escape the five characters that matter inside HTML text and double-quoted attributes. */
+export declare function escapeHtml(value: string): string;
+/**
+ * Render the built-in page. Pure: same `info` + `options` in, same HTML out — so it is trivially
+ * snapshot/regex testable and safe to call from anywhere (the provider, a test, a host that wants
+ * to embed the default page inside its own layout).
+ */
+export declare function renderAccessDeniedPage(info: AccessDeniedInfo, options?: AccessDeniedPageOptions): string;
+/**
+ * Resolve WHAT to serve for a refusal, honouring the host's `accessDenied` option in either form.
+ * Returns the HTML to send, or `null` when a custom renderer already answered the request itself
+ * (`answered()` reports whether it did — the provider wires that to "a `location` header or a body
+ * is already set"). Framework-light: knows nothing about the HTTP context beyond passing it through.
+ */
+export declare function resolveAccessDeniedPage<Ctx>(info: AccessDeniedInfo, option: AccessDeniedOption<Ctx> | null | undefined, ctx: Ctx, answered: () => boolean): Promise<string | null>;
+//# sourceMappingURL=access_denied_page.d.ts.map

package/dist/src/dashboard/access_denied_page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access_denied_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB;AAC5B,2EAA2E;AACzE,iBAAiB;AACnB,+DAA+D;GAC7D,WAAW;AACb,gGAAgG;GAC9F,kBAAkB,CAAC;AAEvB,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC1B,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,CAAC,GAAG,GAAG,OAAO,IAAI,CAChD,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,GAAG,KAEL,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,CAAC,GAAG,GAAG,OAAO,IAAI,uBAAuB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEpG,kGAAkG;AAClG,eAAO,MAAM,OAAO;aAClB,KAAK,EAAE,OAAO;aACd,MAAM,EAAE,SAAS;aACjB,WAAW,EAAE,qBAAqB;CAC1B,CAAC;AAmBX,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAyBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAqLR;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAC/C,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,OAAO,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB"}

