@adonis-agora/agent 0.89.2 → 0.91.0

package/dist/src/coalesced-writes.js

@@ -0,0 +1,182 @@
+/**
+ * What consecutive frames of a run merge under, or `undefined` for a frame that is always written on
+ * its own. Only the streamed deltas qualify — answer text, reasoning text, and the argument text of
+ * ONE tool call — and only in their plain shape, so a merge can never drop a field: every reader
+ * appends those deltas, which makes one frame holding their concatenation read the same as the run.
+ */
+export function coalesceKey(frame) {
+    if (frame.t === 'text')
+        return 'text';
+    if (frame.t !== 'event')
+        return undefined;
+    const event = frame.event;
+    if (event.kind === 'reasoning' && Object.keys(event).length === 2)
+        return 'reasoning';
+    if (event.kind === 'tool-input-delta' && Object.keys(event).length === 3) {
+        return `tool-input-delta\u0000${event.id}`;
+    }
+    return undefined;
+}
+/** `next` appended to `held`; both have the same {@link coalesceKey}. */
+function merge(held, next) {
+    if (held.t === 'text' && next.t === 'text')
+        return { t: 'text', v: held.v + next.v };
+    if (held.t === 'event' && next.t === 'event') {
+        const a = held.event;
+        const b = next.event;
+        if (a.kind === 'reasoning' && b.kind === 'reasoning') {
+            return { t: 'event', event: { kind: 'reasoning', text: a.text + b.text } };
+        }
+        if (a.kind === 'tool-input-delta' && b.kind === 'tool-input-delta') {
+            return {
+                t: 'event',
+                event: { kind: 'tool-input-delta', id: a.id, delta: a.delta + b.delta },
+            };
+        }
+    }
+    return next;
+}
+/**
+ * The write half a shared sink puts in front of its transport: consecutive deltas of one kind
+ * (see {@link coalesceKey}) written within `flushMs` become ONE frame, and every frame of a run is
+ * appended in call order, one append at a time.
+ *
+ * A model streams token by token, and a round trip per token is what a transport shared across
+ * replicas can least afford. A gathered frame is written when its window passes (counted from its
+ * FIRST delta, so a steady stream still lands every `flushMs`), when a frame that does not merge
+ * with it arrives, and on `flush()`/`end()` — so order is always kept. `flushMs: 0` appends every
+ * frame as it comes.
+ *
+ * Writers opened for the same run in one process share what they are gathering, so a delegated
+ * run's text (forwarded through a `childSinkWriter`) and its parent's next frame keep the order they
+ * were written in.
+ */
+export class CoalescedWrites {
+    flushMs;
+    append;
+    runs = new Map();
+    constructor(flushMs, 
+    /** Append one frame to the run's stream, or (`null`) its end marker. */
+    append) {
+        this.flushMs = flushMs;
+        this.append = append;
+    }
+    state(runId) {
+        let state = this.runs.get(runId);
+        if (state === undefined) {
+            state = {
+                held: null,
+                heldKey: undefined,
+                timer: undefined,
+                tail: Promise.resolve(),
+                pending: 0,
+                failure: undefined,
+            };
+            this.runs.set(runId, state);
+        }
+        return state;
+    }
+    /** Forget a run's write state once nothing is gathered, queued or left to report. */
+    release(runId, state) {
+        if (state.pending === 0 &&
+            state.held === null &&
+            state.failure === undefined &&
+            this.runs.get(runId) === state) {
+            this.runs.delete(runId);
+        }
+    }
+    /** Queue `frame` behind every write already queued for the run, so frames land in call order. */
+    enqueue(runId, state, frame) {
+        state.pending += 1;
+        const next = state.tail.then(() => this.append(runId, frame));
+        state.tail = next
+            .then(() => undefined, () => undefined)
+            .then(() => {
+            state.pending -= 1;
+            this.release(runId, state);
+        });
+        return next;
+    }
+    /** Queue the gathered frame (if any). */
+    flushHeld(runId, state) {
+        if (state.timer !== undefined) {
+            clearTimeout(state.timer);
+            state.timer = undefined;
+        }
+        const held = state.held;
+        if (held === null)
+            return Promise.resolve();
+        state.held = null;
+        state.heldKey = undefined;
+        return this.enqueue(runId, state, held);
+    }
+    /** A write nobody awaits (a window that passed, a gathered frame a different one displaced). */
+    flushUnawaited(runId, state) {
+        this.flushHeld(runId, state).catch((error) => {
+            state.failure = { error };
+        });
+    }
+    /** Raise, once, a gathered write that failed with nobody awaiting it. */
+    raiseFailure(state) {
+        const failure = state.failure;
+        if (failure !== undefined) {
+            state.failure = undefined;
+            throw failure.error;
+        }
+    }
+    async write(runId, frame) {
+        const state = this.state(runId);
+        this.raiseFailure(state);
+        const key = this.flushMs > 0 ? coalesceKey(frame) : undefined;
+        if (key !== undefined) {
+            if (state.held !== null && state.heldKey === key) {
+                state.held = merge(state.held, frame);
+                return;
+            }
+            if (state.held !== null)
+                this.flushUnawaited(runId, state);
+            state.held = frame;
+            state.heldKey = key;
+            state.timer = setTimeout(() => {
+                state.timer = undefined;
+                this.flushUnawaited(runId, state);
+            }, this.flushMs);
+            return;
+        }
+        const flushed = this.flushHeld(runId, state);
+        const appended = this.enqueue(runId, state, frame);
+        await Promise.all([flushed, appended]);
+    }
+    /** Write out the gathered frame and wait for every queued write, without ending the stream. */
+    async flush(runId) {
+        const state = this.state(runId);
+        const flushed = this.flushHeld(runId, state);
+        await Promise.all([flushed, state.tail]);
+        this.raiseFailure(state);
+        this.release(runId, state);
+    }
+    /** Write out the gathered frame, then the end marker. */
+    async end(runId) {
+        const state = this.state(runId);
+        const flushed = this.flushHeld(runId, state);
+        const ended = this.enqueue(runId, state, null);
+        await Promise.all([flushed, ended]);
+        this.raiseFailure(state);
+        this.release(runId, state);
+    }
+    /** Drop what is gathered for the run and wait out the writes already queued. */
+    async discard(runId) {
+        const state = this.runs.get(runId);
+        if (state === undefined)
+            return;
+        if (state.timer !== undefined)
+            clearTimeout(state.timer);
+        state.timer = undefined;
+        state.held = null;
+        state.heldKey = undefined;
+        state.failure = undefined;
+        await state.tail;
+        this.runs.delete(runId);
+    }
+}
+//# sourceMappingURL=coalesced-writes.js.map

