@adonis-agora/durable 0.21.1 → 0.22.0

package/dist/src/dashboard/auth.d.ts

@@ -11,15 +11,31 @@ import { type DashboardSession, type DashboardSessionUser } from './session_cook
  * When left unconfigured the dashboard behaves exactly as before (no login/logout routes, no
  * session guard).
  */
-/** Host hook validating submitted credentials from the built-in login page. */
+/** Host hook validating submitted credentials from the built-in login page (Mode B — standalone). */
 export type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
+/**
+ * Host hook validating the HOST APP's own auth off the raw request (Mode A — SSO / "open from your
+ * app"). Receives the underlying platform request object (an AdonisJS `Request['request']`, i.e. the
+ * raw Node `IncomingMessage`) rather than an AdonisJS type, so this module stays framework-light and
+ * unit-testable with no `HttpContext` — the provider passes it through untouched. Mirrors the NestJS
+ * sibling console's `SessionHook` byte-for-byte (same two-mode split).
+ */
+export type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
 /**
  * Author-facing `dashboardAuth` option on `config/durable_dashboard.ts`. Gates the dashboard behind
- * a signed session cookie via the built-in server-rendered login page (`GET <path>/login`) — the
- * bundled dashboard SPA stays untouched.
+ * a signed session cookie, minted by whichever mode(s) are configured:
+ *
+ * - Mode B (`login`) — the built-in server-rendered login page (`GET <path>/login`), for a
+ *   standalone console with its own credentials.
+ * - Mode A (`session`) — `POST <path>/session`, for a host app that's already authenticated the
+ *   operator itself and wants a one-shot "open the console" button (see `client/console-session.ts`).
+ *
+ * Both may be configured together; at least one is required. The bundled dashboard SPA is unaware of
+ * which mode(s) are active — it only reacts to a 401's `{ auth: { modes } }` body (see
+ * `durable-client.ts`).
  *
- * Nest needed a `forRootAsync` to reach app services from the `login` hook; AdonisJS does not — the
- * config module is a plain file and `login` is just a function that may be `async` and close over
+ * Nest needed a `forRootAsync` to reach app services from these hooks; AdonisJS does not — the config
+ * module is a plain file and each hook is just a function that may be `async` and close over
  * `app.container`/services (import them at the top of `config/durable_dashboard.ts`), so there is
  * nothing extra to build for the async case.
  */
@@ -30,20 +46,30 @@ export interface DashboardAuthOptions {
     ttl?: string;
     /** Validates submitted username/password; return the session user, or `null` to deny. Thrown
      *  errors are treated as a denial (logged once, never surfaced to the client). May be async. */
-    login: LoginHook;
+    login?: LoginHook;
+    /** Validates the host app's own auth off the raw request; return the session user, or `null` to
+     *  deny. Thrown errors are treated as a denial. May be async. */
+    session?: SessionHook;
 }
-/** Resolved, validated `dashboardAuth` config shared by the guard, the login handler, and the page. */
+/** Which auth surface(s) are active — carried on an API 401's `{ auth: { modes } }` body so the SPA
+ *  knows whether to offer the login page or just report "not authenticated". */
+export type AuthMode = 'session' | 'login';
+/** Resolved, validated `dashboardAuth` config shared by the guard, the login/session handlers, and
+ *  the page. */
 export interface ResolvedDashboardAuth {
     secret: string;
     ttlMs: number;
-    login: LoginHook;
+    modes: AuthMode[];
+    login?: LoginHook;
+    session?: SessionHook;
 }
 /** Cookie name carrying the signed dashboard session. */
 export declare const SESSION_COOKIE_NAME = "durable_dashboard_session";
 /**
  * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
  * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
- * secret or a `login` hook — the host learns immediately rather than shipping an un-mintable gate.
+ * secret, or neither `login` nor `session` is a function — the host learns immediately rather than
+ * shipping an un-mintable gate.
  */
 export declare function resolveDashboardAuth(options: DashboardAuthOptions | undefined): ResolvedDashboardAuth | null;
 /**
@@ -77,9 +103,28 @@ export type LoginOutcome = {
  * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
  * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
  * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
- * password is required.
+ * password is required. `404`-worthy (Mode B not configured) is the provider's call, not this
+ * function's — it only runs once the provider has confirmed `auth.login` exists.