package/dist/src/dashboard/access_denied_page.js

@@ -0,0 +1,266 @@
+/**
+ * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
+ * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * existed the guard answered every denial with the JSON it answers the API with
+ * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
+ * thing for a human staring at a browser tab.
+ *
+ * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
+ * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
+ * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
+ *
+ * Every string the host can supply ({@link AccessDeniedPageOptions}) is HTML-escaped on the way in.
+ * They are developer-controlled config values, not user input — but escaping them costs nothing and
+ * removes the one class of bug a "just interpolate it" template would invite.
+ *
+ * The visual language (Aviary neutrals, the console's own accent, mono eyebrow over a sans body)
+ * mirrors the agent SPA so the refusal reads as part of the same product, not a server default.
+ *
+ * Ported from `@adonis-agora/payments` (also in `@adonis-agora/durable`, `@adonis-agora/media`, `@adonis-agora/agent` and
+ * `@adonis-agora/telescope` with only {@link CONSOLE} changed, so the Agora consoles share ONE
+ * refusal story rather than each inventing its own.
+ */
+/** This console's identity — the ONLY thing that differs between the Agora ports of this file. */
+export const CONSOLE = {
+    brand: 'Agent',
+    accent: '#a78bfa',
+    packageName: '@adonis-agora/agent',
+};
+const DEFAULT_COPY = {
+    unauthenticated: {
+        title: 'Sign in required',
+        message: 'You need to be signed in to open this console.',
+    },
+    forbidden: {
+        title: 'Access denied',
+        message: 'Your account is not allowed to open this console. If that looks wrong, ask an administrator to grant you access.',
+    },
+    'session-required': {
+        title: 'Open this console from your app',
+        message: 'This console only accepts a session minted by your application. Go back to the app and open the console from there.',
+    },
+};
+/** Escape the five characters that matter inside HTML text and double-quoted attributes. */
+export function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+/**
+ * Accept only a same-origin, root-relative path for a button `href` — the same open-redirect rule
+ * `sanitizeReturnTo` applies to `returnTo`. A host-supplied absolute URL is still a developer's
+ * choice, so it is allowed; what is refused is anything that could smuggle a `javascript:` scheme.
+ */
+function safeHref(candidate) {
+    const trimmed = candidate.trim();
+    if (trimmed === '')
+        return null;
+    if (/^(https?:)?\/\//i.test(trimmed))
+        return trimmed;
+    if (trimmed.startsWith('/'))
+        return trimmed;
+    return null;
+}
+/** Only a plausible CSS colour token reaches the stylesheet; anything else falls back to the accent. */
+function safeColor(candidate) {
+    return /^[#a-zA-Z0-9(),.%\s-]+$/.test(candidate) ? candidate : CONSOLE.accent;
+}
+const LOCK_ICON = '<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></svg>';
+const KEY_ICON = '<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="7.5" cy="15.5" r="4.5"/><path d="m21 2-9.6 9.6"/><path d="m15.5 7.5 3 3L22 7l-3-3"/></svg>';
+/**
+ * Render the built-in page. Pure: same `info` + `options` in, same HTML out — so it is trivially
+ * snapshot/regex testable and safe to call from anywhere (the provider, a test, a host that wants
+ * to embed the default page inside its own layout).
+ */
+export function renderAccessDeniedPage(info, options = {}) {
+    const copy = DEFAULT_COPY[info.reason];
+    const brand = escapeHtml(options.brand ?? CONSOLE.brand);
+    const title = escapeHtml(options.title ?? copy.title);
+    const message = escapeHtml(options.message ?? copy.message);
+    const accent = safeColor(options.accent ?? CONSOLE.accent);
+    const nonceAttr = info.nonce !== undefined ? ` nonce="${escapeHtml(info.nonce)}"` : '';
+    const loginHref = options.loginHref === false
+        ? null
+        : (safeHref(options.loginHref ?? info.loginHref ?? '') ?? null);
+    const homeHref = options.homeHref === false ? null : safeHref(options.homeHref ?? '/');
+    const buttons = [];
+    if (loginHref !== null && info.reason !== 'forbidden') {
+        buttons.push(`<a class="btn primary" href="${escapeHtml(loginHref)}">${KEY_ICON}${escapeHtml(options.loginLabel ?? 'Sign in')}</a>`);
+    }
+    if (homeHref !== null) {
+        buttons.push(`<a class="btn${buttons.length === 0 ? ' primary' : ''}" href="${escapeHtml(homeHref)}">${escapeHtml(options.homeLabel ?? 'Back to app')}</a>`);
+    }
+    if (loginHref !== null && info.reason === 'forbidden') {
+        // A forbidden user might simply be the wrong user: offer a way to switch accounts, second.
+        buttons.push(`<a class="btn" href="${escapeHtml(loginHref)}">${escapeHtml(options.loginLabel ?? 'Sign in as someone else')}</a>`);
+    }
+    const detail = info.detail !== undefined && info.detail !== ''
+        ? `\n    <p class="detail">${escapeHtml(info.detail)}</p>`
+        : '';
+    const actions = buttons.length > 0 ? `\n    <div class="actions">${buttons.join('')}</div>` : '';
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex, nofollow" />
+<title>${title} — ${brand}</title>
+<style${nonceAttr}>
+  :root {
+    color-scheme: dark;
+    --bg: #09090b;
+    --panel: #0c0c0f;
+    --panel-2: #101017;
+    --line: #1c1c22;
+    --text: #e7e7ea;
+    --muted: #76767f;
+    --bad: #f87171;
+    --accent: ${accent};
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 24px;
+    background:
+      radial-gradient(900px 480px at 50% -10%, color-mix(in srgb, var(--accent) 9%, transparent), transparent 70%),
+      var(--bg);
+    color: var(--text);
+    font: 15px/1.6 "Space Grotesk", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  .card {
+    position: relative;
+    overflow: hidden;
+    width: 100%;
+    max-width: 440px;
+    padding: 36px 32px 28px;
+    background: var(--panel);
+    border: 1px solid var(--line);
+    border-radius: 12px;
+    box-shadow: 0 30px 60px -24px rgb(0 0 0 / 0.7);
+  }
+  .card::before {
+    content: "";
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 2px;
+    background: linear-gradient(90deg, var(--accent), transparent 80%);
+  }
+  .eyebrow {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin: 0 0 22px;
+    font: 11px/1 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--muted);
+  }
+  .eyebrow .brand { color: var(--accent); }
+  .eyebrow .status {
+    margin-left: auto;
+    padding: 4px 7px;
+    border: 1px solid var(--line);
+    border-radius: 4px;
+    color: var(--bad);
+    letter-spacing: 0.08em;
+  }
+  .icon {
+    display: grid;
+    place-items: center;
+    width: 40px;
+    height: 40px;
+    margin-bottom: 18px;
+    border-radius: 10px;
+    background: color-mix(in srgb, var(--accent) 12%, transparent);
+    color: var(--accent);
+  }
+  h1 {
+    margin: 0 0 8px;
+    font-size: 22px;
+    font-weight: 600;
+    letter-spacing: -0.01em;
+  }
+  p { margin: 0; color: var(--muted); }
+  .detail {
+    margin-top: 14px;
+    padding: 10px 12px;
+    border: 1px solid var(--line);
+    border-radius: 6px;
+    background: var(--panel-2);
+    font: 12px/1.5 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    color: var(--text);
+    overflow-wrap: anywhere;
+  }
+  .actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    margin-top: 26px;
+  }
+  .btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 9px 14px;
+    border: 1px solid var(--line);
+    border-radius: 6px;
+    background: var(--panel-2);
+    color: var(--text);
+    font-size: 13px;
+    font-weight: 500;
+    text-decoration: none;
+  }
+  .btn:hover { border-color: color-mix(in srgb, var(--accent) 50%, var(--line)); }
+  .btn.primary {
+    background: color-mix(in srgb, var(--accent) 14%, transparent);
+    border-color: color-mix(in srgb, var(--accent) 45%, transparent);
+    color: var(--accent);
+  }
+  .btn.primary:hover { background: color-mix(in srgb, var(--accent) 22%, transparent); }
+  .foot {
+    margin-top: 26px;
+    font: 11px/1 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    letter-spacing: 0.04em;
+    color: var(--muted);
+    opacity: 0.7;
+  }
+</style>
+</head>
+<body>
+  <main class="card">
+    <p class="eyebrow"><span class="brand">${brand}</span><span>console</span><span class="status">${info.status}</span></p>
+    <div class="icon" aria-hidden="true">${info.reason === 'forbidden' ? LOCK_ICON : KEY_ICON}</div>
+    <h1>${title}</h1>
+    <p>${message}</p>${detail}${actions}
+    <p class="foot">${escapeHtml(CONSOLE.packageName)}</p>
+  </main>
+</body>
+</html>`;
+}
+/**
+ * Resolve WHAT to serve for a refusal, honouring the host's `accessDenied` option in either form.
+ * Returns the HTML to send, or `null` when a custom renderer already answered the request itself
+ * (`answered()` reports whether it did — the provider wires that to "a `location` header or a body
+ * is already set"). Framework-light: knows nothing about the HTTP context beyond passing it through.
+ */
+export async function resolveAccessDeniedPage(info, option, ctx, answered) {
+    if (typeof option === 'function') {
+        const rendered = await option(info, ctx);
+        if (typeof rendered === 'string')
+            return rendered;
+        if (answered())
+            return null;
+        return renderAccessDeniedPage(info);
+    }
+    return renderAccessDeniedPage(info, option ?? {});
+}
+//# sourceMappingURL=access_denied_page.js.map