package/dist/src/coalesced-writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coalesced-writes.js","sourceRoot":"","sources":["../../src/coalesced-writes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAkB;IAC5C,IAAI,KAAK,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACtF,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,yBAAyB,KAAK,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,SAAS,KAAK,CAAC,IAAiB,EAAE,IAAiB;IACjD,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IACrF,IAAI,IAAI,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACnE,OAAO;gBACL,CAAC,EAAE,OAAO;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE;aACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,eAAe;IAIP,OAAO;IAEP,MAAM;IALR,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAErD,YACmB,OAAe;IAChC,wEAAwE;IACvD,MAAmE;uBAFnE,OAAO;sBAEP,MAAM;IACtB,CAAC;IAEI,KAAK,CAAC,KAAa;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG;gBACN,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;gBACvB,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,SAAS;aACnB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qFAAqF;IAC7E,OAAO,CAAC,KAAa,EAAE,KAAgB;QAC7C,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,KAAK,CAAC,IAAI,KAAK,IAAI;YACnB,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,EAC9B,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,iGAAiG;IACzF,OAAO,CAAC,KAAa,EAAE,KAAgB,EAAE,KAAyB;QACxE,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,GAAG,IAAI;aACd,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB;aACA,IAAI,CAAC,GAAG,EAAE;YACT,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yCAAyC;IACjC,SAAS,CAAC,KAAa,EAAE,KAAgB;QAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,gGAAgG;IACxF,cAAc,CAAC,KAAa,EAAE,KAAgB;QACpD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpD,KAAK,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACjE,YAAY,CAAC,KAAgB;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;YAC1B,MAAM,OAAO,CAAC,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,KAAkB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;gBACjD,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YACnB,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC;YACpB,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;gBACxB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,KAAK,CAAC,KAAa;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QACxB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;QAC1B,MAAM,KAAK,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/src/dashboard/define_config.d.ts