  */
 export declare function performLogin(auth: ResolvedDashboardAuth, body: unknown, basePath: string, now?: number): Promise<LoginOutcome>;
+/**
+ * The framework-light outcome of a Mode A session-mint attempt (`POST <path>/session`), mapped to
+ * HTTP by the provider: `ok` → set the cookie, reply `204`; `unauthorized` → uniform `401` (the
+ * `session` hook returned/threw a denial).
+ */
+export type SessionOutcome = {
+    kind: 'ok';
+    cookieValue: string;
+} | {
+    kind: 'unauthorized';
+    hookError?: unknown;
+};
+/**
+ * Decide a Mode A session-mint attempt end-to-end: run the host's `session` hook against the raw
+ * platform request, and mint the cookie on success. No body to validate — the hook reads whatever it
+ * needs directly off `request` (its own cookie/JWT/header).
+ */
+export declare function performSession(auth: ResolvedDashboardAuth, request: unknown, now?: number): Promise<SessionOutcome>;
 /**
  * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
  * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.

package/dist/src/dashboard/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAG1B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,oBAAoB,GAAG,IAAI,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;oGACgG;IAChG,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,uGAAuG;AACvG,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAoB/D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GACxC,qBAAqB,GAAG,IAAI,CAgB9B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM7E;AAaD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAqBnE;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,CAiBvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,qBAAqB,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,CAAC,EAAE,MAAM,GACX,gBAAgB,GAAG,IAAI,CAMzB;AAED,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAG1B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AAEH,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,oBAAoB,GAAG,IAAI,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,oBAAoB,GAAG,IAAI,CAAC;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;oGACgG;IAChG,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;qEACiE;IACjE,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED;gFACgF;AAChF,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3C;gBACgB;AAChB,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAoB/D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GACxC,qBAAqB,GAAG,IAAI,CA0B9B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM7E;AAaD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAoBnE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,CAuBvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAElD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,CAAC,CAezB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,qBAAqB,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,CAAC,EAAE,MAAM,GACX,gBAAgB,GAAG,IAAI,CAMzB;AAED,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/src/dashboard/auth.js

@@ -22,7 +22,8 @@ function durationToMs(ttl) {
 /**
  * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
  * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
- * secret or a `login` hook — the host learns immediately rather than shipping an un-mintable gate.
+ * secret, or neither `login` nor `session` is a function — the host learns immediately rather than
+ * shipping an un-mintable gate.
  */
 export function resolveDashboardAuth(options) {
     if (options === undefined)
@@ -31,13 +32,23 @@ export function resolveDashboardAuth(options) {
         throw new Error('durable_dashboard: dashboardAuth.secret is required and must be a non-empty string ' +
             '(HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.');
     }
-    if (typeof options.login !== 'function') {
-        throw new Error('durable_dashboard: dashboardAuth.login is required (a login hook).');
+    const hasLogin = typeof options.login === 'function';
+    const hasSession = typeof options.session === 'function';
+    if (!hasLogin && !hasSession) {
+        throw new Error('durable_dashboard: dashboardAuth needs at least one of `login` or `session` (a login hook or ' +
+            'a host-session hook).');
     }
+    const modes = [];
+    if (hasSession)
+        modes.push('session');
+    if (hasLogin)
+        modes.push('login');
     return {
         secret: options.secret,
         ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-        login: options.login,
+        modes,
+        ...(hasLogin ? { login: options.login } : {}),
+        ...(hasSession ? { session: options.session } : {}),
     };
 }
 /**
@@ -62,13 +73,14 @@ function isString(value) {
 }
 const UNAUTHORIZED_MESSAGE = 'Invalid username or password.';
 /**
- * Run the host's `login` hook defensively: a throw is treated as a denial (uniform failure) so a
- * buggy hook never 500s the endpoint into a stack-trace leak. The thrown error is surfaced on the
- * outcome (`hookError`) so the provider can warn-log it once, but it never reaches the client.
+ * Run a host hook (`login` or `session`) defensively: a throw is treated as a denial (uniform
+ * failure) so a buggy hook never 500s the endpoint into a stack-trace leak. The thrown error is
+ * surfaced on the outcome (`hookError`) so the provider can warn-log it once, but it never reaches
+ * the client.
  */
-async function runLoginHook(auth, username, password) {
+async function runHook(hook) {
     try {
-        return { user: (await auth.login(username, password)) ?? null };
+        return { user: (await hook()) ?? null };
     }
     catch (error) {
         return { user: null, error };
@@ -78,14 +90,19 @@ async function runLoginHook(auth, username, password) {
  * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
  * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
  * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
- * password is required.