package/dist/src/dashboard/access_denied_page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access_denied_page.js","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAoEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,qBAAqB;CAC1B,CAAC;AAEX,MAAM,YAAY,GAAmE;IACnF,eAAe,EAAE;QACf,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,gDAAgD;KAC1D;IACD,SAAS,EAAE;QACT,KAAK,EAAE,eAAe;QACtB,OAAO,EACL,kHAAkH;KACrH;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,iCAAiC;QACxC,OAAO,EACL,qHAAqH;KACxH;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,MAAM,SAAS,GACb,gPAAgP,CAAC;AACnP,MAAM,QAAQ,GACZ,0PAA0P,CAAC;AAE7P;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,KAAK;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,2FAA2F;QAC3F,OAAO,CAAC,IAAI,CACV,wBAAwB,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,MAAM,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC7C,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,OAAO;;;;;;SAMA,KAAK,MAAM,KAAK;QACjB,SAAS;;;;;;;;;;gBAUD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAsHuB,KAAK,mDAAmD,IAAI,CAAC,MAAM;2CACrE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;UACnF,KAAK;SACN,OAAO,OAAO,MAAM,GAAG,OAAO;sBACjB,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;;;QAG7C,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAsB,EACtB,MAAkD,EAClD,GAAQ,EACR,QAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/dashboard/define_config.d.ts