@@ -1,4 +1,5 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import type { AuthorizeResult } from '../authorize-decision.js';
 import type { AgentGovernanceAuthorize } from '../governance-gate.js';
 import type { Actor } from '../types.js';
 import type { AccessDeniedOption as GenericAccessDeniedOption, AccessDeniedRenderer as GenericAccessDeniedRenderer } from './access_denied_page.js';
@@ -14,11 +15,19 @@ export type AccessDeniedRenderer = GenericAccessDeniedRenderer<HttpContext>;
 export type AccessDeniedOption = GenericAccessDeniedOption<HttpContext>;
 /**
  * An extra authorization gate for the dashboard, run AFTER the agent config's `actorResolver` has
- * resolved the caller. Return `false` (or throw) to deny — the request gets `403`. The governance
- * read-model the SPA serves spans EVERY actor's spend/usage, so most apps restrict the console beyond
- * mere authentication, e.g. `(actor) => actor.roles?.includes('ADMIN') ?? false`.
+ * resolved the caller. Returns an {@link AuthorizeResult}:
+ *
+ * - `true` / `{ allowed: true }` → the console is served.
+ * - `{ allowed: false, reason: 'unauthenticated' }` → `401` (the access-denied page's "sign in" variant).
+ * - `{ allowed: false, reason: 'forbidden' }`, `{ allowed: false }`, or `false` → `403`.
+ * - throwing → `403`.
+ *
+ * If the hook answers the request itself (e.g. `ctx.response.redirect('/login')`), that answer is
+ * kept. The governance read-model the SPA serves spans EVERY actor's spend/usage, so most apps
+ * restrict the console beyond mere authentication, e.g.
+ * `(actor) => actor.roles?.includes('ADMIN') ?? false`.
  */
-export type AgentDashboardAuthorize = (actor: Actor, ctx: HttpContext) => boolean | Promise<boolean>;
+export type AgentDashboardAuthorize = (actor: Actor, ctx: HttpContext) => AuthorizeResult | Promise<AuthorizeResult>;
 /**
  * Runs when the agent config's `actorResolver` itself rejects the caller — no resolver configured, or
  * `resolve(ctx)` threw (e.g. `AuthActorResolver` over an anonymous `ctx.auth`) — so there is no
@@ -53,7 +62,9 @@ export interface AgentDashboardConfig {
     /** Override the mount path. Default `<agentPath>/dashboard`. */
     path?: string;
     /**
-     * Extra authorization run after the actor resolves. Return `false` to deny (`403`). Omit to allow
+     * Extra authorization run after the actor resolves. Return `false` / `{ allowed: false }` to deny
+     * (`403`), or `{ allowed: false, reason: 'unauthenticated' }` for `401` — see
+     * {@link AgentDashboardAuthorize}. Omit to allow
      * any resolved actor (the default) — note this is only an EXTRA gate on the SPA shell; whether the
      * console mounts at all, and whether its data is readable, is decided by the agent config's
      * `governanceAuthorize`.

package/dist/src/dashboard/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,4BAA4B,CAQ9B;AAED,uGAAuG;AACvG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,wBAAwB,GAAG,SAAS,EACzD,iBAAiB,CAAC,EAAE,OAAO,GAC1B,sBAAsB,CAgBxB"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,KACb,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GACvC,4BAA4B,CAQ9B;AAED,uGAAuG;AACvG,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,mBAAmB,EAAE,wBAAwB,GAAG,SAAS,EACzD,iBAAiB,CAAC,EAAE,OAAO,GAC1B,sBAAsB,CAgBxB"}

package/dist/src/dashboard/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAmGA,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,MAAM,QAAQ,GAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACpF,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3E,IAAI,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACzC,QAAQ,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxD,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACpF,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;GAIG;AACH,MAAM,0BAA0B,GAC9B,0sBAA0sB,CAAC;AAE7sB;;;;;;GAMG;AACH,MAAM,6BAA6B,GACjC,ipBAAipB,CAAC;AAEppB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,mBAAyD,EACzD,iBAA2B;IAE3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC7F,CAAC;IACD,mGAAmG;IACnG,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,6BAA6B;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AA8GA,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,MAAM,QAAQ,GAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;IACpF,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3E,IAAI,MAAM,EAAE,iBAAiB,KAAK,SAAS;QACzC,QAAQ,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACxD,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACpF,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;GAIG;AACH,MAAM,0BAA0B,GAC9B,0sBAA0sB,CAAC;AAE7sB;;;;;;GAMG;AACH,MAAM,6BAA6B,GACjC,ipBAAipB,CAAC;AAEppB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,mBAAyD,EACzD,iBAA2B;IAE3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1D,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC7F,CAAC;IACD,mGAAmG;IACnG,iGAAiG;IACjG,0FAA0F;IAC1F,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,6BAA6B;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/src/dashboard/gate.d.ts