+ * password is required. `404`-worthy (Mode B not configured) is the provider's call, not this
+ * function's — it only runs once the provider has confirmed `auth.login` exists.
  */
 export async function performLogin(auth, body, basePath, now) {
     const parsed = (body ?? {});
     if (!isString(parsed.username) || !isString(parsed.password)) {
         return { kind: 'bad-request', message: 'Body must include string `username` and `password`.' };
     }
-    const { user, error } = await runLoginHook(auth, parsed.username, parsed.password);
+    const login = auth.login;
+    if (!login) {
+        return { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE };
+    }
+    const { user, error } = await runHook(() => login(parsed.username, parsed.password));
     if (!user) {
         return error !== undefined
             ? { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE, hookError: error }
@@ -98,6 +115,28 @@ export async function performLogin(auth, body, basePath, now) {
     });
     return { kind: 'ok', cookieValue, redirectTo: sanitizeReturnTo(parsed.returnTo, basePath) };
 }
+/**
+ * Decide a Mode A session-mint attempt end-to-end: run the host's `session` hook against the raw
+ * platform request, and mint the cookie on success. No body to validate — the hook reads whatever it
+ * needs directly off `request` (its own cookie/JWT/header).
+ */
+export async function performSession(auth, request, now) {
+    const session = auth.session;
+    if (!session)
+        return { kind: 'unauthorized' };
+    const { user, error } = await runHook(() => session(request));
+    if (!user) {
+        return error !== undefined
+            ? { kind: 'unauthorized', hookError: error }
+            : { kind: 'unauthorized' };
+    }
+    const cookieValue = signSessionCookie(user, {
+        secret: auth.secret,
+        ttlMs: auth.ttlMs,
+        ...(now !== undefined ? { now } : {}),
+    });
+    return { kind: 'ok', cookieValue };
+}
 /**
  * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
  * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.

package/dist/src/dashboard/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAgD7B,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,cAAc,GAA2B;IAC7C,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACvB,CAAC;AAEF,iGAAiG;AACjG,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,cAAc,CAAC;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyC;IAEzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB,EAAE,QAAgB;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAeD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAE7D;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA2B,EAC3B,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAA2B,EAC3B,IAAa,EACb,QAAgB,EAChB,GAAY;IAEZ,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAc,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE;YAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAA2B,EAC3B,WAA+B,EAC/B,GAAY;IAEZ,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,mBAAmB,CAAC,WAAW,EAAE;QACtC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/dashboard/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AA6E7B,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,cAAc,GAA2B;IAC7C,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACvB,CAAC;AAEF,iGAAiG;AACjG,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,cAAc,CAAC;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyC;IAEzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+FAA+F;YAC7F,uBAAuB,CAC1B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;QAC/C,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB,EAAE,QAAgB;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAeD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAE7D;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CACpB,IAA8E;IAE9E,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAA2B,EAC3B,IAAa,EACb,QAAgB,EAChB,GAAY;IAEZ,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAc,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACzC,KAAK,CAAC,MAAM,CAAC,QAAkB,EAAE,MAAM,CAAC,QAAkB,CAAC,CAC5D,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE;YAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B,EAC3B,OAAgB,EAChB,GAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAA2B,EAC3B,WAA+B,EAC/B,GAAY;IAEZ,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,mBAAmB,CAAC,WAAW,EAAE;QACtC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/dashboard/gateway-adapter.d.ts

@@ -1,19 +1,65 @@
+import type { EngineEvent, RunResult } from '../interfaces.js';
 import type { RunGateway } from '../run-gateway/interface.js';
 import type { DashboardEngine } from './handlers.js';
+/**
+ * The slice of {@link import('../engine.js').WorkflowEngine} a store role's {@link
+ * storeDashboardEngine} delegates to. Declared structurally (not by importing the concrete class) so
+ * this module depends only on the verbs it forwards — mirrors `run-gateway/store-run-gateway.ts`'s
+ * `RunGatewayEngine` pattern. The real `WorkflowEngine` is structurally assignable to this (every
+ * method here — including `retryWithInput`, `continue`, and the global `subscribe` — already exists
+ * on it).