@@ -1,6 +1,17 @@
 import type { HttpContext } from '@adonisjs/core/http';
 import type { AgentGovernanceAuthorize } from '../governance-gate.js';
 import type { Actor } from '../types.js';
+import type { AccessDeniedOption as GenericAccessDeniedOption, AccessDeniedRenderer as GenericAccessDeniedRenderer } from './access_denied_page.js';
+/**
+ * The function form of {@link AgentDashboardConfig.accessDenied}: render (or answer) a refused
+ * page navigation yourself. Receives the refusal ({@link AccessDeniedInfo}) and the AdonisJS
+ * {@link HttpContext}. Return an HTML string to have it served; answer the request yourself (a
+ * redirect, most commonly) and return nothing to make the provider stand down; return nothing
+ * WITHOUT answering and the built-in page is served.
+ */
+export type AccessDeniedRenderer = GenericAccessDeniedRenderer<HttpContext>;
+/** `accessDenied` in either form — an options object for the built-in page, or a renderer. */
+export type AccessDeniedOption = GenericAccessDeniedOption<HttpContext>;
 /**
  * An extra authorization gate for the dashboard, run AFTER the agent config's `actorResolver` has
  * resolved the caller. Return `false` (or throw) to deny — the request gets `403`. The governance
@@ -55,12 +66,23 @@ export interface AgentDashboardConfig {
      * `401 { error }` JSON with a custom page/redirect. See {@link AgentDashboardUnauthenticatedHook}.
      */
     onUnauthenticated?: AgentDashboardUnauthenticatedHook;
+    /**
+     * What a BROWSER sees when the gate refuses — the SPA shell or its assets (the console has no
+     * JSON routes of its own; its data comes from the agent's `/agent/governance/*` routes, which are
+     * unaffected). Omit it for the built-in page — a dark card in the console's own visual language
+     * with the status, a sentence explaining the refusal and a "Back to app" link. Pass an object to
+     * tweak that page (`brand`, `title`, `message`, `homeHref`, `accent`, …), or a function to
+     * render/answer it yourself — see {@link AccessDeniedRenderer}. A redirect written by
+     * `onUnauthenticated` or `authorize` still wins: the provider never overwrites a `location` header.
+     */
+    accessDenied?: AccessDeniedOption;
 }
 export interface ResolvedAgentDashboardConfig {
     enabled: boolean;
     path?: string;
     authorize?: AgentDashboardAuthorize;
     onUnauthenticated?: AgentDashboardUnauthenticatedHook;
+    accessDenied?: AccessDeniedOption;
 }
 /** Fill defaults for the optional dashboard config block. */
 export declare function resolveDashboardConfig(config: AgentDashboardConfig | undefined): ResolvedAgentDashboardConfig;

package/dist/src/dashboard/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;CACvD;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;CACvD;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,4BAA4B,CAO9B;AAED,uGAAuG;AACvG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,wBAAwB,GAAG,SAAS,EACzD,iBAAiB,CAAC,EAAE,OAAO,GAC1B,sBAAsB,CAgBxB"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,4BAA4B,CAQ9B;AAED,uGAAuG;AACvG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,wBAAwB,GAAG,SAAS,EACzD,iBAAiB,CAAC,EAAE,OAAO,GAC1B,sBAAsB,CAgBxB"}

package/dist/src/dashboard/define_config.js

@@ -7,6 +7,8 @@ export function resolveDashboardConfig(config) {
         resolved.authorize = config.authorize;
     if (config?.onUnauthenticated !== undefined)
         resolved.onUnauthenticated = config.onUnauthenticated;
+    if (config?.accessDenied !== undefined)
+        resolved.accessDenied = config.accessDenied;
     return resolved;
 }
 /**