@@ -13,7 +13,8 @@ export type DashboardGateVerdict = {
  * Decide whether a request may reach the dashboard, WITHOUT touching the response — so it is unit
  * testable free of the AdonisJS router/app: resolve the actor through the agent config's resolver
  * (missing/failed → `401`), then run the optional `authorize` gate over the resolved actor
- * (denied/threw → `403`).
+ * (`true`/`{ allowed: true }` → proceed; `{ allowed: false, reason: 'unauthenticated' }` → `401`;
+ * `false`, `{ allowed: false }` or `reason: 'forbidden'` → `403`; threw → `403`).
  *
  * This gates the SPA **shell**, and only the shell. It is NOT what decides whether the console's data
  * is readable, and it is no longer the last line of defence it once had to be:

package/dist/src/dashboard/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,iCAAiC,EAClC,MAAM,oBAAoB,CAAC;AAE5B,gGAAgG;AAChG,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,SAAS,CAAC,EAAE,uBAAuB,EACnC,KAAK,UAAQ,EACb,iBAAiB,CAAC,EAAE,iCAAiC,GACpD,OAAO,CAAC,oBAAoB,CAAC,CA8B/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,EACrD,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,iCAAiC,EAClC,MAAM,oBAAoB,CAAC;AAE5B,gGAAgG;AAChG,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,aAAa,GAAG,SAAS,EACxC,SAAS,CAAC,EAAE,uBAAuB,EACnC,KAAK,UAAQ,EACb,iBAAiB,CAAC,EAAE,iCAAiC,GACpD,OAAO,CAAC,oBAAoB,CAAC,CAkC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,sBAAsB;IACrC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,EACrD,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/src/dashboard/gate.js

@@ -1,9 +1,11 @@
+import { resolveAuthorizeResult } from '../authorize-decision.js';
 import { resolveAccessDeniedPage } from './access_denied_page.js';
 /**
  * Decide whether a request may reach the dashboard, WITHOUT touching the response — so it is unit
  * testable free of the AdonisJS router/app: resolve the actor through the agent config's resolver
  * (missing/failed → `401`), then run the optional `authorize` gate over the resolved actor
- * (denied/threw → `403`).
+ * (`true`/`{ allowed: true }` → proceed; `{ allowed: false, reason: 'unauthenticated' }` → `401`;
+ * `false`, `{ allowed: false }` or `reason: 'forbidden'` → `403`; threw → `403`).
  *
  * This gates the SPA **shell**, and only the shell. It is NOT what decides whether the console's data
  * is readable, and it is no longer the last line of defence it once had to be:
@@ -55,8 +57,12 @@ export async function evaluateDashboardGate(ctx, actorResolver, authorize, debug
     }
     if (authorize !== undefined) {
         try {
-            if (!(await authorize(actor, ctx))) {
-                return { ok: false, status: 403, error: 'forbidden' };
+            // A denying decision object is truthy — normalise, never truth-test the raw result.
+            const decision = resolveAuthorizeResult(await authorize(actor, ctx));
+            if (!decision.allowed) {
+                return decision.status === 401
+                    ? { ok: false, status: 401, error: 'unauthorized' }
+                    : { ok: false, status: 403, error: 'forbidden' };
             }
         }
         catch (error) {

package/dist/src/dashboard/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAUzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,aAAwC,EACxC,SAAmC,EACnC,KAAK,GAAG,KAAK,EACb,iBAAqD;IAErD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAoD,CAAC;IACzD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;aACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,OAAqD,EACrD,OAA+B;IAE/B,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE;QAAE,OAAO;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,cAAc,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC;IAClF,MAAM,IAAI,GAAqB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAC1B,GAAG,CAAC,QAAQ;SACT,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACnB,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;SAClD,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC;SACpD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAgB;IACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAuE,CAAC;IAC7F,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAgB;IAChC,MAAM,KAAK,GAAI,GAAG,CAAC,QAA2C,CAAC,KAAK,CAAC;IACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/dashboard/gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAAyB,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAUzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,aAAwC,EACxC,SAAmC,EACnC,KAAK,GAAG,KAAK,EACb,iBAAqD;IAErD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAoD,CAAC;IACzD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,oFAAoF;YACpF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG;oBAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE;oBACnD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;aACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,OAAqD,EACrD,OAA+B;IAE/B,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE;QAAE,OAAO;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,cAAc,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC;IAClF,MAAM,IAAI,GAAqB;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAC1B,GAAG,CAAC,QAAQ;SACT,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACnB,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;SAClD,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC;SACpD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAgB;IACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAuE,CAAC;IAC7F,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAgB;IAChC,MAAM,KAAK,GAAI,GAAG,CAAC,QAA2C,CAAC,KAAK,CAAC;IACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC"}