+ */
+export interface StoreEngineLike {
+    getRun: DashboardEngine['getRun'];
+    listRuns: DashboardEngine['listRuns'];
+    listCheckpoints: DashboardEngine['listCheckpoints'];
+    getRunChildren: DashboardEngine['getRunChildren'];
+    requeue: DashboardEngine['requeue'];
+    redispatchPending?: DashboardEngine['redispatchPending'];
+    cancel: DashboardEngine['cancel'];
+    workerHealth: DashboardEngine['workerHealth'];
+    retryWithInput(runId: string, input: unknown, newRunId?: string): Promise<{
+        runId: string;
+    } | null>;
+    continue(runId: string): Promise<RunResult | null>;
+    /** The engine's GLOBAL listener (every run) — {@link storeDashboardEngine} filters it to one run,
+     *  same as `StoreRunGateway.subscribe` does. */
+    subscribe(listener: (event: EngineEvent) => void): () => void;
+}
+/**
+ * Adapt a store-backed {@link import('../engine.js').WorkflowEngine} to the {@link DashboardEngine}
+ * port — an explicit wrapper (not a raw `as DashboardEngine` cast) because two verbs need shape
+ * bridging, not just a type assertion:
+ * - `subscribe(runId, onEvent)` — the engine's `subscribe` is a GLOBAL listener with no `runId`
+ *   filter; this narrows it to one run's events, byte-for-byte the same filter `StoreRunGateway`
+ *   already applies.
+ * - `redispatchPending` — degrades to `null` when the engine lacks it (kept optional for the same
+ *   reason `RunGatewayEngine.redispatchPending` is: not every engine build has it yet).
+ * Every other verb (including `retryWithInput`/`continue`, which the AdonisJS engine already
+ * implements) forwards 1:1 — behavior unchanged from a plain cast for those.
+ */
+export declare function storeDashboardEngine(engine: StoreEngineLike): DashboardEngine;
 /**
  * Adapt a {@link RunGateway} to the {@link DashboardEngine} port the JSON handlers drive, so a
  * **store-less `tenant` pod** serves the SAME dashboard over the wire (design §8) — every read/control
  * verb round-trips through the pod's `ProxyRunGateway` to the control plane, with NO local store or
  * engine. Store presence stays invisible above the handler line.
  *
- * The gateway is a near-superset of the port; two verbs need bridging:
+ * The gateway is a near-superset of the port; three verbs need bridging:
  * - `listCheckpoints` → the gateway's `getCheckpoints` (same shape, §8 naming);
  * - `requeue` → the gateway's `redispatchPending` (the operator recovery verb; the extra
- *   `redispatched` count on the result is a harmless superset of `RunResult`).
+ *   `redispatched` count on the result is a harmless superset of `RunResult`);
+ * - `subscribe(runId, onEvent)` → the gateway's own per-run `subscribe` (already scoped, no filtering
+ *   needed here — unlike the store-role adapter above).
  *
- * `getRunChildren` (parent→child fan-out) now rides the P4 read surface too (a `getRunChildren`
+ * `getRunChildren` (parent→child fan-out) rides the P4 read surface too (a `getRunChildren`
  * `RunRequestKind` verb), so a store-less tenant pod's run detail view lists children round-tripped over
  * the wire — the responder enforces the tenant-ownership check before answering (anti-IDOR).
+ *
+ * `retryWithInput`/`continue` have NO gateway verb yet (design §8 didn't need fix-and-replay or
+ * breakpoint-continue over the wire) — they degrade to `null`, same convention as
+ * `RunGatewayEngine.redispatchPending`'s optional degrade. A tenant pod's dashboard therefore shows
+ * these actions as unavailable (the handlers 404) until the wire protocol grows the verbs.
  */
 export declare function gatewayDashboardEngine(gateway: RunGateway): DashboardEngine;
 /** The minimal container surface {@link dashboardEngineForRole} resolves bindings through. */
@@ -27,8 +73,9 @@ export interface DashboardContainer {
  * - **`tenant`** (store-less): resolve the {@link DURABLE_RUN_GATEWAY} token (a `ProxyRunGateway`) and
  *   adapt it — the engine binding is deliberately ABSENT on a tenant pod (structural isolation), so we
  *   MUST NOT reach for `WorkflowEngine` here;
- * - **store roles** (`standalone`/`control-plane`): resolve the concrete `WorkflowEngine` (structurally a
- *   {@link DashboardEngine}) exactly as before — behavior byte-for-byte unchanged.