package/dist/src/dashboard/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAwEA,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,MAAM,QAAQ,GAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACpF,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3E,IAAI,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACzC,QAAQ,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;GAIG;AACH,MAAM,0BAA0B,GAC9B,0sBAA0sB,CAAC;AAE7sB;;;;;;GAMG;AACH,MAAM,6BAA6B,GACjC,ipBAAipB,CAAC;AAEppB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,mBAAyD,EACzD,iBAA2B;IAE3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC7F,CAAC;IACD,mGAAmG;IACnG,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,6BAA6B;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAmGA,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,MAAM,QAAQ,GAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACpF,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3E,IAAI,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACzC,QAAQ,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxD,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACpF,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;GAIG;AACH,MAAM,0BAA0B,GAC9B,0sBAA0sB,CAAC;AAE7sB;;;;;;GAMG;AACH,MAAM,6BAA6B,GACjC,ipBAAipB,CAAC;AAEppB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,mBAAyD,EACzD,iBAA2B;IAE3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC7F,CAAC;IACD,mGAAmG;IACnG,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,6BAA6B;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/src/dashboard/gate.d.ts

@@ -1,6 +1,6 @@
 import type { HttpContext } from '@adonisjs/core/http';
 import type { ActorResolver } from '../spi/actor-resolver.js';
-import type { AgentDashboardAuthorize, AgentDashboardUnauthenticatedHook } from './define_config.js';
+import type { AccessDeniedOption, AgentDashboardAuthorize, AgentDashboardUnauthenticatedHook } from './define_config.js';
 /** The outcome of the dashboard access gate: proceed, or deny with an HTTP status + message. */
 export type DashboardGateVerdict = {
     ok: true;
@@ -47,4 +47,26 @@ export type DashboardGateVerdict = {
  * this function only guarantees the hook runs before the verdict is handed back.
  */
 export declare function evaluateDashboardGate(ctx: HttpContext, actorResolver: ActorResolver | undefined, authorize?: AgentDashboardAuthorize, debug?: boolean, onUnauthenticated?: AgentDashboardUnauthenticatedHook): Promise<DashboardGateVerdict>;
+/** What {@link answerDashboardDenial} needs to serve (or delegate) the access-denied page. */
+export interface DashboardDenialOptions {
+    /** The console's mount (`/agent/dashboard`) — reported to a custom renderer as `basePath`. */
+    basePath: string;
+    /** The host's `dashboard.accessDenied` option — tweak the built-in page, or render it. */
+    accessDenied?: AccessDeniedOption | undefined;
+}
+/**
+ * Write a refused {@link DashboardGateVerdict} to the response — shared by BOTH dashboard providers
+ * (embedded and standalone) so they refuse identically. A browser is what hits these routes (the
+ * SPA shell and its assets), so the body is the built-in access-denied page (or the host's
+ * `accessDenied` customisation of it), not the JSON the governance API answers with.
+ *
+ * Stands down when the request is already answered: `onUnauthenticated`/`authorize` (or the
+ * renderer) writing a redirect keeps it — the `location`-header rule the providers have always
+ * honoured. The verdict's `error` is shown on the page as a developer detail only when it is more
+ * than the generic word (i.e. the `debug` message outside production, or the static "no actor
+ * resolver configured" operator hint).
+ */
+export declare function answerDashboardDenial(ctx: HttpContext, verdict: Extract<DashboardGateVerdict, {
+    ok: false;
+}>, options: DashboardDenialOptions): Promise<void>;
 //# sourceMappingURL=gate.d.ts.map

package/dist/src/dashboard/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EACV,uBAAuB,EACvB,iCAAiC,EAClC,MAAM,oBAAoB,CAAC;AAE5B,gGAAgG;AAChG,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,SAAS,CAAC,EAAE,uBAAuB,EACnC,KAAK,UAAQ,EACb,iBAAiB,CAAC,EAAE,iCAAiC,GACpD,OAAO,CAAC,oBAAoB,CAAC,CA8B/B"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,iCAAiC,EAClC,MAAM,oBAAoB,CAAC;AAE5B,gGAAgG;AAChG,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,SAAS,CAAC,EAAE,uBAAuB,EACnC,KAAK,UAAQ,EACb,iBAAiB,CAAC,EAAE,iCAAiC,GACpD,OAAO,CAAC,oBAAoB,CAAC,CA8B/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,EACrD,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/src/dashboard/gate.js