package/dist/src/dashboard/index.d.ts

@@ -14,6 +14,7 @@
  * so a package.json edge back from here to there would be circular. See
  * `providers/dashboard_provider.ts`'s module doc for the full story.
  */
+export type { AuthorizeDecision, AuthorizeResult } from '../authorize-decision.js';
 export type { AccessDeniedInfo, AccessDeniedPageOptions, AccessDeniedReason, } from './access_denied_page.js';
 export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 export { type AccessDeniedOption, type AccessDeniedRenderer, type AgentDashboardAuthorize, type AgentDashboardConfig, type AgentDashboardUnauthenticatedHook, type DashboardMountDecision, decideDashboardMount, type ResolvedAgentDashboardConfig, resolveDashboardConfig, } from './define_config.js';

package/dist/src/dashboard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,4BAA4B,EACjC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACnF,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,4BAA4B,EACjC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/src/dashboard/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAqBA,wFAAwF;AACxF,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAOL,oBAAoB,EAEpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EAGrB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAuBA,wFAAwF;AACxF,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAOL,oBAAoB,EAEpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EAGrB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/src/define_config.d.ts

@@ -202,8 +202,10 @@ export interface AgentConfig {
     /**
      * Authorization gate for the cross-actor `/agent/governance/*` read routes. It runs after the actor
      * is resolved (the caller is authenticated) and decides whether THIS actor may read the platform-wide
-     * governance read-model — every actor's spend, usage, threads, and pending HITL approvals. Return
-     * `false` to deny (the route replies `403`).
+     * governance read-model — every actor's spend, usage, threads, and pending HITL approvals. Returns
+     * an `AuthorizeResult`: `true`/`{ allowed: true }` allows; `false`/`{ allowed: false }` (or
+     * `reason: 'forbidden'`) denies with `403`; `{ allowed: false, reason: 'unauthenticated' }` denies
+     * with `401`; throwing denies with `403`. A `location` header or body the hook wrote itself is kept.
      *
      * **The routes mount only when this gate exists.** Omit it and `/agent/governance/*` is NOT mounted
      * at all (every route answers `404`), because an ungated cross-actor read-model exposes every

package/dist/src/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,EACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzD,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AACxE,iIAAiI;AACjI,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE5F,uGAAuG;AACvG,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD,oBAAoB,CAAC,EAAE;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;WAKG;QACH,SAAS,CAAC,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,iGAAiG;QACjG,UAAU,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACnE,CAAC;IACF;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C;;;OAGG;IACH,KAAK,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,WAAW,GAAG,kBAAkB,CAAC;IAC1C,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,WAAW,CAAC;IACrC;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,aAAa,CAAC;IAC/F;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,KAAK,CAAC;IAC1D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,GAAG,KAAK,CAAC;IAC9E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAAC;IACzC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACxD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IAChD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,CAAC;IACzC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,8GAA8G;IAC9G,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,iGAAiG;IACjG,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IAC/C;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAC5C;;;;;OAKG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,2GAA2G;IAC3G,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D;AAED,YAAY,EACV,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,CAAC;AACF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,CAAC"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,EACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzD,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AACxE,iIAAiI;AACjI,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE5F,uGAAuG;AACvG,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAClD,oBAAoB,CAAC,EAAE;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;WAKG;QACH,SAAS,CAAC,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,iGAAiG;QACjG,UAAU,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACnE,CAAC;IACF;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C;;;OAGG;IACH,KAAK,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,WAAW,GAAG,kBAAkB,CAAC;IAC1C,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,WAAW,CAAC;IACrC;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,aAAa,CAAC;IAC/F;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,KAAK,CAAC;IAC1D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,GAAG,KAAK,CAAC;IAC9E;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;IAC/C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAAC;IACzC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACxD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IAChD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,CAAC;IACzC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,8GAA8G;IAC9G,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,iGAAiG;IACjG,KAAK,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IAC/C;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IAC5C;;;;;OAKG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,2GAA2G;IAC3G,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D;AAED,YAAY,EACV,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,CAAC;AACF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,CAAC"}