+ * - **store roles** (`standalone`/`control-plane`): resolve the concrete `WorkflowEngine` and adapt it
+ *   via {@link storeDashboardEngine} — every verb still forwards 1:1, just through an explicit wrapper
+ *   instead of a raw cast (see that function's doc for why).
  *
  * `engineToken` is injected (rather than imported) so the module doesn't hard-depend on the engine class
  * for the tenant path — the tenant branch never touches it.

package/dist/src/dashboard/gateway-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-adapter.d.ts","sourceRoot":"","sources":["../../../src/dashboard/gateway-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,eAAe,CAW3E;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,QAAQ,EAC/C,SAAS,EAAE,kBAAkB,EAC7B,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,eAAe,CAAC,CAM1B"}
+{"version":3,"file":"gateway-adapter.d.ts","sourceRoot":"","sources":["../../../src/dashboard/gateway-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IACtC,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IACpD,cAAc,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,iBAAiB,CAAC,EAAE,eAAe,CAAC,mBAAmB,CAAC,CAAC;IACzD,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;IAC9C,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACnD;oDACgD;IAChD,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAC/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAiB7E;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,eAAe,CAc3E;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,QAAQ,EAC/C,SAAS,EAAE,kBAAkB,EAC7B,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,eAAe,CAAC,CAO1B"}

package/dist/src/dashboard/gateway-adapter.js

@@ -1,18 +1,55 @@
 import { DURABLE_RUN_GATEWAY } from '../role_bindings.js';
+/**
+ * Adapt a store-backed {@link import('../engine.js').WorkflowEngine} to the {@link DashboardEngine}
+ * port — an explicit wrapper (not a raw `as DashboardEngine` cast) because two verbs need shape
+ * bridging, not just a type assertion:
+ * - `subscribe(runId, onEvent)` — the engine's `subscribe` is a GLOBAL listener with no `runId`
+ *   filter; this narrows it to one run's events, byte-for-byte the same filter `StoreRunGateway`
+ *   already applies.
+ * - `redispatchPending` — degrades to `null` when the engine lacks it (kept optional for the same
+ *   reason `RunGatewayEngine.redispatchPending` is: not every engine build has it yet).
+ * Every other verb (including `retryWithInput`/`continue`, which the AdonisJS engine already
+ * implements) forwards 1:1 — behavior unchanged from a plain cast for those.
+ */
+export function storeDashboardEngine(engine) {
+    return {
+        getRun: (runId) => engine.getRun(runId),
+        listRuns: (query) => engine.listRuns(query),
+        listCheckpoints: (runId) => engine.listCheckpoints(runId),
+        getRunChildren: (runId) => engine.getRunChildren(runId),
+        requeue: (runId) => engine.requeue(runId),
+        redispatchPending: (runId) => engine.redispatchPending?.(runId) ?? Promise.resolve(null),
+        cancel: (runId, opts) => engine.cancel(runId, opts),
+        workerHealth: (extra) => engine.workerHealth(extra),
+        retryWithInput: (runId, input) => engine.retryWithInput(runId, input),
+        continue: (runId) => engine.continue(runId),
+        subscribe: (runId, onEvent) => engine.subscribe((event) => {
+            if (event.runId === runId)
+                onEvent(event);
+        }),
+    };
+}
 /**
  * Adapt a {@link RunGateway} to the {@link DashboardEngine} port the JSON handlers drive, so a
  * **store-less `tenant` pod** serves the SAME dashboard over the wire (design §8) — every read/control
  * verb round-trips through the pod's `ProxyRunGateway` to the control plane, with NO local store or
  * engine. Store presence stays invisible above the handler line.
  *
- * The gateway is a near-superset of the port; two verbs need bridging:
+ * The gateway is a near-superset of the port; three verbs need bridging:
  * - `listCheckpoints` → the gateway's `getCheckpoints` (same shape, §8 naming);
  * - `requeue` → the gateway's `redispatchPending` (the operator recovery verb; the extra
- *   `redispatched` count on the result is a harmless superset of `RunResult`).
+ *   `redispatched` count on the result is a harmless superset of `RunResult`);
+ * - `subscribe(runId, onEvent)` → the gateway's own per-run `subscribe` (already scoped, no filtering
+ *   needed here — unlike the store-role adapter above).
  *
- * `getRunChildren` (parent→child fan-out) now rides the P4 read surface too (a `getRunChildren`
+ * `getRunChildren` (parent→child fan-out) rides the P4 read surface too (a `getRunChildren`
  * `RunRequestKind` verb), so a store-less tenant pod's run detail view lists children round-tripped over
  * the wire — the responder enforces the tenant-ownership check before answering (anti-IDOR).