@@ -1,3 +1,4 @@
+import { resolveAccessDeniedPage } from './access_denied_page.js';
 /**
  * Decide whether a request may reach the dashboard, WITHOUT touching the response — so it is unit
  * testable free of the AdonisJS router/app: resolve the actor through the agent config's resolver
@@ -68,4 +69,58 @@ export async function evaluateDashboardGate(ctx, actorResolver, authorize, debug
     }
     return { ok: true };
 }
+/**
+ * Write a refused {@link DashboardGateVerdict} to the response — shared by BOTH dashboard providers
+ * (embedded and standalone) so they refuse identically. A browser is what hits these routes (the
+ * SPA shell and its assets), so the body is the built-in access-denied page (or the host's
+ * `accessDenied` customisation of it), not the JSON the governance API answers with.
+ *
+ * Stands down when the request is already answered: `onUnauthenticated`/`authorize` (or the
+ * renderer) writing a redirect keeps it — the `location`-header rule the providers have always
+ * honoured. The verdict's `error` is shown on the page as a developer detail only when it is more
+ * than the generic word (i.e. the `debug` message outside production, or the static "no actor
+ * resolver configured" operator hint).
+ */
+export async function answerDashboardDenial(ctx, verdict, options) {
+    const answered = () => responseAnswered(ctx);
+    if (answered())
+        return;
+    const nonce = cspNonce(ctx);
+    const generic = verdict.error === 'unauthorized' || verdict.error === 'forbidden';
+    const info = {
+        status: verdict.status,
+        reason: verdict.status === 401 ? 'unauthenticated' : 'forbidden',
+        basePath: options.basePath,
+        ...(generic ? {} : { detail: verdict.error }),
+        ...(nonce !== undefined ? { nonce } : {}),
+    };
+    const html = await resolveAccessDeniedPage(info, options.accessDenied, ctx, answered);
+    if (html === null)
+        return;
+    ctx.response
+        .status(info.status)
+        .header('content-type', 'text/html; charset=utf-8')
+        .header('cache-control', 'no-store, must-revalidate')
+        .send(html);
+}
+/**
+ * Whether something already answered this request: a redirect (`location` header) or a body queued
+ * on the response. The body check reads AdonisJS's `response.hasLazyBody` structurally so a
+ * plain-object `ctx` double in a unit test (which has neither) still works.
+ */
+function responseAnswered(ctx) {
+    if (ctx.response.getHeader('location'))
+        return true;
+    const response = ctx.response;
+    return response.hasLazyBody === true || response.headersSent === true;
+}
+/**
+ * The request's CSP nonce when the host runs `@adonisjs/shield` with `@nonce` in its policy (shield
+ * exposes it as `response.nonce`). Read structurally: this package neither depends on shield nor
+ * cares which middleware minted the nonce — only that the page's inline `<style>` carries it.
+ */
+function cspNonce(ctx) {
+    const nonce = ctx.response.nonce;
+    return typeof nonce === 'string' && nonce !== '' ? nonce : undefined;
+}
 //# sourceMappingURL=gate.js.map

package/dist/src/dashboard/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,aAAwC,EACxC,SAAmC,EACnC,KAAK,GAAG,KAAK,EACb,iBAAqD;IAErD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAoD,CAAC;IACzD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;aACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAUzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,aAAwC,EACxC,SAAmC,EACnC,KAAK,GAAG,KAAK,EACb,iBAAqD;IAErD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAoD,CAAC;IACzD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;aACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,OAAqD,EACrD,OAA+B;IAE/B,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE;QAAE,OAAO;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,cAAc,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC;IAClF,MAAM,IAAI,GAAqB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAC1B,GAAG,CAAC,QAAQ;SACT,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACnB,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;SAClD,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC;SACpD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAgB;IACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAuE,CAAC;IAC7F,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAgB;IAChC,MAAM,KAAK,GAAI,GAAG,CAAC,QAA2C,CAAC,KAAK,CAAC;IACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC"}