package/dist/src/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAuDA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,MAAM,qBAAqB,CAAC;AAsY7B,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AA0BD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../src/define_config.ts"],"names":[],"mappings":"AAuDA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,MAAM,qBAAqB,CAAC;AAwY7B,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AA0BD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,CAAC"}

package/dist/src/governance-gate.d.ts

@@ -1,10 +1,13 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import { type AuthorizeResult } from './authorize-decision.js';
 import type { Actor } from './types.js';
 /**
  * Authorization gate for the cross-actor `/agent/governance/*` read routes. It runs AFTER the actor
  * is resolved (so the caller is already authenticated), and decides whether THIS actor may read the
- * platform-wide governance read-model (every actor's spend/usage/threads/approvals). Return `false`
- * to deny (the route replies `403`).
+ * platform-wide governance read-model (every actor's spend/usage/threads/approvals). Returns an
+ * {@link AuthorizeResult}: `true`/`{ allowed: true }` allows; `false`/`{ allowed: false }` denies
+ * with `403`; `{ allowed: false, reason: 'unauthenticated' }` denies with `401` and
+ * `{ allowed: false, reason: 'forbidden' }` with `403`. Throwing denies with `403`.
  *
  * The gate is what makes those routes exist: omit it and the provider does NOT mount
  * `/agent/governance/*` at all (every route answers `404`). Set it to mount them gated, or set
@@ -15,11 +18,14 @@ import type { Actor } from './types.js';
  * Mirrors `@adonis-agora/agent-dashboard`'s `authorize` hook so the JSON routes and the console SPA
  * that reads them can be gated with the SAME predicate (typically "actor is ADMIN").
  */
-export type AgentGovernanceAuthorize = (actor: Actor, ctx: HttpContext) => boolean | Promise<boolean>;
+export type AgentGovernanceAuthorize = (actor: Actor, ctx: HttpContext) => AuthorizeResult | Promise<AuthorizeResult>;
 /** The decision {@link evaluateGovernanceGate} returns: proceed, or reply `status` with `error`. */
 export interface GovernanceGateVerdict {
     ok: boolean;
-    /** The HTTP status to reply when `!ok` (always `403` here — the caller is already authenticated). */
+    /**
+     * The HTTP status to reply when `!ok`: `403`, or `401` when `authorize` returned
+     * `{ allowed: false, reason: 'unauthenticated' }`.
+     */
     status: number;
     error?: string;
 }
@@ -28,8 +34,11 @@ export interface GovernanceGateVerdict {
  * core of the provider's governance gate, extracted so it can be unit tested without booting an app.
  *
  * - No `authorize` configured → `{ ok: true }` (see the caveat below — the provider never gets here).
- * - `authorize` returns truthy → `{ ok: true }`.
- * - `authorize` returns falsy → `{ ok: false, status: 403 }`.
+ * - `authorize` returns `true` / `{ allowed: true }` → `{ ok: true }`.
+ * - `authorize` returns `false` / `{ allowed: false }` (no reason) / `{ allowed: false, reason:
+ *   'forbidden' }` → `{ ok: false, status: 403 }`. A denying decision object is truthy, so it is
+ *   normalised via {@link resolveAuthorizeResult}, never truth-tested.
+ * - `authorize` returns `{ allowed: false, reason: 'unauthenticated' }` → `{ ok: false, status: 401 }`.
  * - `authorize` throws → `{ ok: false, status: 403 }` (fail-closed). `debug` decides whether the
  *   thrown `.message` reaches the client (`true`, e.g. local dev — the message is meant for whoever
  *   is wiring `governanceAuthorize`, useful to see while testing it) or a generic `'forbidden'`

package/dist/src/governance-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"governance-gate.d.ts","sourceRoot":"","sources":["../../src/governance-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,KACb,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,EAChB,SAAS,CAAC,EAAE,wBAAwB,EACpC,KAAK,UAAQ,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAYhC"}
+{"version":3,"file":"governance-gate.d.ts","sourceRoot":"","sources":["../../src/governance-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,KAAK,eAAe,EAA0B,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,KACb,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhD,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,WAAW,EAChB,SAAS,CAAC,EAAE,wBAAwB,EACpC,KAAK,UAAQ,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAehC"}

