@adonis-agora/durable-dashboard 0.8.2 → 0.8.3

package/dist/spa/index.html

@@ -10,7 +10,7 @@
       rel="stylesheet"
     />
     <title>durable · control plane</title>
-    <script type="module" crossorigin src="/__DURABLE_DASHBOARD__/assets/index-BEk3-95l.js"></script>
+    <script type="module" crossorigin src="/__DURABLE_DASHBOARD__/assets/index-BULnCUuC.js"></script>
     <link rel="stylesheet" crossorigin href="/__DURABLE_DASHBOARD__/assets/index-6nmSTfT7.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/durable-dashboard",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Control-plane console (runs, step timeline, workflow graph, retry/cancel/fix-and-replay) for @adonis-agora/durable — a React SPA served by a thin AdonisJS provider. Part of the Agora ecosystem.",
   "license": "MIT",
   "repository": {
@@ -42,7 +42,7 @@
     "@tailwindcss/postcss": "4.3.3",
     "@tanstack/intent": "0.5.6",
     "@tanstack/react-query": "5.104.5",
-    "@tanstack/react-virtual": "3.14.21",
+    "@tanstack/react-virtual": "3.14.22",
     "@testing-library/dom": "10.4.2",
     "@testing-library/react": "16.3.3",
     "@types/node": "26.6.5",
@@ -59,7 +59,7 @@
     "tailwind-merge": "3.7.0",
     "tailwindcss": "4.3.3",
     "typescript": "7.0.2",
-    "vite": "8.3.4",
+    "vite": "8.3.5",
     "vitest": "5.0.5"
   },
   "engines": {

package/skills/durable-observability/SKILL.md

@@ -46,12 +46,18 @@ export default defineConfig({
   // enabled: true,          // default true; false registers no routes at all
   path: '/durable',
   authorize: async (ctx) => {
-    await ctx.auth.check()
-    return ctx.auth.user?.isAdmin === true // denied requests get 403
+    // boolean | { allowed, reason?: 'unauthenticated' | 'forbidden' }
+    if (!(await ctx.auth.check())) return { allowed: false, reason: 'unauthenticated' } // 401
+    return ctx.auth.user?.isAdmin === true // false / { allowed: false } -> 403
   },
 })
 ```
 
+`authorize` returns `AuthorizeResult = boolean | AuthorizeDecision`
+(`{ allowed: boolean; reason?: 'unauthenticated' | 'forbidden' }`). Only `true`
+or `allowed: true` passes; `reason: 'unauthenticated'` → `401`, every other
+denial (incl. a throwing hook) → `403`. A hook that redirects keeps its redirect.
+
 The default `authorize` fails closed in **every** environment: it requires a
 bearer token equal to `DURABLE_DASHBOARD_TOKEN`, denying everything when that
 env var is unset. Open it up explicitly with `dashboardAuth`, your own