package/dist/src/dashboard/index.d.ts

@@ -14,7 +14,9 @@
  * so a package.json edge back from here to there would be circular. See
  * `providers/dashboard_provider.ts`'s module doc for the full story.
  */
-export { type AgentDashboardAuthorize, type AgentDashboardConfig, type AgentDashboardUnauthenticatedHook, type DashboardMountDecision, decideDashboardMount, type ResolvedAgentDashboardConfig, resolveDashboardConfig, } from './define_config.js';
-export { type DashboardGateVerdict, evaluateDashboardGate } from './gate.js';
+export type { AccessDeniedInfo, AccessDeniedPageOptions, AccessDeniedReason, } from './access_denied_page.js';
+export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
+export { type AccessDeniedOption, type AccessDeniedRenderer, type AgentDashboardAuthorize, type AgentDashboardConfig, type AgentDashboardUnauthenticatedHook, type DashboardMountDecision, decideDashboardMount, type ResolvedAgentDashboardConfig, resolveDashboardConfig, } from './define_config.js';
+export { answerDashboardDenial, type DashboardDenialOptions, type DashboardGateVerdict, evaluateDashboardGate, } from './gate.js';
 export { apiBaseFor, CONFIG_ELEMENT_ID, contentTypeFor, injectApiBase, injectBaseHref, mountPathFor, safeAssetSegments, trimSlashes, } from './paths.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/dashboard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,4BAA4B,EACjC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,4BAA4B,EACjC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/src/dashboard/index.js

@@ -1,20 +1,6 @@
-/**
- * Serving helpers for the `@adonis-agora/agent-dashboard` governance SPA — the config shape, the
- * mount/gate decisions, and the pure path/asset helpers. Framework-light (no AdonisJS router/app
- * dependency), so they're unit-testable in isolation and reusable by BOTH dashboard providers:
- *
- * - `@adonis-agora/agent/dashboard_provider` (this package, `providers/dashboard_provider.ts`) —
- *   embedded: registered automatically by `node ace configure @adonis-agora/agent`, serves the SPA
- *   bundle copied into THIS package's own `dist/assets/spa` at build time.
- * - `@adonis-agora/agent-dashboard`'s own provider (`agent_dashboard_provider.ts`) — standalone: an
- *   independently installable/registrable package some apps already depend on directly.
- *
- * Living here (rather than in `@adonis-agora/agent-dashboard`) keeps the dependency direction
- * one-way: the dashboard package already depends on this one for `AgentConfig`/`ActorResolver`/etc.,
- * so a package.json edge back from here to there would be circular. See
- * `providers/dashboard_provider.ts`'s module doc for the full story.
- */
+// The built-in "access denied" page (what a browser sees on a refused page navigation).
+export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 export { decideDashboardMount, resolveDashboardConfig, } from './define_config.js';
-export { evaluateDashboardGate } from './gate.js';
+export { answerDashboardDenial, evaluateDashboardGate, } from './gate.js';
 export { apiBaseFor, CONFIG_ELEMENT_ID, contentTypeFor, injectApiBase, injectBaseHref, mountPathFor, safeAssetSegments, trimSlashes, } from './paths.js';
 //# sourceMappingURL=index.js.map

package/dist/src/dashboard/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAKL,oBAAoB,EAEpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAA6B,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAqBA,wFAAwF;AACxF,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAOL,oBAAoB,EAEpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EAGrB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.25.5";
+export declare const VERSION = "0.26.0";
 export { configure } from '../configure.js';
 export * from './actor-labels.js';
 export type { AuthActorResolverOptions } from './actor-resolver.js';

package/dist/src/index.js

@@ -1,4 +1,4 @@
-export const VERSION = '0.25.5';
+export const VERSION = '0.26.0';
 // Re-export the configure hook from the package root so `node ace configure` finds it.
 // AdonisJS imports the package MAIN and reads `configure` off the module namespace —
 // the `./configure` subpath alone is never consulted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/agent",
-  "version": "0.25.5",
+  "version": "0.26.0",
   "description": "Governed, durable-backed AI agent (chat + tool-calling + governance) for AdonisJS — part of the Agora ecosystem.",
   "license": "MIT",
   "repository": {