+ *
+ * `retryWithInput`/`continue` have NO gateway verb yet (design §8 didn't need fix-and-replay or
+ * breakpoint-continue over the wire) — they degrade to `null`, same convention as
+ * `RunGatewayEngine.redispatchPending`'s optional degrade. A tenant pod's dashboard therefore shows
+ * these actions as unavailable (the handlers 404) until the wire protocol grows the verbs.
  */
 export function gatewayDashboardEngine(gateway) {
     return {
@@ -24,6 +61,9 @@ export function gatewayDashboardEngine(gateway) {
         redispatchPending: (runId) => gateway.redispatchPending(runId),
         cancel: (runId, opts) => gateway.cancel(runId, opts),
         workerHealth: () => gateway.workerHealth(),
+        retryWithInput: () => Promise.resolve(null),
+        continue: () => Promise.resolve(null),
+        subscribe: (runId, onEvent) => gateway.subscribe(runId, onEvent),
     };
 }
 /**
@@ -33,8 +73,9 @@ export function gatewayDashboardEngine(gateway) {
  * - **`tenant`** (store-less): resolve the {@link DURABLE_RUN_GATEWAY} token (a `ProxyRunGateway`) and
  *   adapt it — the engine binding is deliberately ABSENT on a tenant pod (structural isolation), so we
  *   MUST NOT reach for `WorkflowEngine` here;
- * - **store roles** (`standalone`/`control-plane`): resolve the concrete `WorkflowEngine` (structurally a
- *   {@link DashboardEngine}) exactly as before — behavior byte-for-byte unchanged.
+ * - **store roles** (`standalone`/`control-plane`): resolve the concrete `WorkflowEngine` and adapt it
+ *   via {@link storeDashboardEngine} — every verb still forwards 1:1, just through an explicit wrapper
+ *   instead of a raw cast (see that function's doc for why).
  *
  * `engineToken` is injected (rather than imported) so the module doesn't hard-depend on the engine class
  * for the tenant path — the tenant branch never touches it.
@@ -44,6 +85,7 @@ export async function dashboardEngineForRole(role, container, engineToken) {
         const gateway = (await container.make(DURABLE_RUN_GATEWAY));
         return gatewayDashboardEngine(gateway);
     }
-    return (await container.make(engineToken));
+    const engine = (await container.make(engineToken));
+    return storeDashboardEngine(engine);
 }
 //# sourceMappingURL=gateway-adapter.js.map

package/dist/src/dashboard/gateway-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-adapter.js","sourceRoot":"","sources":["../../../src/dashboard/gateway-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAI1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAmB;IACxD,OAAO;QACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;QACzD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;QACxD,OAAO,EAAE,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAC/E,iBAAiB,EAAE,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACzF,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QACpD,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;KAC3C,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA+C,EAC/C,SAA6B,EAC7B,WAAoB;IAEpB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAe,CAAC;QAC1E,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAoB,CAAC;AAChE,CAAC"}
+{"version":3,"file":"gateway-adapter.js","sourceRoot":"","sources":["../../../src/dashboard/gateway-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAgC1D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,OAAO;QACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC;QACzD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC;QACvD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACxF,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QACnD,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC;QACnD,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC;QACrE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC3C,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAC5B,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAmB;IACxD,OAAO;QACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5C,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;QACzD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC;QACxD,OAAO,EAAE,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAC/E,iBAAiB,EAAE,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACzF,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QACpD,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1C,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;KACjE,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA+C,EAC/C,SAA6B,EAC7B,WAAoB;IAEpB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAe,CAAC;QAC1E,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAoB,CAAC;IACtE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/dashboard/handlers.d.ts

@@ -1,4 +1,4 @@
-import type { GroupHealth, RunQuery, RunResult, StepCheckpoint, WorkflowRun } from '../index.js';
+import type { EngineEvent, GroupHealth, RunQuery, RunResult, StepCheckpoint, WorkflowRun } from '../index.js';
 /**
  * Framework-light JSON handlers over a {@link DashboardEngine}.
  *
@@ -11,15 +11,24 @@ import type { GroupHealth, RunQuery, RunResult, StepCheckpoint, WorkflowRun } fr
  * leak in, so the handlers are unit-testable against a real in-memory engine
  * with no HTTP server. The provider adapts an AdonisJS `HttpContext` to these
  * shapes.