package/dist/src/governance-gate.js

@@ -1,10 +1,14 @@
+import { resolveAuthorizeResult } from './authorize-decision.js';
 /**
  * Decide whether an already-resolved actor holds cross-actor governance privilege — the router-free
  * core of the provider's governance gate, extracted so it can be unit tested without booting an app.
  *
  * - No `authorize` configured → `{ ok: true }` (see the caveat below — the provider never gets here).
- * - `authorize` returns truthy → `{ ok: true }`.
- * - `authorize` returns falsy → `{ ok: false, status: 403 }`.
+ * - `authorize` returns `true` / `{ allowed: true }` → `{ ok: true }`.
+ * - `authorize` returns `false` / `{ allowed: false }` (no reason) / `{ allowed: false, reason:
+ *   'forbidden' }` → `{ ok: false, status: 403 }`. A denying decision object is truthy, so it is
+ *   normalised via {@link resolveAuthorizeResult}, never truth-tested.
+ * - `authorize` returns `{ allowed: false, reason: 'unauthenticated' }` → `{ ok: false, status: 401 }`.
  * - `authorize` throws → `{ ok: false, status: 403 }` (fail-closed). `debug` decides whether the
  *   thrown `.message` reaches the client (`true`, e.g. local dev — the message is meant for whoever
  *   is wiring `governanceAuthorize`, useful to see while testing it) or a generic `'forbidden'`
@@ -27,8 +31,12 @@ export async function evaluateGovernanceGate(actor, ctx, authorize, debug = fals
     if (authorize === undefined)
         return { ok: true, status: 200 };
     try {
-        const allowed = await authorize(actor, ctx);
-        return allowed ? { ok: true, status: 200 } : { ok: false, status: 403, error: 'forbidden' };
+        const decision = resolveAuthorizeResult(await authorize(actor, ctx));
+        if (decision.allowed)
+            return { ok: true, status: 200 };
+        return decision.status === 401
+            ? { ok: false, status: 401, error: 'unauthorized' }
+            : { ok: false, status: 403, error: 'forbidden' };
     }
     catch (error) {
         return {

package/dist/src/governance-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"governance-gate.js","sourceRoot":"","sources":["../../src/governance-gate.ts"],"names":[],"mappings":"AA+BA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAY,EACZ,GAAgB,EAChB,SAAoC,EACpC,KAAK,GAAG,KAAK;IAEb,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;SACrE,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"governance-gate.js","sourceRoot":"","sources":["../../src/governance-gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAoCvF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAY,EACZ,GAAgB,EAChB,SAAoC,EACpC,KAAK,GAAG,KAAK;IAEb,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG;YAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE;YACnD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;SACrE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/guardrails/detectors/custom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../../../src/guardrails/detectors/custom.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAS3C,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAS3D;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,KAAK,SAAW,GACf,OAAO,EAAE,CA4BX;AAID,iGAAiG;AACjG,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAQtC;AAID,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,SAAa,GACjB,OAAO,EAAE,CAqBX"}
+{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../../../src/guardrails/detectors/custom.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAS3C,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAS3D;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,KAAK,SAAW,GACf,OAAO,EAAE,CA4BX;AAID,iGAAiG;AACjG,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAQtC;AAyBD,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,SAAa,GACjB,OAAO,EAAE,CAkBX"}