+ *
+ * `listRuns`/`getRun`/`retryRun`/`redispatchPendingRun`/`cancelRun`/`health` are the original
+ * handlers this file always had (kept response-shape compatible with the legacy static
+ * `assets/dashboard.html`, still served as a compat fallback — see `compat.ts`/`compat-view.ts`).
+ * `workers`, `topology`, `retryWithInputRun`, `continueRun`, and `bulkAction` are additions that give
+ * the new `@adonis-agora/durable-dashboard` React SPA parity with `@dudousxd/nestjs-durable-dashboard`'s
+ * `DurableApiController` (fix-and-replay, bulk retry/cancel, breakpoint continue, full worker
+ * heartbeats, topology badge). The SSE `runs/:id/stream` route is wired directly in
+ * `providers/dashboard_provider.ts` since streaming needs the raw HTTP response, not a JSON `ApiResponse`.
  */
 /**
  * The bounded read/control surface the JSON handlers drive — declared STRUCTURALLY (a port), not by
  * importing the concrete `WorkflowEngine` class, so the same handlers serve BOTH durable topologies
- * (design §8): a store role passes the real {@link import('../engine.js').WorkflowEngine} (structurally
- * assignable — it has every method here); a store-less `tenant` pod passes an adapter over its
- * {@link import('../run-gateway/interface.js').RunGateway} (see `gatewayDashboardEngine`). Store presence
- * is therefore invisible to the handlers. Mirrors the `RunGatewayEngine` port pattern already used by
- * `StoreRunGateway`.
+ * (design §8): a store role passes an adapter over the real {@link
+ * import('../engine.js').WorkflowEngine} (`storeDashboardEngine`); a store-less `tenant` pod passes an
+ * adapter over its {@link import('../run-gateway/interface.js').RunGateway} (`gatewayDashboardEngine`).
+ * Store presence is therefore invisible to the handlers. Mirrors the `RunGatewayEngine` port pattern
+ * already used by `StoreRunGateway`.
  */
 export interface DashboardEngine {
     getRun(runId: string): Promise<WorkflowRun | null>;
@@ -32,6 +41,17 @@ export interface DashboardEngine {
         compensate?: boolean;
     }): Promise<RunResult | null>;
     workerHealth(extra?: string[]): Promise<GroupHealth[]>;
+    /** Fix-and-replay: start a fresh linked run from `runId`'s workflow with a corrected `input`. Returns
+     *  the new run's id, or `null` if `runId` is unknown. Degrades to `null` on a topology that can't
+     *  perform it yet (a store-less `tenant` pod — see `gateway-adapter.ts`). */
+    retryWithInput(runId: string, input: unknown): Promise<{
+        runId: string;
+    } | null>;
+    /** Resume a run paused at a `ctx.breakpoint()`. Returns `null` if the run isn't paused at one, or on
+     *  a topology that can't perform it yet (see `retryWithInput`). */
+    continue(runId: string): Promise<RunResult | null>;
+    /** Live lifecycle events for ONE run; returns an unsubscribe fn. */
+    subscribe(runId: string, onEvent: (event: EngineEvent) => void): () => void;
 }
 /** The read/control port the handlers operate over (a store engine or a tenant gateway adapter). */
 export interface Deps {
@@ -53,7 +73,7 @@ export interface ApiResponse {
 }
 /** A `200 OK` JSON response. Exported so sibling handlers (e.g. `compat`) share one convention. */
 export declare const ok: (body: unknown) => ApiResponse;
-/** `GET /runs` — list runs filtered by status/workflow/tag, paginated. */
+/** `GET /runs` — list runs filtered by status/workflow/tag/namespace/search-attributes, paginated. */
 export declare function listRuns(deps: Deps, req: ApiRequest): Promise<ApiResponse>;
 /** `GET /runs/:id` — a run's detail: the run, its step timeline, and child run ids. */
 export declare function getRun(deps: Deps, req: ApiRequest): Promise<ApiResponse>;
@@ -72,6 +92,34 @@ export declare function retryRun(deps: Deps, req: ApiRequest): Promise<ApiRespon
 export declare function redispatchPendingRun(deps: Deps, req: ApiRequest): Promise<ApiResponse>;
 /** `POST /runs/:id/cancel` — cancel a run. Pass `{ compensate: true }` to undo the saga first. */
 export declare function cancelRun(deps: Deps, req: ApiRequest): Promise<ApiResponse>;
-/** `GET /health` — per-group worker health (queue backlog + live worker heartbeats). */
+/**
+ * `POST /runs/:id/retry-with-input` — fix-and-replay: start a fresh linked run of `runId`'s workflow
+ * with a corrected `input`. Body: `{ input: unknown }`. Returns the new run's id; the ORIGINAL run is
+ * left untouched (mirrors `@dudousxd/nestjs-durable-dashboard`'s `retryWithInput`).