package/dist/src/guardrails/detectors/custom.js

@@ -57,12 +57,29 @@ export function fold(s) {
     return out;
 }
 const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const keywordPatterns = new Map();
+/** The matcher for a word list, built once per distinct list (bounded like {@link compileGuardPattern}). */
+function keywordPattern(words) {
+    const key = words.join('\u0000');
+    let re = keywordPatterns.get(key);
+    if (re === undefined) {
+        const clean = words.map((w) => fold(w.trim())).filter(Boolean);
+        re =
+            clean.length === 0
+                ? null
+                : new RegExp(`(?<![\\p{L}\\p{N}_])(?:${clean.map(escapeRe).join('|')})(?![\\p{L}\\p{N}_])`, 'gu');
+        if (keywordPatterns.size > 1_000)
+            keywordPatterns.clear();
+        keywordPatterns.set(key, re);
+    }
+    return re;
+}
 /** Whole-word, case- and accent-insensitive keyword/phrase matching. */
 export function detectKeywords(text, words, label = 'keywords') {
-    const clean = words.map((w) => fold(w.trim())).filter(Boolean);
-    if (clean.length === 0)
+    const re = keywordPattern(words);
+    if (re === null)
         return [];
-    const re = new RegExp(`(?<![\\p{L}\\p{N}_])(?:${clean.map(escapeRe).join('|')})(?![\\p{L}\\p{N}_])`, 'gu');
+    re.lastIndex = 0;
     const folded = fold(text);
     const out = [];
     for (let m = re.exec(folded); m; m = re.exec(folded)) {

package/dist/src/guardrails/detectors/custom.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/guardrails/detectors/custom.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE3C,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,GAAG,KAAK;YAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5C,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,QAA2B,EAC3B,KAAK,GAAG,QAAQ;IAEhB,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1E,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,EAAE,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,SAAS,KAAK,EAAE;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC1B,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,iGAAiG;AACjG,MAAM,UAAU,IAAI,CAAC,CAAS;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAEzE,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,KAAwB,EACxB,KAAK,GAAG,UAAU;IAElB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,0BAA0B,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAC7E,IAAI,CACL,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,YAAY,KAAK,EAAE;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;YAC1B,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACjD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/guardrails/detectors/custom.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE3C,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,GAAG,KAAK;YAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5C,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,QAA2B,EAC3B,KAAK,GAAG,QAAQ;IAEhB,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1E,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,EAAE,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,SAAS,KAAK,EAAE;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC1B,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;gBACX,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,iGAAiG;AACjG,MAAM,UAAU,IAAI,CAAC,CAAS;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAEzE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEzD,4GAA4G;AAC5G,SAAS,cAAc,CAAC,KAAwB;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,EAAE;YACA,KAAK,CAAC,MAAM,KAAK,CAAC;gBAChB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,MAAM,CACR,0BAA0B,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAC7E,IAAI,CACL,CAAC;QACR,IAAI,eAAe,CAAC,IAAI,GAAG,KAAK;YAAE,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1D,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,KAAwB,EACxB,KAAK,GAAG,UAAU;IAElB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,YAAY,KAAK,EAAE;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;YAC1B,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACjD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/in-process-sink.d.ts

@@ -4,13 +4,23 @@ import type { SinkWriter, StreamFrame, TokenStreamSink } from './spi/token-strea
  * subscriber replays everything so far, then follows live until the run ends. Good for a single
  * replica; a multi-replica deployment needs a shared (Redis) sink so any pod can serve any run's
  * stream. Identical (frame-for-frame) to the `InMemoryTokenStreamSink` shipped from `./testing`.
+ *
+ * A run's buffer is dropped an hour after its last write, ended or not, so a long-lived process does
+ * not keep every stream it ever served. The timers are `unref`'d: they never hold the process open.
  */
 export declare class InProcessTokenStreamSink implements TokenStreamSink {
     private readonly runs;
     private buffer;
+    /**
+     * One timer per run, re-armed for whatever is left of the window when it fires early, so a write
+     * only stamps `touchedAt` instead of resetting a timer per token.
+     */
+    private scheduleExpiry;
+    private drop;
     private wake;
     open(runId: string): SinkWriter;
     subscribe(runId: string): AsyncIterable<StreamFrame>;
+    private follow;
     has(runId: string): boolean;
     close(runId: string): void;
 }

package/dist/src/in-process-sink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"in-process-sink.d.ts","sourceRoot":"","sources":["../../src/in-process-sink.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAQ3F;;;;;GAKG;AACH,qBAAa,wBAAyB,YAAW,eAAe;IAC9D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IAErD,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,IAAI;IAOZ,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAY9B;IAEM,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAgB1D;IAED,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1B;IAED,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzB;CACF"}
+{"version":3,"file":"in-process-sink.d.ts","sourceRoot":"","sources":["../../src/in-process-sink.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAoB3F;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,YAAW,eAAe;IAC9D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IAErD,OAAO,CAAC,MAAM;IAiBd;;;OAGG;IACH,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,IAAI;IAOZ,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAiB9B;IAED,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAEnD;YAEc,MAAM;IAwBrB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1B;IAED,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAGzB;CACF"}