+ */
+export declare function retryWithInputRun(deps: Deps, req: ApiRequest): Promise<ApiResponse>;
+/**
+ * `POST /runs/:id/continue` — resume a run paused at a {@link import('../interfaces.js').WorkflowCtx}
+ * breakpoint (the dashboard's "continue" button). `404` if the run isn't paused at one.
+ */
+export declare function continueRun(deps: Deps, req: ApiRequest): Promise<ApiResponse>;
+/**
+ * `POST /bulk/:action` (`action` = `retry`|`cancel`) — apply an action to every run matching the same
+ * filter `listRuns` accepts (status/workflow/tag/namespace/attr), capped at 500 matches. Skips (does
+ * not abort on) a run that can't take the action (e.g. already terminal). Mirrors
+ * `@dudousxd/nestjs-durable-dashboard`'s `DashboardService.bulk`.
+ */
+export declare function bulkAction(deps: Deps, req: ApiRequest): Promise<ApiResponse>;
+/** `GET /health` — per-group worker health (queue backlog + live worker heartbeats), reduced to a
+ *  compact shape. Kept for the legacy static dashboard (`assets/dashboard.html`, compat fallback). */
 export declare function health(deps: Deps): Promise<ApiResponse>;
+/** `GET /workers` — full per-group worker health (every live worker's heartbeat, not just a count),
+ *  for the new SPA's Workers panel (`pivot-by-worker.ts`/`group-by-partition.ts` need per-instance
+ *  `instanceId`/`lastBeatAt`). Raw `GroupHealth[]`, unwrapped — matches
+ *  `@dudousxd/nestjs-durable-dashboard`'s `GET /workers` shape byte for byte (minus the `status`
+ *  telemetry field, which the AdonisJS engine's heartbeat doesn't carry — see `durable-client.ts`). */
+export declare function workers(deps: Deps): Promise<ApiResponse>;
+/** `GET /topology` — this deployment's durable role, for the header badge. Pure/local (no engine
+ *  round-trip): the role is already known by `dashboard_provider.ts` from `config/durable.ts`. */
+export declare function topology(role: 'standalone' | 'control-plane' | 'tenant', tenant?: string): ApiResponse;
 //# sourceMappingURL=handlers.d.ts.map

package/dist/src/dashboard/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/dashboard/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,QAAQ,EACR,SAAS,EAET,cAAc,EACd,WAAW,EACZ,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;GAYG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClF,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CACxD;AAED,oGAAoG;AACpG,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACrD,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,mGAAmG;AACnG,eAAO,MAAM,EAAE,GAAI,MAAM,OAAO,KAAG,WAAsC,CAAC;AAqC1E,0EAA0E;AAC1E,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAqBhF;AAED,uFAAuF;AACvF,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAe9E;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMhF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAM5F;AAED,kGAAkG;AAClG,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAUjF;AAED,wFAAwF;AACxF,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAW7D"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/dashboard/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,QAAQ,EACR,SAAS,EAET,cAAc,EACd,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClF,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD;;iFAE6E;IAC7E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF;uEACmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACnD,oEAAoE;IACpE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAC7E;AAED,oGAAoG;AACpG,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACrD,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,mGAAmG;AACnG,eAAO,MAAM,EAAE,GAAI,MAAM,OAAO,KAAG,WAAsC,CAAC;AA+D1E,sGAAsG;AACtG,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAahF;AAED,uFAAuF;AACvF,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAe9E;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMhF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAM5F;AAED,kGAAkG;AAClG,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAUjF;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAOzF;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMnF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0BlF;AAED;sGACsG;AACtG,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAW7D;AAED;;;;uGAIuG;AACvG,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAG9D;AAED;kGACkG;AAClG,wBAAgB,QAAQ,CACtB,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,QAAQ,EAC/C,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,CAEb"}